Privacy Policy

StockLine is operated by [to be confirmed before publication] (operator legal name). This policy covers the StockLine website and apps: seller accounts, public catalog pages, buyer order links, and optional buyer accounts.

Roles differ by data. For seller account data, visitor data and buyer-account data, StockLine decides how the information is used. For the details a buyer submits when sending an order to a seller, the seller decides why and how to use them, and StockLine stores and transmits them for the seller as a service provider. Each seller is responsible for its own privacy practices toward its customers.

For counsel: confirm the role characterisation for order data (seller = controller / "database owner"; StockLine = processor / "holder" under Israeli law and "service provider" under CCPA), and whether a Data Processing Agreement should be offered.

We list only what the product actually handles.

• Seller account: email address, password (stored as a salted hash by our authentication provider, never in readable form), business name, currency, tax rate, WhatsApp number, notification email, brand colour and logo.
• Catalog content a seller creates: catalogs, categories, products, prices, images, descriptions, and seller-private fields such as cost price, which are never shown to buyers.
• Orders: when a buyer sends an order we receive the buyer's name and phone number (required), and, if the buyer chooses to enter them, email address, delivery or billing address, tax ID, website, and a note, along with the order lines and totals. This is passed to the seller.
• Optional buyer accounts: email, name, phone, business name and address saved for faster checkout, and the link between the account and orders.
• Subscription information: plan, status, and identifiers that link the account to our payment provider. Card details are handled by the payment provider, not stored by us.
• Technical and usage data: IP address and device/browser details in server and security logs; for sign-up abuse prevention, the IP address is kept in a short-lived throttle table. Storefront view counts: page, product, time and — only if the visitor allowed Analytics cookies — a hash of a random per-browser ID.
• Support and privacy requests: what you send us and our replies.
• Records of your acceptance of our Terms and Privacy Policy (user ID, document versions, time) and of your cookie choices (when signed in).

We do not knowingly collect special-category data (such as health or biometric data), and we ask sellers and buyers not to put it in notes or descriptions.

• To provide the Service — create accounts, host catalogs, deliver orders to sellers, send order notifications, bill subscriptions. Basis: performing our contract with you; for buyers, fulfilling their request to send an order.
• To keep the Service secure and prevent abuse — rate limiting, fraud and security monitoring. Basis: our legitimate interests (and legal obligations).
• To understand and improve the Service — storefront view statistics for sellers and page-speed measurements. Basis: your consent where analytics cookies or identifiers are used.
• To communicate with you — service and security messages (transactional) and, only if you opt in, marketing. Basis: contract/legitimate interests for service messages; your consent for marketing.
• To comply with law and defend legal claims. Basis: legal obligation / legitimate interests.

Israeli law is consent- and purpose-based: we use information only for the purposes described here, and ask for your consent where the law requires it. Where the EU or UK GDPR applies to a person, the legal bases above are the ones we rely on.

For counsel: assess whether GDPR/UK GDPR applies (Art. 3(2): targeting or monitoring individuals in the EU/UK). StockLine is Hebrew/English and Israel-focused, but public catalogs can be opened anywhere. If it applies, decide on an EU/UK representative and transfer mechanisms.

Data is stored with our database, authentication and file-storage provider and our hosting provider (see Subprocessors). Safeguards in place include encryption in transit (HTTPS), row-level access rules so each seller can only read their own records, public catalog pages that read only through restricted functions that exclude seller-private fields, service-level credentials kept on the server only, rate limiting on public endpoints, and password re-entry for sensitive account actions such as data export and deletion.

No system is perfectly secure. If a breach affecting your personal information occurs we will notify you and the authorities as the law requires, including under Israel's data-security regulations and US state breach-notification laws.

For counsel: confirm which Israeli security level (Privacy Protection (Data Security) Regulations, 2017) applies to StockLine databases, whether a database-registration or Privacy Protection Authority notification is required, and whether a data-protection officer is needed under Amendment 13. A penetration test and written security procedure document are not yet in place.

• The seller you order from — receives your order details.
• Service providers that process data for us, listed on the Subprocessors page (database/authentication/storage, hosting, email delivery, payments, and AI text generation).
• Authorities or other parties where required by law or to protect rights and safety.
• A successor entity in a merger or sale of the business, with notice to you.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

Our providers operate outside Israel, including in the United States and Asia-Pacific. Your information may therefore be processed in other countries, which may have different data-protection rules. We use contractual and technical safeguards offered by those providers and limit what we send.

For counsel: Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001 conditions; confirm each provider's data region (database project region is believed to be Asia-Pacific/Tokyo — verify) and signed DPAs/SCCs. No agreements are represented as signed in this draft.

• Seller account and catalog data: kept while the account is active; deleted from live systems when the account is deleted.
• Orders: held in the seller's account for as long as the seller keeps them; removed when the seller deletes them or the account.
• Buyer accounts: kept until the buyer deletes the account; orders remain with the seller they were sent to.
• Storefront view data: aggregated or per-view rows kept to power seller statistics while the catalog exists.
• Sign-up throttle and security logs: short-lived operational data.
• Privacy-request records: kept to prove we handled the request, with contact details removed once the request is closed.
• Billing and tax records: kept for the period the law requires (to be confirmed — see below).
• Backups: provider backups expire on their normal cycle; deleted data is not restored into live systems.

For counsel: confirm retention periods, in particular tax/accounting record retention (commonly 7 years in Israel), privacy-request log duration, and the provider backup window (not yet verified).

Signed-in users can request deletion in Settings → Privacy (sellers) or from the account page (buyers), and anyone can use the form on the Data Deletion page. Deleting a seller account removes the account, its catalogs, products, images and the orders held in it from live systems. Because that includes buyers' order history held by that seller, export what you need first. Deleting a buyer account removes the saved profile; past orders stay with the seller who received them, de-linked from the account. If a paid subscription is active it must be cancelled first. See the Data Deletion page for exceptions and timing.

Depending on where you live you may have the right to: know what we hold about you and get a copy; correct inaccurate information; delete information; export it in a portable format; withdraw consent; object to or restrict some processing; opt out of sale/sharing (we do neither); not be discriminated against for using your rights; and complain to a regulator (in Israel, the Privacy Protection Authority).

Under Israel's Protection of Privacy Law you may review information held about you in a database and ask for it to be corrected or deleted if it is inaccurate, incomplete, unclear or out of date. California residents have rights under the CCPA/CPRA; residents of other US states may have similar rights.

If your information is in an order a buyer sent to a seller, the seller is the right party for most requests; we will help route or support them, and will act on our own copy where we are responsible.

• Signed-in: Settings → Privacy lets you download your data, request deletion, manage preferences and contact privacy support.
• Not signed in: use the form on the Data Deletion page, or contact [to be confirmed before publication] (privacy email).

We verify identity before releasing or deleting personal information: signed-in users re-enter their password; for others we may ask you to confirm via the email address involved or give details that match our records. We aim to respond within 30 days (extendable where the law permits) and will tell you if we decline and why. You can use an authorised agent; we may ask for proof of authority.

We use essential technologies, and optional ones only with your permission. See the Cookie Policy for the full list and how to change your choice at any time via Cookie Settings. We honour the Global Privacy Control signal as a request to reject optional categories. We do not use advertising or cross-site tracking.

StockLine is not directed to children and is not for people under 18 as sellers. We do not knowingly collect personal information from children under 13 (COPPA) or the applicable local age. If you think a child has given us information, contact us and we will delete it.

We send service and security emails as needed (account, orders, billing). We send promotional or newsletter emails only if you opt in — through a separate, unticked option, never as a condition of the Service — and every such message includes a working unsubscribe link. Unsubscribed addresses are kept on a suppression list so they are not contacted again. As of this draft StockLine does not send marketing emails.

Catalogs may contain links and images from third parties, and seller catalogs may use their own external links. Those parties have their own privacy practices. The sample demo catalog loads photographs from a stock-image service, which can see your IP address when they load.

In the last 12 months we collected the following categories: identifiers (name, email, phone, IP address), commercial information (orders), internet activity (view statistics, if allowed), and business information, for the purposes in section 3. We disclosed them to the seller you ordered from and to the service providers named on the Subprocessors page. We do not sell or share personal information as those terms are defined in the CCPA. Sellers using StockLine in the US are responsible for their own state-law duties toward their customers.

For counsel: CCPA/CPRA applies only if StockLine meets the thresholds (revenue, volume of California consumers, or share of income from selling/sharing). Confirm applicability, "Do Not Sell/Share" and "Limit Use of Sensitive PI" link requirements (currently none, as nothing is sold/shared), and other state privacy laws as thresholds are crossed. FTC Act §5: make sure all statements here stay accurate.

We will post updates here with a new version number and date. For material changes we will notify you by email or in the app before they apply, and where the law requires, ask again for consent.

Operator: [to be confirmed before publication] (operator legal name). Privacy contact: [to be confirmed before publication] (privacy email). You may also complain to the Israeli Privacy Protection Authority or your local data-protection regulator.