PRIVACY POLICY
Your documents, and how we handle them.
Summary
This policy explains what Profitpin LLC collects when you visit getstockstart.com, create an account, use the StockStart application, or contact support, and what we do with it.
Account information
To create an account we collect your email address and a password (stored only as a salted hash), and your business name if you give it. Stripe collects your name, billing address and card at checkout; from Stripe we keep your customer and subscription identifiers, subscription status and billing dates. We never see your full card number.
Documents and data you upload
The Service stores the files you upload — invoices, receipts, photographs, spreadsheets, pricebook exports — and the text extracted from them by OCR, the item library built from them, your review decisions, and the exports you generate. These may contain supplier names, prices, quantities, and occasionally personal information such as a sales rep's name or an address on an invoice. We process this data solely to provide the Service to your account.
We do not sell Customer Data, use it for advertising, share it with other customers, or use it to train machine-learning models. Automated OCR and matching run on our infrastructure and, for image OCR, may run in your browser.
Usage and technical data
Our servers keep ordinary logs: request time, path, IP address, browser type, and account identifier, retained for a short period for security and troubleshooting. We use a session cookie to keep you signed in. We don't run advertising trackers or third-party analytics on the application or the website.
Who processes data for us
| Provider | Role | Data |
|---|---|---|
| Render | Runs the application and its database (United States) | Account data, Customer Data, logs |
| Stripe | Checkout, billing, customer portal | Name, email, card, billing address, subscription status |
| GitHub | Hosts the marketing website | Standard access logs |
| Microsoft 365 | Support email | Whatever you send us |
Each provider is limited to its role. We'll update this list if it changes. We disclose information if the law requires it or to protect our rights, and we'll tell you when we can.
How we protect it
All traffic is encrypted (HTTPS). Passwords are hashed, never stored in plain text. Customer Data is scoped to your account; other customers cannot see it. Card data is entered on Stripe's pages under Stripe's PCI DSS certification. Access to production systems is limited to the people who operate the Service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.
Retention and deletion
Uploaded documents and your item library stay in your account until you delete them or close the account — there is no automatic purge, because contractors often need to refer back to old invoices. When a subscription ends, the account becomes read-only for 30 days so you can export, after which we may delete Customer Data. To delete sooner, delete documents in the Service or email support from your account address; we delete within 30 days, except for what tax and accounting rules require us to keep (billing records, generally seven years) and short-lived backups that roll off on their own schedule.
Emails we send
Transactional only: account and password emails, receipts and invoices (from Stripe), a reminder before your free month ends, failed-payment notices, notices about changes to price or terms, and support replies. No marketing newsletters. You can't opt out of transactional emails while you have an account.
Your rights
You can ask what personal information we hold about you, have it corrected or deleted, or get a copy — email support from your account address. Residents of California and other states with privacy laws have additional rights under those laws; we honor them for everyone and don't discriminate for exercising them. In the past 12 months we have collected identifiers (email, account and Stripe IDs, IP address), commercial information (subscription and billing history), and the Customer Data you upload. We do not sell or "share" personal information for cross-context advertising. Our sites don't respond to browser "Do Not Track" signals because they don't track visitors.
StockStart is a business product and isn't directed at children under 16.
Where data is kept
Our providers store data in the United States. Using StockStart from outside the US sends your data to the US.
Changes to this policy
We'll post updates here and email the address on your account about material changes. The effective date at the top tells you which version you're reading.
Contact
Profitpin LLC · support@getstockstart.com