Legal

Privacy Policy

Last updated: October 12, 2026

This policy explains what personal information Tillstock collects, why, where it is stored, who handles it and what choices you have. We never sell personal information. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who we are and who this covers

Tillstock Inventory Solutions Inc. ("Tillstock", "we", "us") runs the Tillstock platform. You can reach us at support@tillstock.com.
We handle personal information in two different roles, and this policy says which is which.
Our own role: for people who visit tillstock.com, contact us, or are named as the owner or a user on a business account, we decide why and how the information is used.
Our customers' role: when a business uses Tillstock, the information it puts in (its customers, shoppers, employees, suppliers) belongs to that business. We handle it only to run the service for them and on their instructions, under our data processing agreement with each customer. Those people should go to the business first about their information.

2. What we collect

Account information: the name, work email and phone number of a business's owner and users. Sign-in and passwords are handled by Amazon Cognito. We never see or store your password.
Business information: business name, address, tax and billing details, and the settings you choose.
Information a business puts into the service: products, stock, orders, suppliers, customers (name, email, phone, address, order history), and employees. This is the business's data.
Online store shoppers: when someone orders from a store run on Tillstock, we process their name, email, phone, address and order details for that store.
Usage and device data: IP address, browser, device type and activity logs, for security, fault-finding and the audit log.
Messages you send us: emails and contact-form messages.
We do not collect payment card numbers. Card payments in an online store are handled by Stripe.

3. Why we use it

To provide, secure and support the service.
To send service messages: sign-in codes, receipts, order updates, alerts and billing messages.
To invoice and collect payment, and meet our legal and tax duties.
To keep a record of the Terms accepted for a business: who accepted, when, and from which IP address and browser.
To prevent fraud and abuse, and to find and fix faults.
To improve the product, using error reports and fault logs, not the content of a business's own records.
We do not sell personal information. We do not use customer data to train AI models. We do not use it for advertising.
We send marketing email only to people who have agreed to receive it, and every such message has an unsubscribe link, as Canada's anti-spam law requires.

4. Who we share it with

We use a small number of service providers, and only for what they are needed for:
Amazon Web Services: hosting, data storage, sign-in (Cognito) and system email (SES).
Resend: sending transactional email such as receipts and order updates.
Stripe (not our service provider, but the business's own): card payments for online stores, paid to the business's own Stripe account. We do not bill businesses through Stripe. Stripe also uses payment details for its own fraud-prevention and legal purposes, under its own privacy policy.
Twilio: text-message receipts, only where a business turns that on.
Sentry: error monitoring in the web app, to find and fix faults.
We keep this list current. Businesses that use Tillstock get at least 30 days' email notice before we add or replace a provider that handles their customers' information for us, unless an urgent change is needed for security or continuity, when we tell them as soon as we reasonably can. A copy of our standard data processing agreement is available on request at support@tillstock.com.
We may also disclose information where the law or a court requires it, to protect people or the service, or in a sale or reorganisation of our business, with the same protections carried over.
Within a business, what a user can see depends on the role the business gives them.

5. Where it is stored

Tillstock's data is hosted by Amazon Web Services in the United States (N. Virginia). Information is therefore processed outside Canada and can be accessed under United States law.
Data is encrypted in transit and at rest, and each business's data is kept separate from other businesses'.

6. How long we keep it

While a business's account is active, we keep its data so it can use the service.
When an account ends, the business has 30 days to ask us for an export of its data. After that we delete it from our live systems within a further 30 days.
Encrypted backups are kept on a rolling schedule of up to 12 months, and deleted data ages out of them in that time.
We keep invoices and billing records for 6 years after the end of the tax year they relate to, because Canadian tax law requires it.
Account activity is logged for security. The readable log, with who did what, is kept for 90 days in the live system. A pseudonymous record of each action (a code for the person, their role and location, the action, the type and ID of the record acted on, and the time, with no name, email or IP address) is kept for up to 7 years for security and record-keeping, and is used for nothing else. While an account is active, receipts are kept for the period the business sets in its settings or, if it sets none, for 7 years; they are deleted with the account when it ends.
A business can ask us to delete specific information from our live systems earlier, and we will unless the law requires us to keep it. Copies in encrypted backups and in the pseudonymous audit record described above are deleted when they expire, not before.

7. How we protect it

Encryption in transit and at rest, role-based access, a record of changes in the audit log, and separation between businesses.
Only people at Tillstock who need access to do their job can reach customer data, and only for support or maintenance.
No system is perfectly secure. If a breach affects personal information and creates a real risk of significant harm, we tell the affected business without unreasonable delay, and report it to the Privacy Commissioner of Canada and affected individuals where the law requires it.

8. Your rights

You can ask to see the personal information we hold about you, ask us to correct it, and withdraw consent where we rely on it, subject to legal limits.
To make a request, email support@tillstock.com. We may need to confirm who you are first, and we will respond within 30 days.
If your information is held by a business using Tillstock (for example you shopped at their store), ask that business first. We will help them respond.
These policies are in English. A French version is at tillstock.com/fr/privacy for your convenience.
If you are not happy with how we handled a request, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, to the Commission d’accès à l’information.
Our Privacy Officer is the person responsible for personal information at Tillstock. Write to the Privacy Officer at support@tillstock.com.

9. Cookies

We use only the cookies and browser storage needed to keep you signed in and remember your settings. We do not use advertising or tracking cookies. See our Cookie Policy.

10. Children

Tillstock is built for businesses and is not directed at children. We do not knowingly collect information from anyone under 16.

11. Changes to this policy

We may update this policy. For a material change we will email account owners at least 30 days before it takes effect, and we will change the date at the top.

12. Contact

Tillstock Inventory Solutions Inc., Prince Edward Island, Canada.
Privacy Officer: support@tillstock.com
A postal address for notices is available on request.
Or use the contact form at tillstock.com/contact