Draft only — not in force. Confirm actual production settings, providers and data practices; replace bracketed information; and obtain qualified privacy counsel review before publication. This draft is not a representation that controls, retention schedules, rights processes, or integrations have been implemented.
Controller/operator: [legal name and registration details] (“StockSOS,” “we,” “us,” or “our”) Address: [business address] Privacy contact: [public email or other accessible contact method] Website: https://socksos.vercel.app Effective date: [date] Data protection officer or representative, if required: [details or state not applicable after review]
1. Scope
This policy describes how we handle personal information when people visit StockSOS, create buyer or supplier accounts, operate supplier businesses, search for stock, submit requests or quotations, use orders or support, and use enabled sharing or voice features. A business user may provide information about its staff or contacts and is responsible for having the necessary authority to do so. The identity and responsibilities of a supplier, external platform and StockSOS may differ by transaction; [confirm controller/processor roles and relationships].
2. Information we collect
Depending on the features used, information may include:
- Account and profile: name, email, authentication and verification information, account role, optional telephone number, country, region, city, postal code, area, address and fulfillment preference. Password authentication is handled by our authentication provider; do not send passwords to support.
- Supplier and public listing: business name, business link, category, location, description, contact or registration details supplied during application, verification information where collected, product details, price, quantity, availability, and uploaded photos or videos. Public business and product pages can be viewed by others and indexed by search engines.
- Marketplace activity: search text, sourcing requests, quantities, location, specifications, urgency, quotations, orders, fulfillment and delivery details, saved suppliers, enquiries, reviews and support messages. Do not include information that is not needed for a request.
- Voice: if you use native voice recognition, your device or browser’s speech provider may process audio according to its own settings and policy. If enabled and you choose backup transcription, a short recording is sent through StockSOS to OpenAI for transcription; recognized text can be reviewed before submission. The reviewed route does not save the audio as an application record, but provider and infrastructure handling must be confirmed. Avoid speaking sensitive information that is not necessary.
- Technical and security information: session cookies, request and device or browser information, IP address and security events needed to operate and protect the service. The login code uses a hash derived from the request IP for throttling. [Confirm actual infrastructure logs, analytics, cookies and retention in production.]
- Payment information if enabled: order and transaction references, status, amounts and provider responses. Online payment initialization is currently paused in the reviewed code. If enabled, the provider may collect payment details directly under its policy. [Confirm payment data flows and providers before publication.]
We receive information from you, from your business’s authorized users, from other marketplace participants and, where enabled, from service or connected-platform providers. [Confirm other sources and categories.]
3. How and why we use information
We use relevant information to create and secure accounts, verify applications, display approved listings, search and match stock, transmit requests and quotations, support orders and fulfillment, respond to enquiries and support cases, prevent misuse, maintain records, comply with law, and improve the service. Service notices may be sent where configured. Marketing messages, external channel distribution and advertising require the permissions or choices required by law and the relevant platform; do not claim an integration is active until verified.
Where UK or EU data-protection law applies, our proposed legal bases may include performing a contract, legitimate interests in operating and securing the marketplace, complying with legal obligations, and consent where required. [Counsel and owner must assess and specify the actual basis for each purpose, legitimate interests, and consequences of not providing required information before publication.] Where processing relies on consent, you may withdraw it using [method], without affecting earlier lawful processing.
4. Who receives information
Public supplier profiles and public product listings are visible to visitors and search engines. Relevant suppliers may see the information needed to evaluate a matched sourcing request; buyers may see supplier quotations and listing information. Enquiry and referral features present a consent choice for referrals. [Verify each field disclosed at each workflow step; do not promise that contact details are never shared without an end-to-end audit.]
We may share information with authorized members of the same business, staff and support personnel, infrastructure and security providers, and providers that perform services for us. The code uses Supabase for authentication, database and storage and is deployed through Vercel. Optional backup voice transcription sends audio to OpenAI when configured and selected. Browser speech services and platforms you choose to share with may act under their own terms. Payment services are conditional on being enabled. We may disclose information when legally required or reasonably necessary to protect rights, safety or the service, or in connection with a business transaction where permitted.
[Complete and verify the provider list, purposes, locations, contractual safeguards, and whether any data is sold, shared for cross-context advertising, or used for targeted advertising. Do not make a “no sale” claim without this assessment.]
5. Cookies and similar technologies
The service uses authentication/session cookies to keep users signed in and support secure access. [Inventory all cookies and similar technologies, purposes, duration and providers in production; document any analytics or advertising technologies and the required consent or opt-out controls before publication.] Browser settings may allow you to control cookies, but disabling essential cookies can prevent sign-in.
6. Retention and security
We retain information for the period needed for its purposes, applicable legal and accounting obligations, security, disputes and backups. [Insert the actual retention periods or objective criteria for each category, backup deletion timing and legal holds. No general deletion schedule is confirmed.] We use measures intended to limit access, including authenticated access and database authorization controls. No system is completely secure. [Verify operational controls and incident-response procedures before publication.]
7. International processing
StockSOS is intended for worldwide use, and our service providers may process information in countries other than your own. [Identify actual processing locations and applicable transfer mechanisms or safeguards, and how a person can obtain information about them.] Legal protections may vary by location.
8. Your privacy rights and choices
Depending on where you live and applicable law, you may have rights to access, correct, delete, obtain a copy of, restrict or object to certain processing, withdraw consent, opt out of certain uses or appeal a decision. These rights can have exceptions. You may also complain to an appropriate supervisory authority. To make a request, contact [public privacy contact and accessible request method]. We may need to verify your identity and authority before acting. [Specify response periods, appeal and complaint routes and any jurisdiction-specific notices after legal review.]
For California and other applicable US state laws, [assess whether the business and practices are covered; identify categories, purposes, retention, disclosures, sale/sharing or targeted advertising, and required opt-out and appeal methods based on actual practices]. We do not assert a practice or exemption until it has been verified.
9. Children and sensitive information
StockSOS is intended for business use and is not directed to children. [Confirm the applicable age threshold and procedures for data collected from minors.] Please avoid providing sensitive personal data in listings, support messages, voice input or sourcing requests unless it is necessary and we have provided an appropriate way to handle it.
10. Changes and contact
We may update this policy when our practices or the law change, and will provide notice where required. The date at the top will show when the current policy took effect. Contact [legal operator and privacy contact]. The existing support form requires sign-in, so an accessible public privacy contact is needed before this policy is published.