Privacy policy
Last updated: 30 October 2026
This is a first version. Have it reviewed by a lawyer before you take on paying customers.
Stokyo is a service of [Bedrijfsnaam of naam zelfstandige], [Straat nr, postcode gemeente, België], company number [BE 0xxx.xxx.xxx] (“we”). We are the controller of your personal data on stokyo.app. Questions? Email [contact@stokyo.app].
What data we process
- Account: your email address and, if you choose, a password (stored encrypted).
- Your business: name, language, plan and the people you invite (email address and role).
- Your stock: products, suppliers (name, phone number, email address, note), counts, deliveries, orders, events, sales, costs and revenue you enter.
- Invoices: the photos and PDFs you scan, and what was read from them.
- Technical: limited logs (such as IP address and time) to keep the service secure and working.
Why
- To provide Stokyo as agreed (performance of the contract).
- To sign you in and send emails that belong to the service, such as a sign-in code, an invitation or your weekly summary (performance of the contract; the weekly summary can be switched off).
- To secure the service and fix errors (legitimate interest).
- To meet legal obligations, such as accounting for our invoices (legal obligation).
We don’t sell your data, don’t use it for advertising and don’t build profiles.
Who helps us (processors)
- Supabase: database, storage and sign-in. Your data is stored in a data centre in Ireland (EU).
- Cloudflare: delivers the website quickly and securely.
- Brevo (France): sends Stokyo’s emails.
- Anthropic (United States): only when you scan an invoice, the image is sent to read its text. [Check and state the transfer basis here, e.g. the EU standard contractual clauses in the data processing agreement.]
A data processing agreement is or will be in place with each processor.
How long
We keep your data as long as your account exists. If you delete your business, we erase the data within 30 days, except what the law requires us to keep longer (such as invoices). Stock movements older than 120 days are summarised.
Your rights
You may access, correct and erase your data, restrict or object to processing, and take your data with you. You can always export it yourself in the app (More → Settings). For anything else: [contact@stokyo.app]. You can also lodge a complaint with the Belgian Data Protection Authority (www.dataprotectionauthority.be).
Security
Connections are always encrypted. Each business only sees its own data, and you decide what each person can do.