Start a conversation

StockByLocation privacy policy

How the StockByLocation Shopify app handles data, explained in plain terms.

Last updated 2 November 2026 Applies to the StockByLocation Shopify app

In short

  • StockByLocation reads your products, inventory and locations from Shopify. It cannot change them.
  • It stores your app settings and the Shopify session it needs to connect to your store.
  • Inventory is read live and is not copied into our database.
  • It does not store shopper names, email addresses, orders or payment details, and sets no tracking cookies.
  • When you uninstall, your settings and sessions are deleted from the app database.

01Who we are

StockByLocation is developed and operated by Teske Software, an independent software business in the Netherlands run by Damian Teske (“Teske Software”, “we”, “us”). The app runs at stockbylocation.teskesoftware.com and is used through Shopify.

This policy covers the StockByLocation app: its embedded admin, its theme app block, and the storefront requests that block makes. Our website is covered by the separate Teske Software privacy policy.

For data about merchants and their stores that we need to run the app, Teske Software decides how that data is used. For storefront requests made on a merchant's shop, we process data on behalf of that merchant to provide the feature they installed.

02Data about merchants and their stores

“Merchant” means the Shopify store that installs StockByLocation and the staff who use it.

DataWhyStored?
Store identity — your myshopify.com domain; Shopify's shop ID for billing checks To identify your installation, link it to your settings and check your subscription. Domain: yes, in our database. Shop ID: used for the check, not stored.
Shopify session — access token, granted permissions (scopes), session ID, state and expiry dates; a refresh token where Shopify issues one So the app can call Shopify's API on your behalf. Yes, in our database, while the app is installed.
Staff account fields — user ID, first and last name, email, locale, account-owner, collaborator and email-verified flags These are part of Shopify's standard session format and are only filled in for user-specific (“online”) sessions. StockByLocation uses shop-level access for its normal operation, so these fields are normally empty. Only if Shopify supplies them in a session.
App settings — selected location IDs, location display names, display mode, low-stock threshold, hide-out-of-stock and show-address options, your status texts, created and updated timestamps To show the availability block the way you configured it. Yes, in our database, while the app is installed.
Store data read live — products and variants (status, publication, whether inventory is tracked), inventory quantities per location, location names and addresses To work out what to show for the variant a shopper is viewing, and to list your locations in the app. No. Read from Shopify when needed; not saved.
Subscription status — whether your store has an active StockByLocation plan To provide the app to subscribed stores. Held briefly in server memory (minutes) to avoid repeated checks; not in the database.
Technical logs — application request logs (request method, path, status code, response size and time, without query strings or Shopify authentication parameters), messages about webhooks received, and error messages. These can include your shop domain and a product variant ID. Web server logs are described under data about shoppers. Keeping the app secure and working; diagnosing problems. For a limited period, see retention.

The Shopify permissions StockByLocation requests are: read_products, read_inventory, read_locations and write_app_proxy. The last one only lets the app serve the storefront block through Shopify's app proxy; it does not allow changes to your products or stock.

03Data about shoppers

“Shoppers” are the visitors of a merchant's online store. When a shopper opens a product page that contains the StockByLocation block, or picks another variant, their browser asks for availability of that variant through Shopify's app proxy (a path on the merchant's own store, /apps/stock-by-location/).

  • Shopify forwards that request to our server together with the shop's domain and a signature that proves the request came through Shopify. If the shopper is logged in to a customer account, Shopify also adds that customer's Shopify ID to the request.
  • StockByLocation does not intentionally read or store that customer ID, and does not read customer profiles, orders or contact details.
  • The response contains only location names, availability status, your configured texts and, depending on your settings, quantities and location addresses.
  • The app sets no cookies of its own, does not track shoppers across pages or sites, and does not build profiles.
  • Our application request logs record the request method, path, status code, response size and time. They do not record query strings, so the customer ID and Shopify's authentication parameters are not written to them.
  • Our web server's access logs record the IP address the request came from, the time, the request method and path (not the full URL with its query string), the response status and size, and the browser's user agent.
  • In exceptional cases, for example when a request fails at the web server, the web server's error log may contain the full request URL, which can include the customer ID.
  • These logs are used only for security and troubleshooting and are deleted automatically, as described under retention.

We do not collect shopper names, email addresses, postal addresses, purchase history or payment card details.

04Purposes and legal bases

  • Providing the app you installed — storing your settings and session, reading store data, showing availability. Basis: performance of our agreement with you.
  • Billing checks — confirming your subscription status with Shopify. Basis: performance of our agreement.
  • Security and troubleshooting — technical logs and request verification. Basis: our legitimate interest in running a secure, reliable service.
  • Support — answering emails you send us. Basis: performance of our agreement, or our legitimate interest in replying to you.
  • Legal obligations — keeping records where the law requires it.

We don't use data from StockByLocation for advertising, don't sell it, and don't use it for automated decision-making.

05Billing and payments

Subscriptions are handled entirely by Shopify's billing system. You choose a plan on Shopify's plan-selection page and charges appear on your Shopify invoice. We never receive your payment card or bank details. To check whether your store has an active plan, the app asks Shopify's Partner API for your subscription status.

06Service providers

We keep the list short:

  • Shopify — the platform the app runs on: authentication, store data, the app proxy, webhooks and billing. Shopify processes data under its own privacy policy.
  • Our hosting provider — the virtual server on which the app and its database run.

StockByLocation uses no third-party analytics, advertising, error-tracking or email-marketing services. The embedded admin loads fonts from Shopify's CDN.

Shopify and hosting providers may process data in countries outside the European Economic Area. Where that happens, we rely on the safeguards required by EU data protection law, such as the European Commission's standard contractual clauses or adequacy decisions.

07Retention and deletion

  • While installed: settings and sessions are kept so the app keeps working.
  • When you uninstall: Shopify notifies the app, and your shop's settings and all of its stored sessions are deleted from the app database straight away.
  • Shop data erasure: after uninstalling, Shopify sends a request to erase shop data. The app deletes any remaining settings and sessions for that shop.
  • Customer data requests: Shopify can ask apps to export or erase a specific customer's data. Because StockByLocation does not store customer data in its database, there is nothing to export or erase; these requests are acknowledged.
  • Subscription status: held in memory for minutes and discarded.
  • Application logs: limited in size. The oldest entries are deleted automatically once the logs reach about 50 MB (five files of up to 10 MB each), so how long an entry is kept depends on how much is logged.
  • Web server logs: rotated daily, compressed, and deleted automatically after ten rotations, which is normally about ten days. The exact period can vary, for example when a rotation is delayed.
  • Support emails: kept as long as needed to help you and maintain normal business records.

08Security

All traffic to the app uses HTTPS. Requests from Shopify (webhooks and app proxy calls) are verified with Shopify's signatures before they are processed. The database is not reachable from the public internet, and access tokens are only used server-side to talk to Shopify. Inventory responses never include tokens or internal identifiers beyond what the block needs.

No system is perfectly secure. If you believe you've found a vulnerability, please write to security@teskesoftware.com.

09Your rights

Under the GDPR and similar laws you may have the right to access, correct or delete personal data, to restrict or object to processing, and to data portability. Merchants can contact us directly. Shoppers should usually contact the store they shopped with first, since the store decides which apps it uses, but you're also welcome to contact us.

You can also lodge a complaint with a data protection authority. In the Netherlands, that is the Autoriteit Persoonsgegevens.

10Changes to this policy

When the app's data processing changes, we update this page and the “last updated” date. For significant changes affecting installed stores, we'll let merchants know.

11Contact