Privacy notice
Effective: August 20, 2026
Free browser-local scan
The free readiness scan reads selected CSV files inside your browser. Stocky Exit Audit does not upload, transmit, or persist the contents of files selected for the free scan. The downloadable JSON report is created locally and remains under your control.
Payments
Paid assisted audits are purchased through Stripe-hosted checkout. Stocky Exit Audit does not receive or store full payment-card numbers. Stripe processes the payment and provides checkout status, amount, currency, customer contact details, and a Checkout Session identifier used to verify paid access.
Paid audit intake
After a verified payment, the intake form stores the operating context you submit, such as contact details, business/store name, Shopify store URL, location and SKU estimates, migration status, workflow descriptions, export-readiness selections, and notes. Paid intake and payment-verification records are stored in a dedicated Supabase project with server-only application access. Do not enter passwords, API keys, card data, sensitive customer information, or information you are not authorized to process.
Assisted-audit operations
The private operator workspace may add engagement status, review timestamps, internal operator notes, and approved report snapshots needed to manage follow-ups, evidence review, remediation, and delivery decisions. These records are not displayed publicly and are accessed through server-only credentials and a separate operator authentication secret.
Approved report delivery
After an operator approves a report, Stocky Exit Audit may create a revocable, expiring merchant report link. The application stores only a cryptographic hash of the access token, plus limited delivery metadata such as recipient email, expiration, send status, and access count. The plaintext token is presented only when a new link is created and is not stored in the database.
Approved merchant report pages expose the approved report snapshot only. They are designed not to expose private operator notes, Stripe session identifiers, raw Stocky CSV files, or internal support records. The operator may revoke the current link at any time or replace it with a newly issued token.
Paid inventory CSV processing
After the paid intake is submitted, you may choose to process supported inventory or inventory-baseline CSV exports. This processor is currently limited to rows that can be mapped to the documented inventory target fields; purchase-order history, stocktake history, supplier exports, and other Stocky export classes remain part of the human-assisted review rather than this automated inventory processor.
Selected supported files are uploaded directly from your browser to a private Supabase Storage bucket using a short-lived signed upload token. The server reads the private object to validate and classify inventory rows for the assisted audit. The application attempts to delete the raw Storage object when processing finishes or fails, and a secured daily cleanup job removes stale transient uploads that did not complete normally.
Stocky Exit Audit retains the processing record needed for the engagement, including file name, file size, processing status, summary counts, and bounded validation/quarantine error evidence. The application is designed not to persist raw inventory rows in the paid-intake database.
Optional schema-realignment fallback
Most supported inventory rows are handled by deterministic validation and known column mappings without an AI request. If the server-side schema-realignment fallback is configured, a limited number of rows that cannot be resolved by the static validator may be sent to Google's Gemini API for structured schema alignment. The fallback is capped per file and its output is revalidated before it can be accepted. Do not upload files containing customer PII, credentials, payment data, or other data you are not authorized to send to these processors.
Operational and report notifications
Stocky Exit Audit may use Resend to send the operator limited operational notifications and, after operator approval, to send a merchant their secure report link. Report-delivery emails contain the merchant-facing report link and basic report context, not raw inventory rows, raw Stocky exports, Stripe identifiers, or private operator notes.
Operational telemetry
This release does not intentionally include advertising trackers or session replay. Hosting and infrastructure providers may process ordinary request metadata such as IP address, user agent, requested path, timestamp, and diagnostic logs for security and service operation.
Contact
Privacy or data-handling questions can be sent to evertonhudson@icloud.com.