Privacy Policy

1. Introduction

At StokX we value your privacy. This policy explains which data is collected while you use the StokX mobile and desktop application and the stokxpro.com website, how it is processed, where it is stored, and what your rights are.

StokX is a cloud-based application and requires an internet connection to work. By using the application or the website you declare that you have read and accepted this policy.

2. Data We Collect

2.1. Account information

Your name, email address and password are collected during registration. Your password is stored in an irreversible (hashed) form; it cannot be seen by us in plain text.

2.2. Business data

The products, categories, customer accounts, stock movements, sales and purchase records, financial records, staff and permission information you create in the application, together with your application settings, are processed under your account and stored on our servers.

2.3. Contact data

You may provide data such as your name, email, phone number and message content through the contact form, newsletter sign-up or a support request on our website. This data is used to answer your request.

2.4. Technical and anonymous data

We may collect technical information that cannot be linked to your identity — such as device type, operating system version, application version and crash reports — for the purpose of improving the product.

2.5. Location data

Only in the field sales feature and only when you are assigned to a vehicle, the precise (GPS) location of your vehicle is collected and stored on our servers under your account. This data is used so that your business manager can track field vehicles live on a map and manage routes and deliveries. Location is collected only for as long as you are assigned to a vehicle. On Android it may also be collected while the application is in the background or closed; a persistent notification is shown on your device while sharing is active and you can stop it at any time. On iOS location is collected only while the application is in the foreground; the app does not use background location. Your field sales location is used only within your own business; it is not shared with third parties, not sold and not used for marketing.

Approximate location for weather. If you allow it, your device's approximate location is read only while the application is open, in order to show the weather on the home page for where you are. A coordinate rounded to about 1 km is sent to the Open-Meteo and OpenStreetMap services solely to look up the weather and the place name; it is not linked to your account, is not stored on our servers and is not used for marketing. If you decline, the weather is shown for your business's city; you can turn the permission off at any time in your device settings. The "my location" button on the warehouse map uses the same permission to center the map on where you are; that location is not saved.

2.6. Voice / microphone data

Microphone access is requested only when you use voice-based stock counting or ask the AI assistant a question by voice. Your voice is converted to text; no audio recording is stored. The text of the question you ask the AI assistant is sent to the relevant third-party service (see Section 5) so that an answer can be generated.

2.7. Purchase and subscription data

When you purchase the in-app StokX Pro subscription, the payment takes place entirely on Apple App Store or Google Play. Your card number, bank details and billing address are never transmitted to us and are never stored on our servers.

Only the technical data required to verify the validity of the subscription reaches our servers from the store: the transaction identifier, the purchased product identifier (which plan), the purchase and expiry dates, the automatic renewal status, the environment (production / sandbox) and the verification response returned by the store. This data is processed under your account.

This data is used only to verify the validity of your subscription, to manage your ad-free use and your desktop application access, and to resolve your support requests; it is not used for marketing and not sold to third parties.

2.8. Advertising data (Yandex and Google AdMob)

The StokX mobile application and the web panel are free. If you do not have a StokX Pro subscription once the first 14-day trial period of your account has ended, ads are shown in the mobile application (Android and iOS) through Yandex Advertising Network (Yandex Mobile Ads SDK) and Google AdMob, and in the web panel (stokxpro.com/panel) through Yandex Advertising Network site advertising. In the mobile application, ads are currently served by Yandex Advertising Network; the Google advertising software is present in the application for consent management (UMP) and as a fallback ad infrastructure. The advertising service is provided by Yandex and Google (Google Ireland Limited / Google LLC). No ads are shown to StokX Pro subscribers or to users within the trial period, and in that case the ad SDK makes no ad requests. There are no ads in the desktop application.

When ads are shown, Yandex and Google may process the following data through the advertising software development kits (SDKs) integrated into the mobile application:

• Advertising identifier (Android Advertising ID; on iOS, the IDFA — only if you have given permission),
• IP address (used to infer approximate location),
• Device and operating system information,
• Ad interactions within the application (impressions and clicks),
• Crash and diagnostic data.

In the web panel, the advertising script (yandex.ru/ads/system/context.js) is loaded into your browser only for users who are going to be shown ads; in that case cookies or similar identifiers, IP address, browser and device information and ad interactions (impressions and clicks) are processed by Yandex. In the web panel, ads are shown as a banner at the bottom of the screen and, on touch-screen browsers, may also be shown as full-screen and sticky bottom ads.

This data is processed to serve ads, to measure them and to prevent fraud. Personalisation of ads depends on the following consents and permissions:

• European Economic Area (EEA), United Kingdom and Switzerland: your consent to personalised ads is requested through Google's User Messaging Platform (UMP). You can change your choice or withdraw your consent at any time in the application under Settings → Ad privacy choices.
• iOS: Apple's App Tracking Transparency (ATT) permission is requested; if you do not grant it, ads are shown without personalisation and your advertising identifier (IDFA) is not used. You can change the permission at any time under Settings → Privacy & Security → Tracking.
• Android: you can reset or delete your advertising ID in the ads section of your device settings (on most devices Settings → Google → Ads or Settings → Privacy → Ads).
• Web panel: you can delete or block advertising cookies at any time in your browser's cookie settings; ad delivery or measurement may then be affected.

Ads with adult content are not shown (the ad content rating is limited to PG). Your business data (products, customer accounts, sales, etc.) and your account information are not shared with the advertising provider. Google's explanation of how it uses this data: policies.google.com/technologies/partner-sites. Yandex's privacy policy: yandex.com/legal/confidential. The processing and retention of this data by Yandex and by Google is subject to each one's own privacy policy.

3. Purposes of Processing

• To provide the service and manage your account,
• To synchronise your data across the devices you sign in on,
• To run application features (reports, business intelligence, invoice reading, barcode lookup, etc.),
• To verify your subscription status and manage your ad-free use and your desktop application access,
• To serve ads in the free version and measure ad delivery (through Yandex and Google AdMob; see Section 2.8),
• To respond to your support requests,
• To detect and fix software defects,
• To maintain information security and comply with legal obligations.

4. Storage and Synchronisation

Your business and account data is stored on our servers (stokxpro.com) under your account and is synchronised across all devices you sign in on. This lets you access the same data from more than one device with the same account.

Data is transmitted over a secure connection (HTTPS/TLS). A local cache is also kept on your device for fast access and temporary offline viewing. If you wish, you can back up your data to your own Google Drive account; that backup is under your control alone.

5. Third-Party Services

StokX uses the following third-party services in order to provide certain features. Only the data required by the relevant function is transmitted to these services:

• Anthropic (Claude AI): in the business intelligence and invoice reading features, the relevant business data is transmitted for processing.
• Barcode lookup service: only the barcode number is sent, in order to retrieve product information.
• Firebase (Sign in with Google / Apple): used for authentication if you choose it.
• Google Drive: only when you enable it, your backups are uploaded to your own Drive account.
• Currency / market data services: for display purposes only.
• Weather and map services (Open-Meteo, OpenStreetMap, CARTO): for weather and place names only an approximate coordinate or a city name is sent; map screens request the map tiles of the area being viewed. No account information is sent (see Section 2.5).
• Apple App Store / Google Play: subscription purchase and verification. Payment takes place entirely on the store side; only the technical data verifying the validity of the subscription is returned to us (see Section 2.7).
• Yandex Advertising Network (advertising): only in the free version, after the 14-day trial has ended and when there is no StokX Pro subscription, to show ads in the mobile application (Yandex Mobile Ads SDK) and the web panel (site advertising). The advertising identifier (mobile), cookies and similar identifiers (web), IP address, device and browser information and ad interactions are processed; your business data is not shared (see Section 2.8).
• Google AdMob (advertising): only in the free version, after the 14-day trial has ended and when there is no StokX Pro subscription, to show ads in the mobile application (including consent management and fallback ad infrastructure). The advertising identifier, IP address, device information and ad interactions are processed; your business data is not shared (see Section 2.8).

Some of these service providers may be located abroad; in that case the transfer is carried out in accordance with the applicable legislation. We do not sell, rent or share your account and business data with third parties for marketing purposes. The data Yandex and Google process for ads in the free version is described in Section 2.8.

6. App Permissions

The application may request the following permissions, only when you use the relevant features:

• Camera: barcode scanning and adding documents/photos,
• Location: to show the weather on the home page for where you are and to mark warehouse locations on the map (only while the app is open); and, when you are assigned to a field sales vehicle, to share the vehicle's live location with your business manager. On Android, background location is used only while the field sales feature is active and remains visible through a persistent notification; on iOS, location is used only while the app is in the foreground,
• Microphone: for voice-based stock counting and asking the AI assistant a question by voice (voice is converted to text, not recorded),
• Storage / Gallery: product photos and backup files,
• Notifications: critical stock alerts and reminders,
• Contacts: importing customer/supplier information,
• Local network: connecting to a printer and to security cameras on the local network (RTSP/ONVIF),
• Tracking (iOS only): the App Tracking Transparency permission, requested for personalised ads when ads are about to be shown in the free version; if you do not grant it, ads are shown without personalisation,
• Biometrics: application security (fingerprint / face recognition).

Permissions are optional; if you do not grant one, only the related feature stops working and the application continues to run.

7. Cookies and Tracking

Our website uses a limited number of cookies for session management and anonymous analytics. You can delete or block cookies from your browser at any time.

In the mobile application, while ads are shown in the free version, Yandex and Google AdMob may use device identifiers such as the advertising identifier; for details and your choices, see Section 2.8.

In the web panel (stokxpro.com/panel), while ads are shown in the free version, Yandex Advertising Network may use cookies or similar identifiers for advertising purposes; you can delete or block these cookies in your browser settings. See Section 2.8 for details.

8. Data Security

The main measures we take to protect your data:

• Encrypted communication between the server and the device with TLS (HTTPS),
• Storing passwords in an irreversible (hashed) form,
• Access to data only with your own authenticated account,
• The option of a biometric lock or PIN protection on the device.

For the security of your account we recommend using a strong password and not sharing your sign-in credentials.

9. Retention Period

Your data is retained for as long as the service is provided and within the applicable statutory retention periods. When you delete your account, the data linked to your account is deleted or anonymised, except where legal obligations require otherwise.

Subscription records (Section 2.7) may be kept after account deletion, in a form that cannot be linked to your identity, due to the retention obligations imposed by financial legislation. These records contain no payment information.

10. Your Rights and Account Deletion

Under the Turkish Personal Data Protection Law (KVKK) and the GDPR you have the following rights:

• To learn whether your data is being processed,
• To request access to, correction of, or deletion of your data,
• To request restriction of processing,
• To withdraw your explicit consent,
• To request data portability.

You can change or withdraw your ad-related consents and permissions at any time: in the application under Settings → Ad privacy choices (EEA, United Kingdom and Switzerland), on iOS under Settings → Privacy & Security → Tracking, and on Android by resetting or deleting the advertising ID in the ads section of your device settings, and in the web panel in your browser's cookie settings (see Section 2.8).

You can delete your account and your data directly from within the application: My Account → Delete Account. This permanently removes your account and your data on the server. If you prefer, you can also send deletion or other requests to stokx.info@gmail.com; your request is answered within 30 days at the latest.

11. Children's Privacy

StokX is not designed for users under the age of 13. If we learn that a user under 13 has provided data, we delete that data.

StokX is an application intended for businesses; the ads in the free version are not directed at children either. Ads with adult content are not shown (the ad content rating is limited to PG).

12. Contact

For all questions and requests regarding our privacy policy:

• Email: stokx.info@gmail.com
• Phone: 0546 853 98 26
• Address: Karşıyaka Mah., Asya Center, Afyonkarahisar

This policy may be updated from time to time. We will inform you of significant changes by in-app notification or email.