1. Controller
The controller of personal data described here is Event Space Sp. z o.o., ul. Kanarkowa 47, 11-041 Olsztyn, Poland, VAT ID PL7394025935, KRS 0001210621. Contact for privacy matters: info@stockeven.com.
For stock data that a store sends through StockEven, the store owner is the controller and we act as processor under the Data processing agreement.
2. In short
- StockEven syncs stock quantities. It does not need and does not collect customer names, addresses or payment details of the store's buyers.
- This website uses no advertising or analytics cookies and loads no third-party trackers or fonts.
- Payments are handled by Stripe through Link. We never see card numbers.
3. Website visitors
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser, requested page, time (server logs) | Security and fixing errors | Legitimate interest, Art. 6(1)(f) GDPR |
| Name, email, store address and message sent through the contact form | Answering the message | Steps at the sender's request and legitimate interest, Art. 6(1)(b) and (f) |
4. Stores using StockEven
| Data | Purpose | Legal basis |
|---|---|---|
| Store address (URL), plugin and WooCommerce versions | Identifying and connecting the store | Contract, Art. 6(1)(b) |
| Square merchant ID, business name, location, access and refresh tokens (stored encrypted) | Reading and updating inventory in Square | Contract, Art. 6(1)(b) |
| Product IDs, SKUs, product names, stock quantities, stock change events with reason and order number | Syncing stock and showing the activity log | Contract, Art. 6(1)(b) |
| Alert email address (by default the site admin email) | Sending alerts when sync needs attention | Contract, Art. 6(1)(b); can be turned off in the plugin |
| Plan, subscription status, Stripe customer ID | Applying plan limits and billing | Contract, Art. 6(1)(b) |
Order numbers are used only to label stock changes as sales or refunds. Buyer details from orders are never sent to StockEven.
5. Payments
Paid plans are bought through Stripe Checkout. Stripe, through Link, acts as the merchant of record and processes the buyer's name, email, billing address, tax ID and payment details as an independent controller under its own privacy policy. We receive the email, country, subscription status and invoice records needed to provide the plan and meet accounting obligations (Art. 6(1)(b) and (c) GDPR).
6. Service providers
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and backups | Germany, Finland |
| Resend, Inc. | Sending alert and contact emails | EU sending region; company in the USA |
| Cloudflare, Inc. | DNS and email forwarding | Global network; company in the USA |
| Stripe Payments Europe Ltd. / Link | Payments, invoices, taxes (independent controller) | Ireland |
| Block, Inc. (Square) | The store's own Square account, accessed with the store's permission | USA and the store's region |
We do not sell personal data and do not share it for advertising.
7. Transfers outside the EEA
Where a provider transfers data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses.
8. Retention
- Server logs: up to 14 days.
- Store connection data, tokens and sync records: while the store is connected. After disconnecting or uninstalling, tokens are deleted at once and the rest within 30 days.
- Activity log entries: up to 12 months.
- Backups: up to 14 days, then deleted.
- Contact messages: up to 2 years after the conversation ends.
- Billing records: 5 years from the end of the tax year, as required by Polish tax law.
9. Security
All traffic uses TLS. Square tokens and store secrets are encrypted at rest. Requests between the plugin and the service are signed with a secret unique to each store. Access to servers is limited to authorized staff with SSH keys, and databases are backed up daily.
10. Your rights
Under the GDPR, anyone whose data we process may request access, correction, deletion, restriction, data portability, and may object to processing based on legitimate interest. Requests go to info@stockeven.com; we reply within one month.
A complaint can be filed with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, or with the authority in the country of residence.
11. Changes
We update this policy when the Service or the law changes. The date at the top shows the latest version. Material changes are announced by email to connected stores.