Privacy Policy

The controller is [LEGAL COMPANY NAME], [COMPANY ID / TAX ID], with registered address at [ADDRESS]. You can write to us at contacto@stockai.es. Full details are in the legal notice.

For your account data (your name, your email), we are the controller. For the business data you upload that mentions people — for example, a supplier's contact or a customer's name in your sales history — the controller is your company, and we process it on its behalf, only to provide it the service.

What we do not collect: we use no analytics, pixels or advertising cookies, and we take no card payments inside the application, so we hold no payment data. More detail in the cookie policy.

Models are trained only on your account's data. When StockAI trains a forecast, it uses the history you uploaded to your account and nothing else; we do not mix data from different companies or use it to train other customers' models.

We do not sell your data, do not share it with advertisers and do not use it to send you advertising.

Some features use a language model from DeepSeek: the assistant (in the application and over WhatsApp), the morning summary on the Purchasing Panel, the explanation of a forecast and the quality check of a file. The Purchasing Panel summary is requested when you open that screen.

When they are used, we send DeepSeek the question and the data from your account needed to answer it — for example, product codes and names, quantities, the stock signal, suppliers and amounts. We do not send passwords or credentials. DeepSeek is based in China and processes that data under its own terms.

Your company's administrators can choose their own AI provider in Settings (for example OpenAI, Anthropic, Google, Groq, OpenRouter, DeepSeek or a compatible service of their own). The question and the data are then sent to that provider, not to DeepSeek, under your company's key and terms: that provider is a processor of your company, not ours. We only store its key, encrypted, and never show it again. If the chosen provider fails, we do not use another one on our own: the screen says what failed and shows rule-based text.

Artificial intelligence cannot be switched off entirely per account from the application. If you do not want your data to reach DeepSeek, ask your company's administrators to choose another provider, or write to contacto@stockai.es before using StockAI. If the service has no provider configured, nothing is sent and those screens answer with rule-based text.

We share data only with the providers we need to run StockAI, and only what their task needs:

We use no analytics services or advertising networks. The site's fonts are served from our own server, with no calls to third parties.

We may also disclose data if a law or a competent authority requires it.

Because of the providers above, your data may be processed outside your country: in Boston, United States (server), in China (DeepSeek, if you use the AI features with the default provider), in the country of the AI provider your company chooses in Settings and in the United States (Twilio, if you switch on WhatsApp or SMS).

If you are in the European Union or Spain, note that China has no adequacy decision from the European Commission. That is why we tell you which features send data to DeepSeek and how to avoid it.

• Each company sees only its own data. Every database query is filtered by the account of whoever makes it.
• Role-based permissions: administrator, analyst and viewer. Only an analyst or an administrator can change data.
• Passwords are stored with bcrypt and API keys as a fingerprint: not even we can read them.
• Credentials for connections and services (for example, the password of a database you connect) are stored encrypted with Fernet.
• Sessions expire after 15 minutes and renew themselves while the tab is open. Changing your password ends earlier sessions.
• The connection to the application is encrypted (HTTPS).

No system is infallible. If an incident affects your data, we will tell you and notify the authority where the law requires it.

You can ask us at any time for:

• Access: knowing what data of yours we hold.
• Rectification: correcting it. You can change your name and number yourself in My account.
• Erasure: deleting your account and all its data.
• Portability: a complete copy of your company's data in a ZIP file, one table per file.
• Objection and restriction: that we stop processing your data for some purpose, or restrict it.

Write to contacto@stockai.es from your account's email address. Today export and deletion are run by an account administrator through the API, or by us when you ask. We answer within one month at most, or sooner if the law of your country requires it.

If a company invited you, its administrator controls the business data: we handle requests about that data together with them.

If you are not satisfied, you can complain to the data-protection authority of your country: in Costa Rica, the Agencia de Protección de Datos de los Habitantes (PRODHAB); in Spain, the Agencia Española de Protección de Datos (AEPD).

We process data under Costa Rica's Law 8968 (Protection of the Person in the Processing of Personal Data) and, for users in the European Union or Spain, the General Data Protection Regulation (GDPR) and Organic Law 3/2018 (LOPDGDD). We hold no certifications or compliance audits.

StockAI is a service for businesses. It is not aimed at minors and we do not knowingly collect their data.

If we change this policy, we update the date above. If the change is significant, we tell you by email or inside the application before it takes effect.