StockPrivacy notice
Last updated 12 October 2026.
Who we are
StockLock is a Shopify app provided by Parabox Games Ltd, Unit 3 Millers Yard, Market Harborough, LE16 7PW, United Kingdom ("we", "us"). Contact us about privacy at support@stocklock.net.
This notice covers the StockLock app and this website. For the merchant's own data about their customers, the merchant is the controller and we process it on their behalf, only to run StockLock for them.
Our design: customer data stays in Shopify
StockLock runs mostly inside Shopify. Limits are stored on the merchant's products, enforced by a Shopify checkout rule, and shown by a theme app embed. Per-customer purchase counts are saved on the customer record in the merchant's own Shopify store, not on our servers.
What we process
| Data | Why | Where and how long |
|---|---|---|
| The merchant's store domain and Shopify store ID, plan and trial status, whether StockLock is switched on, a 30-day order count, and the IDs of the webhook subscriptions we created | To provide the app and the plan the merchant chose | Our database (Google Cloud Firestore, Belgium), while the app is installed and until Shopify asks us to delete it after uninstalling |
| Shopify access tokens for the store | To act for the store in Shopify (counting purchases, holding orders, opening drops) | Our database, encrypted (AES-256-GCM). Deleted as soon as the app is uninstalled or the plan ends |
| Order notifications from Shopify (order IDs), and, read from Shopify for limited products, the order's lines and customer ID | To update per-customer purchase counts and to hold orders that broke a limit | Processed in transit. Notifications wait in Google Cloud Pub/Sub for at most 7 days if delivery fails. Not stored in our database |
| Per-customer purchase counts (product IDs and quantities by order) | To enforce per-customer limits | In the merchant's Shopify store, on the customer record. Deleted when Shopify asks us to erase that customer |
| For invite-only drops: customer IDs, total spend and order counts of eligible customers | To pick and tag invitees | Read in the merchant's browser directly from Shopify. For very large drops, the chosen customer IDs pass through our server to Shopify's bulk tool and are not kept |
| Staff sign-in details from Shopify's session token | To check a request comes from the store's admin | Checked and discarded; not stored |
| Operational logs (store domain, times, error types) | To keep the service running and secure | Google Cloud Logging, kept for 30 days |
We don't sell data, use it for advertising, or use merchants' or customers' data to train models.
Who we share it with
Shopify, which hosts the merchant's store and runs the app's checkout rule, admin cards and theme embed. Google Cloud (Google Ireland Ltd), which hosts our service, database and message queue in the europe-west1 region (Belgium), and hosts this website (Firebase Hosting). Both act under data processing terms. We don't share data with anyone else unless the law requires it.
Legal bases
We process merchant data to perform our contract with the merchant (providing the app), and for our legitimate interests in running a secure, reliable service. We process the merchant's customers' data as the merchant's processor, on their instructions.
Deletion and Shopify's privacy requests
- On uninstall, we delete the store's access tokens straight away and stop all processing.
- When Shopify sends a shop redact request (48 hours after uninstalling), we delete the store's record.
- When Shopify sends a customer redact request, we delete that customer's purchase count from the merchant's store.
- For a customer data request: we hold no customer data on our servers, and the purchase count is visible to the merchant on the customer record in Shopify.
This website
stocklock.net sets no cookies and uses no analytics or tracking. Our host (Firebase Hosting) and Google Fonts receive your IP address to serve pages and fonts, as any web host does.
Your rights
Under UK and EU data protection law you can ask to access, correct or delete your personal data, object to or restrict its processing, and ask for a copy. If you're a shopper at a store using StockLock, contact that store first, since it controls your data; we'll help it respond. Email support@stocklock.net. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local authority.
Security
Access tokens are encrypted, each tied to its own store. Every request to our service that reads or changes data must be signed by Shopify or Google, and the service keeps no customer data. Access is limited to the people who run StockLock.
Changes
We'll update this notice if what we do changes, and change the date above.