Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the Terms of Service between StockTime (“we”, the processor) and the shop that uses StockTime (“you”, the controller). It applies when we process personal data for you, for example the customers, staff and suppliers you record in the app. It is meant to meet Article 28 of the EU GDPR and the Turkish KVKK.

1. What we process

• Subject matter and purpose: running StockTime for you — stock, sales, invoices, customer debts, staff accounts, reports, backups and the services you choose to connect.
• Types of data: names, phone numbers, e-mail addresses, invoice and payment records, staff names and log-ins, and anything else you choose to write in the app.
• People concerned: your customers, staff, suppliers and you.
• Duration: while your account exists, then deletion as described in section 7.

2. Our duties

• We process the data only on your documented instructions — the Terms, this DPA and how you use the app — unless the law requires otherwise (we will tell you first, if allowed).
• Everyone at StockTime who can access the data is bound by confidentiality.
• We do not sell the data, use it for ads, or share it with other shops.

3. Security

• Each shop has its own separate database and photo folder.
• Traffic is encrypted (HTTPS); passwords are stored only as secure hashes.
• Staff accounts have permissions set by the owner; connected services (Telegram, Claude) can be switched off at any time and access stops at once.
• Access tokens for connected services are stored hashed and expire.

4. Sub-processors

You allow us to use these sub-processors. We bind them to data-protection terms at least as strict as this DPA and stay responsible for them.

• Railway — cloud hosting of the app and its databases.
• Resend — sending account e-mails (sign-up codes, password reset links).
• Paddle.com / Lemon Squeezy — card payments, as Merchant of Record (only your billing details).
• Google — only if you choose to sign in with Google (name, e-mail, account ID).

Services you choose to connect yourself — Telegram (daily copy) and Claude by Anthropic (StockTime in Claude) — receive data on your instruction and handle it under their own terms. We will update this list before adding a new sub-processor; you may object by contacting us, and you may close your account if we cannot agree.

5. Helping you

• We help you answer requests from people to see, correct, export or delete their data (you can also do most of this yourself in the app: edit, Excel export, full backup, delete account).
• We tell you without undue delay, and where possible within 72 hours, after we become aware of a personal-data breach that affects your data, with the information we have.
• We give you the information reasonably needed to show compliance with this DPA.

6. Transfers

Our sub-processors may process data outside your country. Where the law requires it, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. End of service

You can download all your data at any time (Settings → Excel & backup). When your account is deleted we delete your shop data within 30 days, unless the law requires us to keep it.

8. Contact

E-mail: support@stocktime.io