Privacy Policy

1. Who we are and what this policy covers

Stocklio AS ("Stockifi", "we", "us") is the data controller for the personal data described in this policy.

This policy applies to:

• our website stockifi.io, its language versions and its subdomains, including go.stockifi.io and our other campaign landing pages
• the Stockifi apps for iOS, Android and web ("the app")
• our sales, marketing and customer support communications (email, phone and events)

This policy does not cover the data our customers put into Stockifi about their own business, such as supplier invoices, sales data, recipes and their staff's user accounts. We process that data on our customers' behalf as a data processor, under our agreement with the customer. If you use Stockifi through your employer, your employer is the controller of that data, and you should contact them first.

Stockifi is a service for businesses. Most of the people whose data we handle are contacts at restaurants, hotels, bars and other hospitality businesses.

2. What we collect

Information you give us

• Demo and contact forms: your name, work email, phone number, company name, role, number of locations and your message.
• Your account and use of the app: your name, email, phone number, company name and address, login details, and the role and permissions your company gives you.
• Support and communication: the content of your emails, chats and calls with us.
• Billing: invoicing contact and company details.

Information we collect automatically

• Website usage: pages you view, clicks, the page that referred you, the ad or campaign that brought you to us (for example campaign parameters and ad click IDs), approximate location based on your IP address, and your browser and device type. We collect this with cookies and similar technology, with your consent where the law requires it (see section 5).
• App usage and diagnostics: device model, operating system and app version, IP address, the actions you take in the app, and crash and error reports.
• Security information: IP address and browser and device signals, used to protect our forms against spam and bots.

Information from other sources

• Public business sources: business contact details (name, role, work email and work phone) of people at hospitality businesses, from company websites, public business registers and professional networks. We use these to contact businesses that may benefit from Stockifi.
• Advertising platforms: reports on how our ads perform, and, where you have consented, confirmation that a visit or sign-up came from one of our ads.

3. Why we use your data and our legal basis

Where we rely on legitimate interest, we have weighed our interest against your rights and interests. You can object at any time (see section 9), and if you object to direct marketing, we will stop.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects for you.

4. Advertising and measurement

We advertise on platforms such as Google and OpenAI (ChatGPT). To understand which ads work, we use these platforms' measurement tools on our website and landing pages, including go.stockifi.io.

Only if you accept marketing cookies, these tools may:

• record that you arrived from one of our ads and what you did next, for example requesting a demo
• when you submit a form, send a hashed version of the email address and phone number you entered to the advertising platform. Hashing turns your email into a one-way code before it is sent. The platform compares this code with codes of its own users to tell us that an ad led to a sign-up. We only receive aggregated results, not information about your account with that platform.

We may also share hashed email lists of our contacts with advertising platforms, to show relevant ads to them or to exclude existing customers from our ads. We only do this for people who were informed of it when we collected their email and, where the law requires, gave their consent. You can ask us to remove you from these lists at any time.

Hashed data is still personal data, and we treat it as such.

We do not sell your personal data.

5. Cookies and similar technology

We use cookies, pixels, local storage and similar technology on our website and in the app. They fall into three groups:

• Strictly necessary: needed for the website or app to work, for example security and remembering your cookie choice. These do not require consent.
• Analytics: help us understand how our website and app are used. On our website, we only use these with your consent.
• Marketing: measure our advertising. We only use these with your consent.

You make your choice in the cookie banner when you first visit. You can change your choice or withdraw your consent at any time through the cookie settings on our website. Withdrawing consent does not affect what was processed before.

The cookie banner and your consent choices apply to our website and landing pages. In the app, we use analytics and crash reporting based on our legitimate interest in keeping the app working and improving it.

6. Who we share data with

• Service providers that host, run or support our services under contract and only on our instructions, for example cloud hosting and databases, CRM and email tools, analytics, error monitoring, customer support and invoicing.
• Advertising platforms (Google and OpenAI), as described in section 4. For some purposes these platforms act as independent controllers, and their own privacy policies apply. These platforms may also use this data to improve their own services, under their own policies.
• Professional advisers and public authorities, such as accountants, lawyers and auditors, and authorities where the law requires it.
• A buyer or investor in the event of a merger, acquisition or sale of assets, under confidentiality obligations.

We can give you a list of our service providers on request.

7. Transfers outside the EU/EEA

Some of our service providers process data outside the EU/EEA, mainly in the United States. We only transfer data with a lawful safeguard in place: an adequacy decision by the European Commission (including the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses, with additional measures where needed. You can ask us for a copy of the safeguards that apply.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes in this policy:

• Leads and enquiries that do not become customers: until the contact is no longer relevant, and then we delete or anonymise it.
• Customer account data: for as long as the agreement with your company runs, and for a limited time afterwards to close the account and handle any follow-up questions.
• Billing and bookkeeping records: for as long as Norwegian bookkeeping law requires, up to five years.
• Website and app analytics: according to the retention settings of our analytics tools, after which the data is deleted or aggregated.
• Crash and error reports: for a limited time, while we need them to fix problems.
• Opt-out records: if you ask us not to contact you, we keep the minimum needed to respect that request.

9. Your rights

Wherever you are, you can ask us to:

• give you a copy of your personal data
• correct data that is wrong
• delete your data
• restrict how we use your data
• stop processing based on our legitimate interest, and stop direct marketing at any time
• give you the data you provided to us in a portable format
• withdraw your consent at any time, including through the cookie settings
• remove you from our advertising lists

To use your rights, email support@stockifi.io. We will reply within one month. We may ask you to confirm your identity first.

Deleting your app account: email support@stockifi.io from the email address linked to your account. If your account belongs to a company, we may need to confirm the request with your company's account administrator.

Complaints: you can complain to the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no) or to the data protection authority in the country where you live or work. We would appreciate the chance to resolve your concern first.

California residents: you have the right to know, delete and correct your personal information, and to opt out of the sale or sharing of personal information for cross-context behavioural advertising. We do not sell personal information. To opt out of sharing for advertising, decline marketing cookies or email us. We will not treat you differently for using these rights.

10. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and limiting access to people who need it for their work. No system is completely secure. If a data breach is likely to put your rights at risk, we will inform you and the authorities as the law requires.

11. Children

Stockifi is a service for businesses and is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We update this policy when our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we will let you know on our website, in the app, or by email if you have an account. If a translated version of this policy differs from the English version, the English version applies.

13. Contact us

Stocklio AS
Hasleveien 28A, 0571 Oslo, Norway
Email: support@stockifi.io
Phone: +47 21 05 14 03