Who we are
Restokio ("we", "us") is an inventory management and purchasing app for merchants on Shopify. It mirrors your products and stock, plans reorders from your sales, creates and sends purchase orders, and writes received stock back to Shopify. This policy explains the data we handle when you use the app or this website, and how to reach us about it. For your data, you are the controller and we act as your processor.
What we access from Shopify, and why
When you install Restokio, you grant the minimum scopes needed for these features. We use this access only to provide the app's functionality to you:
| Access | What we read / do | Why |
|---|---|---|
read_productsread_inventory | Product titles, variants, SKUs, images, unit cost and on-hand stock | Mirror your catalogue so we can show stock and plan reorders |
write_inventory | Add received quantities to your stock when you receive a purchase order | Keep Shopify inventory accurate after deliveries |
read_orders | Order line quantities and order dates only — to count units sold per product over time | Compute sales velocity, demand forecasts, reorder points and dead-stock alerts |
read_locations | Your store's locations | Receive stock into the right location |
Important: although we read orders, we only use aggregated quantities and dates. We do not collect, store, display or share your customers' personal data — no names, emails, phone numbers or addresses. We process the minimum personal data necessary, and use it solely for the inventory and purchasing features described above.
What we store
- A mirror of your products — title, SKU, image, cost, on-hand stock, and derived figures like sales velocity and the date of the last sale (an aggregate count, not customer data).
- Suppliers and purchase orders you create or import — supplier names and contact details, PO lines, costs, dates and statuses. This is your operational data.
- Your Stocky API key, only if you connect Stocky to import data. It is encrypted at rest (AES-256-GCM) and used only for read-only requests to Stocky.
- Your shop domain and app session, provided by Shopify, used to authenticate you and keep your data separate from other stores'.
- App settings — your planning preferences, company profile for PO documents, and notification settings.
- Email address, only if you submit it on this website to be notified about the product. Used for that alone — no third-party marketing, no list sharing.
What we do not collect
We do not collect or retain your customers' personal data, run third-party ads, or use tracking pixels on this site. We do not sell or rent any data to anyone, and we do not use your data to make automated decisions that have legal or similarly significant effects on any individual — our suggestions affect your purchasing, not people.
Where your data lives & how it's protected
Your data is stored in our application database, isolated per store. Data is encrypted in transit (TLS/HTTPS for all connections to Shopify, our servers, and email delivery), and sensitive secrets such as your Stocky API key are encrypted at rest. Access is limited to what the app itself needs to serve you.
Service providers (sub-processors)
We share data only with the infrastructure providers that operate the service on our behalf, and with Shopify as required for the app to function:
- Cloud hosting — runs the application and database.
- Resend — delivers purchase-order emails to your suppliers and product notifications, on your instruction.
- Cloudflare — DNS and email routing for our domain.
- Shopify — the platform the app runs on.
Retention & deletion
- While installed: we keep your data only as long as needed to provide the service.
- On request: use the delete option in the app or email us, and we purge your suppliers, purchase orders, product mirror, rescue history and API key.
- On uninstall: the same purge runs automatically. We honor Shopify's
shop/redactwebhook (sent ~48 hours after uninstall) by deleting your store's data and sessions. - Customer privacy webhooks: we honor
customers/redactandcustomers/data_request. Since we hold no customer personal data, there is nothing to disclose or erase for those requests.
Your rights
Depending on your location, you may have rights to access, correct, export or delete your data. You can export your data from within the app at any time, and request deletion as described above. Contact us and we will help.
Changes
If this policy changes in a way that affects your data, we will note it here with a new date and, for material changes, notify you in the app.
Contact
Questions, data or deletion requests: support@restokio.com.