At StockNoter, we prioritize the privacy and security of your business and personal data. This Privacy Policy describes how we collect, use, and safeguard the information you provide when using our multi-tenant SaaS inventory management platform, designed specifically for Indian MSMEs.
StockNoter operates an offline-first mobile application (React Native / Expo) backed by a Django REST API with PostgreSQL database. By using our service, you agree to the practices described below.
1 Information We Collect
To provide offline-first capabilities, secure cloud backups, and multi-device synchronization, we collect the following categories of information:
User Profile Data: Your name, business email address, and hashed credentials. Passwords are stored using Django's built-in PBKDF2 hashing. Staff users authenticate via a hashed PIN.
Business Entity Data: Business name, branch locations, and your chosen inventory mode (Quantity or Availability).
Inventory Data: Product names, stock quantities or availability statuses, and timestamped stock operation history.
Device & Session Identifiers: Device IDs, active session tokens (UUIDs), session expiry timestamps, and sync log data, which are necessary to manage multi-device synchronization and session revocation security.
Payment Information: If you submit a payment upgrade request, we store the UPI transaction ID, proof image, and review status. We do not process or store credit/debit card numbers.
We do NOT collect: Location data, contacts, call logs, SMS, camera data, or any information unrelated to inventory management.
2 How We Use Your Information
We use the collected information strictly for the following core operations:
To enable offline and online inventory tracking and data synchronization across your devices.
To manage your SaaS subscription (FREE and BASIC plans) and upgrade status, including processing payment upgrade requests.
To process secure cloud backups and prevent data loss through incremental sync with conflict resolution.
To generate inventory export files (such as CSV spreadsheets) when requested by the user.
To send transactional emails for email verification during signup and password reset OTPs. We use SendGrid as our email delivery provider.
To maintain device session security including token expiry, session revocation, and protection against concurrent login abuse.
We do not sell, rent, or trade your personal or business data to any third party for advertising or marketing purposes.
3 Data Storage & Security
StockNoter is designed with an offline-first architecture, meaning:
All active workspace data is stored locally on your device in a secure SQLite database.
When synchronized, your data is securely transferred over HTTPS to our cloud servers and stored in a PostgreSQL database hosted on Railway.
All API communication uses device session token authentication. Each session has an automatic expiry (30 days for owners, 14 days for staff).
Optimistic locking (version-based) prevents data corruption during concurrent edits, with full sync conflict logging.
Payment proof images are stored via Cloudinary (encrypted at rest) in production, or local file storage in development.
4 Multi-Tenant Data Isolation
StockNoter employs a strict multi-tenant architecture where Business is the tenant boundary. This means:
Every business owns its own users, branches, products, stocks, subscriptions, and sync data.
Data belonging to one business/tenant is strictly isolated and can never be accessed by another business.
All API endpoints validate business ownership before returning or modifying data.
Suspending a business immediately invalidates all active device sessions for that business.
Complete Isolation: Even platform administrators access business data only through controlled admin workflows with role-based permissions (Superadmin, Admin, Reviewer, Developer).
5 Data Deletion & Retention
You have full control over your data:
You can delete your account and all associated business data at any time from the Settings section inside the StockNoter app.
When you delete your account, all database records associated with your business are immediately and permanently erased — including products, branches, stock history, sessions, sync data, subscription records, and your Django auth user account.
Individual products use a soft-delete mechanism for sync integrity, but full account deletion hard-deletes everything.
You can also request account deletion by emailing support@stocknoter.in — we will process it within 7 business days.
Cloudinary — Storage for payment proof images uploaded during subscription upgrade requests (production only).
Each of these services processes data only as necessary for StockNoter's core functionality. We recommend reviewing their individual privacy policies for more information.
7 Children's Privacy
StockNoter is a B2B inventory management tool designed for business owners and their staff. We do not knowingly collect personal information from children under the age of 18. If you believe a child has provided us with personal information, please contact us at support@stocknoter.in and we will promptly delete it.
8 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our service, technology, or compliance requirements. The updated policy will always be posted publicly on this page with a revised "Last updated" date. We encourage you to review this page periodically.
9 Contact Us
If you have any questions, concerns, or feedback regarding this Privacy Policy or how we handle your data, please contact us:
Email:support@stocknoter.in
We aim to respond to all privacy-related inquiries within 3 business days.
