Silverstack Solutions Ltd ("we", "us"), registered in England and Wales, is the data controller for StoreDeck. This policy explains what we store and why.
What we collect
Account data
Your email address, name, team roles, store access and sign-in records, used to run your account and authenticate you, among them the browsers you have signed in from, each a scrambled random marker, or for a sign-in made without the app a scrambled mix of its browser's name and its internet address, so a sign-in from a new one is emailed to you, your passkeys (each a public key, never your face or fingerprint, which stay on your device, with the name of what saved it and when it was added and last used), and which of your stores you have opened, so one you have not reads New. When you create an account with the sign-up form we check that the address's domain accepts mail and refuse disposable inboxes; only the domain is looked up, nothing about you. If you sign up or sign in with Google, Google sends us your Google account's address, name and profile picture each time, which we keep with your sign-in, its name becoming your profile's when Google makes your account; we ask Google for nothing more.
Bookkeeping data you enter
Orders, listings and their product photos and descriptions, stock and the deliveries you receive, expenses, inventory, payouts, payments to people, the owner's drawings and related business records, including the buyer's name, contact details and delivery address where you record them on an order, which a processor you name on the order reads until they add their own order number to it. Receipts, invoices and product photos are kept as private files, each with who uploaded it, and opened through a link that expires within the hour. This is your data; we process it solely to provide the service.
Data from a sales channel you connect
Connecting a store to eBay keeps the access eBay grants for it, held by StoreDeck's servers alone and never sent to a browser, your eBay account's id and username, and a record of each sync and of each quantity it set on your eBay listings where you switch that on. The sync brings in your orders, with each buyer's name, delivery address, contact and eBay username, their fees, refunds and returns, your payouts and eBay's charges, and your listings, each kept with your books as a record you typed would be, under eBay's API License Agreement. A synced listing's photos are kept as their addresses alone and shown from eBay's own picture servers, so your browser asks eBay for them, as eBay's own pages do. For a listing not yet on eBay, the listing form sends eBay the words you type to find its category and reads your business policies and item locations; what you choose is kept with the listing, and an item location you add sends eBay its postcode. Publishing a listing sends eBay what the listing is, and its photos as links that last a day, which eBay copies to its own servers. A refund or a cancellation you send from an order tells eBay the order, the amount and the reason, and StoreDeck keeps who sent it. Your conversations with buyers on eBay are read too and kept with the store: what each buyer and your store wrote, the buyer's username, the listing it is about and any file's address on eBay, read by whoever reads the store's orders. A reply typed in StoreDeck is sent to eBay by a person's own action, with who sent it kept beside it. When eBay tells us an eBay account has closed, we erase what we hold of it that day: the buyer's name, address, contact and username on every order it made, the orders' money kept, their conversations with any store, and the account's id, username and access on any connection; a coded mark of it, which cannot be turned back into it, is kept so its details stay erased. Disconnecting ends the access and keeps the records.
Partner, investor and processor records
The name, email address and agreed terms of each partner, investor or processor you add, the shares recorded for them, and for the cards and bank accounts an investor or processor pays with only the scheme, the bank and the last four digits. We never store a full card or account number. These people see only their own record when they sign in, and each of them adds and edits their own payment methods from their own settings. The owner's accountant, on the stores the owner gives them, reads every record the owner reads there, these included, and changes none of them.
Billing data
Your subscription status, plan, and invoice history. Payments are processed by Stripe; we never see or store card numbers. Stripe collects your billing address and, where applicable, VAT number for tax purposes.
Collaboration content
Posts, comments and mentions in your store feed, visible to your account's team.
Notifications
What happened in your stores that concerns you, for the bell in the app: a mention or a reply with the words it quotes, a product at or below its reorder point with the order that last sold it, an invitation accepted with the name of the person who joined, or asked for again or run out with their name or address and role, a stock count completed with its name, who completed it and how many of its lines differ, a co-owner's payment to themselves with its amount and stores, and on the 1st of each month the profit shares owed, with the name of each person owed, the records they are paid through and what they were owed and had been paid then. For an account's owners too: a month reconciled with its books still open, a store's financial year about to end, a store nearing its tax registration threshold with its net sales and the threshold, every place on the plan taken, a payment for the plan that did not go through, a store's connection to its sales channel needing its owner (to be connected again, paused, or not synced for an hour) with the store, the channel and the seller account's name there, and a payout a sales channel sent to the bank with its amount, date and reference. For the members and VAs who pack a store's orders: new orders a sales channel sends in, with how many and the latest order number. For whoever writes a store's orders: a payment dispute a sales channel took money for, with its amount and the channel's words, a return a buyer opened on an order a sales channel sent, with the order number and the units to come back, and a buyer's message on a sales channel, with the listing it is about and never the buyer or what they wrote. For the people paid out of the business: a payment to them with each store's part, its references and who recorded it; a change to their terms with the stores, the rate, the rate before it, the day it runs from and who made it; a repayment of the goods their cards bought, or goods marked unpaid, with its date, its reference, who recorded it and each order's or delivery's date, goods cost and a processor's own order number; and orders added for them to place with their product, units, goods cost, the day to dispatch by and who added them. For the owner's accountant: a store's Lock date moved earlier, with the store, the date it was locked up to before, the date it runs to now and who moved it. Each is seen only by the person it is for and kept for 90 days. A notice goes when the record it is about is deleted, with these exceptions: a payment to you that is deleted is told as deleted, goods marked unpaid are told in a notice of their own, and a notice of a change to your terms stays. Each is also emailed to you, unless you have turned its kind off in Settings, Notifications: we keep which kinds you turned off, and when each notice's email went.
Activity records
An audit trail of who added, changed or deleted each record or file and when, kept so your books can be checked. The person who created a record is shown beside it to everyone who can see that record.
Messages and problem reports
What you send through the contact form or the Help button in the app: your name, email address and message. A report sent from inside the app also carries the page you were on, the store, your role, the account, the app version, your screen size, the page address and the last few errors the app hit, so we can reproduce the problem. Both record the sending IP address and browser identification to limit abuse.
Usage statistics
To make StoreDeck better we count how the app is used: which pages are opened, whether a few key tasks (adding an order, recording a return, paying a share, receiving stock, adding a virtual assistant) are completed or left and at which field, how long they took, and the type and code location of any error the app hits. Each count carries the account, the role and whether a phone, tablet or laptop was used, and never a name, a figure, anything you type or an error's message. It sets no cookie, keeps nothing on your device, is kept for 13 months and is shared with no one. You can turn it off for yourself at any time in Settings, under Profile.
Technical basics
What your browser keeps on this device, and why, is set out under Cookies and local storage below. We do not run advertising or cross-site tracking.
The camera, when you scan
Scanning barcodes to count or receive stock uses your device's camera, only after you allow it and only while the scanner is open. The picture is read on your device to find each code and is never stored or sent to us; what is saved is the count or the delivery line the scan changed, as if you had typed it.
Who processes it
We use a small set of processors, each bound by their own data-processing terms:
We do not sell personal data, and we do not share it with anyone else except where the law requires.
Retention and your rights
Your bookkeeping data is kept while your account exists. Deleting records in the app soft-deletes them; closed accounts are archived, not silently erased, so your books can be recovered - contact us for permanent erasure.
A new address you ask to sign in with is kept until its link is opened, or for as long as the link works.
When an email we send cannot be delivered (it bounced, was marked as spam, was delayed or was not sent), we keep the address, which email it was and the reason Resend gave for 30 days, so we can put it right.
A receipt, invoice or product photo you delete, on its own or with its record, is kept for 30 days so it can be restored, then removed for good, the file and its details together. One behind a record in a period you have locked is kept with your books.
A nightly backup copy of the books is kept for 30 days, and a file's backup copy goes the night after the file itself is removed for good.
Buyer details on an order, and buyers' messages, can be erased from within the app once your own retention period has passed, while the financial record is kept; a sync does not bring back what was erased. Those a sales channel sends are kept and erased the same way, and erased the day the channel tells us the buyer's account has closed; erased details leave the backup copies as those copies reach 30 days.
Invoices and payment records are retained as required for tax and accounting law.
You may request access to, correction of, export of, or deletion of your personal data at any time: support@storedeck.org. You also have the right to complain to the ICO (ico.org.uk).
Security
Data is encrypted in transit, access is scoped per account, per store and per role with database-enforced rules, and secret keys never reach the browser. Payment card data is handled entirely by Stripe (PCI DSS Level 1).
Changes
We will notify material changes to this policy in the app or by email before they take effect.