StockedUp Privacy Policy
Publish at: https://stockedup.ai/privacy
Last updated: 18 October 2026
This Privacy Policy explains how Statistical Edge Ltd ("we", "us", "our") collects, uses, and shares information when you use the StockedUp mobile application (Android / iOS), package name uk.co.statisticaledge.stockedup.
StockedUp is a venue stocktake and inventory tool for hospitality teams (pubs, bars, and similar venues).
1. Who we are (data controller)
Statistical Edge Ltd
Company number: 16277247
Registered office: Statistical Edge, 124 City Road, London, United Kingdom, EC1V 2NX
Contact for privacy and support: support@statisticaledge.co.uk
Website: https://statisticaledge.co.uk
For UK GDPR purposes, Statistical Edge Ltd is the data controller for personal data processed in connection with StockedUp (except where a third-party processor processes data solely on our instructions, as described below).
2. What StockedUp does
You use StockedUp to count and manage venue inventory: venues, sections, items, stocktakes, team memberships, and invites. The app is designed to work offline on the device and sync with your signed-in team when online.
3. Information we process
3.1 Account and authentication
When you create an account or sign in, we process:
- Email address
- Display name (if provided)
- Authentication identifiers / tokens needed to keep you signed in
Sign-in is handled by Firebase Authentication (Google Firebase). You may sign in with email/password or Google Sign-In. Email/password accounts must verify their email before they can view or accept team invites. Google Sign-In is already verified.
We do not build a separate marketing profile from your StockedUp account.
3.2 Venue and inventory data
Depending on how you use the app, we process operational data you enter or generate, such as:
- Venue name and related venue settings
- Sections and inventory items
- Stocktake counts, statuses, and related stocktake records
- Team memberships and invite information
This data is stored:
- On your device (local storage such as AsyncStorage) so the app can work offline. Android backup and device-transfer extraction of that data are disabled, because the device also holds sign-in tokens.
- In our cloud database (Supabase) when you are signed in with a team, so invited teammates can share the same venue data.
Venue inventory data belongs to your venue/team. We do not sell it.
3.3 App and API usage (service operation)
To run StockedUp, the app communicates with our backend API hosted on Fly.io at https://stockedup-api.fly.dev. That API may receive authenticated requests needed for sync, voice mapping, billing flows, and related features. Technical logs necessary to operate and secure the service (for example request metadata, error information, and authentication status) may be processed for a limited period.
3.4 Optional: voice stocktake
If you choose to use voice capture while you have a signal, StockedUp records audio on your device and sends that recording to our API. The API sends the raw audio to OpenAI for transcription using the model gpt-4o-mini-transcribe. The transcript, together with item names from your venue (and, where that feature is used, reference product names), is then sent to OpenAI's gpt-4o-mini model so speech can be turned into inventory counts or structured item details.
When you have no signal and the phone can transcribe on the device, the audio stays on the phone. It is not sent to OpenAI or to Apple or Google servers. Section product names may be passed to the on-device recogniser as hints.
When you have no signal and the phone cannot transcribe on the device, the recording stays on the device until you are online. It is then sent the same way as a normal voice take. The section is not counted until you check the result.
Voice is only used when you start a recording. If you do not use voice features, this processing does not occur.
OpenAI processes audio and text that does reach it to provide the feature. This policy does not state how long OpenAI retains it. See the OpenAI Privacy Policy.
3.5 Optional: payments
Paid plans are completed on the StockedUp website. The app shows whether a venue's plan is active and does not email a link to pay. Payment card details are processed by Stripe according to Stripe's terms and privacy policy. StockedUp does not collect or store full card numbers on our servers or in the app.
3.6 Optional: crash and error reporting
The app can send crash / error diagnostics to Sentry when a Sentry DSN is configured for a production build. That may include device/app technical information and error stack traces needed to fix bugs. If Sentry is not configured, this does not run.
3.7 Analytics and advertising
We do not currently use third-party advertising SDKs or marketing analytics suites (for example Amplitude, Mixpanel, or ad networks) in StockedUp. If that changes, we will update this policy before enabling them.
3.8 Support communications
If you email us (for example support@statisticaledge.co.uk), we process the content of your message and your email address so we can respond.
3.9 Website visits
If you start a trial or a venue from the StockedUp website, we store how you arrived: campaign parameters (utm), referrer, and landing page. That is saved on the venue (venues.acquisition) and, for funnel steps, in marketing_events. Values that look like an email address or a card number are dropped before they are stored. This is not a separate marketing profile of your StockedUp account.
4. Why we process data (purposes and lawful bases)
We process personal data to:
- Provide and secure the StockedUp service (accounts, sync, team access) — contract / legitimate interests
- Store and sync venue inventory you choose to enter — contract / legitimate interests
- Process optional voice transcription and mapping you initiate — contract / legitimate interests (and only when you use the feature)
- Process optional paid plans you choose on the website — contract
- Record how a website visitor arrived when they start a venue (campaign, referrer, landing page), without storing email addresses or card numbers in that record — legitimate interests
- Diagnose crashes and improve reliability (when Sentry is enabled) — legitimate interests
- Respond to support requests — legitimate interests / contract
- Comply with legal obligations where applicable — legal obligation
Where UK GDPR requires consent for a specific optional feature, we will ask for it in-product before enabling that processing.
5. Who we share data with (processors / infrastructure)
We use service providers who process data on our behalf to operate StockedUp:
| Provider | Role |
|---|---|
| Google Firebase | Account authentication |
| Supabase | Cloud database for synced venue/team data |
| Fly.io | Hosting for the StockedUp API (stockedup-api.fly.dev) |
| OpenAI | Optional voice transcription (gpt-4o-mini-transcribe) and transcript / item-name mapping (gpt-4o-mini), only if you use voice |
| Stripe | Optional paid billing (only if you subscribe) |
| Resend | Verification emails, team-invite emails, and trial-reminder emails |
| Sentry | Optional crash/error reporting (when configured) |
We do not sell your personal data or venue inventory data. We may disclose information if required by law, or to protect the rights, safety, and security of users, the public, or Statistical Edge Ltd.
6. International transfers
Some providers (for example Google, OpenAI, Stripe, Sentry, Fly.io, Supabase) may process data in the UK, EEA, United States, or other countries. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the provider's UK/EU adequacy mechanisms or standard contractual clauses, as offered by those providers.
7. Retention
- Account data: kept while your account remains active. When you delete your account in the app, or ask us to delete it, we delete the Firebase login (after the database changes succeed), your profile, and the voice-usage counters we hold for you. Where you are the only member of a venue, we also delete that venue and its cloud inventory. If another owner remains, the venue stays. If there are other members but no other owner, the oldest active manager becomes owner. If there is no manager, deletion waits until you transfer ownership. Invites you created on a venue that stays are kept, with your name removed from the "created by" field. Limited records may be kept where we must retain them for legal, security, or dispute reasons.
- Venue / inventory data: retained while your venue/team continues to use StockedUp, and on your device until you clear app data, delete the account as described above, or uninstall. After account or venue deletion, we remove associated cloud records from systems we control, subject to backup cycles and legal retention needs.
- Voice audio and transcripts sent to OpenAI: processed so the feature can run. We do not state an OpenAI retention period. See the OpenAI Privacy Policy.
- Logs / diagnostics: retained only as long as needed for security, debugging, and operations.
- Support emails: retained as needed to handle your request and for ordinary business records.
8. Security
We use industry-standard measures appropriate to a small SaaS product, including transport encryption (HTTPS) for production, access controls on cloud services, and authentication for API access. Production Android builds do not allow cleartext HTTP. No method of transmission or storage is 100% secure; please protect your device and account credentials, and only invite trusted teammates.
9. Your rights (UK GDPR)
Depending on applicable law, you may have the right to:
- Access your personal data
- Rectify inaccurate personal data
- Erase personal data in certain circumstances
- Restrict or object to certain processing
- Data portability for data you provided
- Complain to the UK Information Commissioner's Office (ICO): https://ico.org.uk
To exercise these rights, email support@statisticaledge.co.uk with the subject "StockedUp privacy request". We may need to verify your identity and your relationship to the venue/team data involved.
Account / data deletion: you can delete your account in the app (Settings → Delete account). Steps and the email route are also at https://stockedup.ai/delete-account. If you are the only member, deleting your account deletes that venue's cloud data. If another owner remains, the venue stays with the team. If other members exist and there is no other owner, ownership moves to the oldest manager. If there is no manager, you are asked to transfer ownership first.
10. Children
StockedUp is intended for business / hospitality use by adults. It is not directed at children under 16. We do not knowingly collect personal data from children.
11. Permissions and device features
Depending on the features you use and your device OS, StockedUp may request:
- Network access (required)
- Microphone access (only for optional voice stocktake)
- On Android, permission to change audio settings (
MODIFY_AUDIO_SETTINGS), which the recording library uses when it sets the audio mode for a voice capture
You can deny optional permissions in system settings; core inventory counting without voice remains available. The app does not request permission to draw over other apps or to read and write shared external storage.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. For material changes, we will take reasonable steps to notify users (for example in-app notice or email where appropriate). Continued use of StockedUp after an update means you should review the revised policy.
13. Contact
Questions about this Privacy Policy or your data:
Statistical Edge Ltd
Email: support@statisticaledge.co.uk
Web: https://statisticaledge.co.uk
Registered office: Statistical Edge, 124 City Road, London, United Kingdom, EC1V 2NX
Company number: 16277247
This policy applies to the StockedUp app listing and in-app legal links. In-app Settings may open this public URL when configured, or show a short in-app summary if the public URL is not set.