Privacy Policy & GDPR

This Privacy Policy describes how AI Hub and Co FZE ("we", "us"), publisher of StockyTrack, collects, uses, retains and protects your personal data when you use our website and our Service.

For account and billing data, we act as data controller. For the business data you import into StockyTrack (products, orders, customers, suppliers), we act as data processor on your behalf: you remain the controller of that data.

This policy supplements the Terms & Conditions; where they conflict on data protection matters, this policy prevails.

We comply with two principal frameworks:

—The General Data Protection Regulation (EU) 2016/679 ("GDPR"), applicable whenever our users are located in the European Union or the European Economic Area.

—UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), applicable to our establishment in Sharjah, together with the regulations of the Sharjah Publishing City Free Zone.

Where both frameworks apply, we follow the standard that is more protective of you.

3.1 Account data

First and last name, email address, password (hashed with BCrypt, never stored in plain text), job title, language, company and phone number.

3.2 Usage and technical data

Login logs, IP address, session identifiers and preferences (language, dashboard layout), required for the security and proper operation of the Service.

3.3 Business data (for which you remain controller)

Products, stock, orders, customers, suppliers, documents and images you import into the Service. They are never used for any purpose other than providing the Service.

3.4 Billing data

Subscription history, invoices and Stripe identifiers. Card numbers never pass through our servers (see Section 5).

—Providing and operating the Service — performance of the contract (Art. 6(1)(b) GDPR).

—Billing, accounting and tax obligations — legal obligation (Art. 6(1)(c) GDPR).

—Security, fraud and abuse prevention — legitimate interest (Art. 6(1)(f) GDPR).

—Transactional emails (activation, invoices, stock alerts) — performance of the contract; marketing communications only with your consent (Art. 6(1)(a) GDPR), revocable at any time.

All payments are processed by Stripe, a PCI-DSS Level 1 certified payment provider. Your card details are entered directly into Stripe's secure interfaces and never pass through our servers.

For payment processing, Stripe acts as an independent data controller under its own privacy policy, available at stripe.com/privacy.

We only receive from Stripe the information needed to manage your subscription: customer identifier, subscription status, last four digits of the card, renewal dates and billing history.

Cardholder details and personally identifiable information are never stored, sold, shared, rented or leased to third parties. Card details are never passed on by us to third parties: they are entered directly with Stripe, a PCI-DSS-certified provider, and never transit through our servers.

The Service is hosted in the European Union (Frankfurt, Germany). We rely on the following sub-processors:

—Stripe — payment processing

—MongoDB Atlas — database

—Google Cloud Platform — infrastructure

—Cloudflare — file storage and CDN

—Brevo — transactional email delivery

—Render — application hosting (Frankfurt region, EU)

Each sub-processor is bound by a GDPR-compliant Data Processing Agreement (DPA).

Service data is hosted in the EU. Where a transfer outside the EU/EEA is necessary — for example to our establishment in the United Arab Emirates or to sub-processors located in the United States — it is safeguarded by the European Commission's Standard Contractual Clauses (SCCs) or an equivalent recognised transfer mechanism.

Cross-border transfers from the United Arab Emirates comply with the requirements of Articles 22 and 23 of the PDPL.

—Account data: for the lifetime of the account, then deleted or anonymised within twelve (12) months of closure.

—Business data: deleted on request or upon account closure, in accordance with the Terms & Conditions.

—Billing data: retained for the statutory period required by applicable tax and accounting law.

—Technical logs: retained for a maximum of twelve (12) months.

9.1 GDPR rights (EU/EEA)

Access, rectification, erasure, restriction of processing, portability, objection, withdrawal of consent at any time, and the right to lodge a complaint with your supervisory authority.

9.2 PDPL rights (UAE)

The PDPL grants you equivalent rights: access, rectification, erasure, restriction, objection and portability, as well as recourse to the UAE Data Office.

9.3 Exercising your rights

Write to us at contact@stockytrack.com. We respond within thirty (30) days. Proof of identity may be requested.

Encryption in transit (TLS), passwords hashed with BCrypt, time-limited sessions with automatic logout after inactivity, strict per-account data isolation (multi-tenant), role-based access control and operation logging.

In the event of a data breach likely to result in a risk to your rights, we will notify the competent authority and the affected individuals within the timeframes set by the GDPR (72 hours) and the PDPL.

Data privacy and security are ensured through appropriate hardware and software measures (encryption in transit and at rest, strict access control). However, as no online data transmission can be guaranteed fully secure, we cannot guarantee absolute security.

StockyTrack only uses essential cookies: authentication session and language preference. We use no advertising cookies or third-party trackers for profiling purposes.

The consent banner lets you accept or decline any non-essential cookies.

We may update this policy; the last-updated date appears at the top of the page. In the event of a substantial change, we will inform you by email or through the Service.

For any data protection enquiry: contact@stockytrack.com.

The website may contain links to third-party websites whose privacy practices we do not control: please consult their policies directly. These policies and the Terms may be updated from time to time; modifications take effect on the day they are posted on this page — please check back frequently.