Legal

Privacy Policy

Last updated: April 11, 2026

At Tillstock, your privacy is important to us. This policy explains what data we collect, how we use it, and the choices you have. We never sell your data and we never share it with third parties without your explicit consent.

1. Information We Collect

Account information: your name and email address. Sign-in and passwords are handled by Amazon Cognito — we never see or store your password.
Organization data: Business name, logo, country, currency preference, and any team member details you add.
Product and inventory data: All products, stock levels, categories, and related information you enter into the platform.
Order and transaction data: Sales orders, purchase orders, customer records, and supplier records you create.
Usage data: Pages visited, features used, session duration, and error logs — collected to improve the product.
Device and browser data: IP address, browser type, and operating system for security and fraud prevention.

2. How We Use Your Information

To provide and operate the Tillstock platform and all its features.
To send account emails such as verification, password reset, team invitations and the alerts you have turned on.
To improve and develop new features based on aggregate, anonymised usage patterns.
To enforce our Terms of Service and detect or prevent fraud and abuse.
To comply with legal obligations and respond to lawful requests from authorities.

3. Data Storage and Security

All data is stored on AWS infrastructure, encrypted at rest and in transit.
Each business’s data is kept separate, and every request is checked against the business it belongs to.
Access to production systems is limited and goes through single sign-on.
Dependencies are scanned and updated, and every change is built and tested before it goes live.
In the event of a data breach, we will notify affected users within 72 hours in accordance with GDPR.

4. Data Sharing

We do not sell your personal data to any third party, ever.
We share data only with the providers needed to run the service — Amazon Web Services for hosting and sign-in, and Resend for email. If you take the Online Store package, Stripe processes your customers’ card payments and Twilio sends text receipts.
We may disclose data if required by law, court order, or government authority.
If Tillstock is acquired or merged, your data may be transferred as part of that transaction. We will notify you in advance.

5. Cookies

We use strictly necessary cookies to keep you signed in and keep your session secure.
We use local storage to remember small preferences, such as light or dark mode.
We do not use advertising or tracking cookies.
You can manage your cookie preferences at any time. See our Cookie Policy for full details.

6. Your Rights (GDPR & Privacy Laws)

Access: Request a copy of all personal data we hold about you.
Rectification: Correct any inaccurate personal data.
Erasure: Request deletion of your account and all associated data.
Portability: Export all your organisation's data in CSV format at any time from within the app.
Objection: Object to processing of your data for certain purposes.
To exercise any of these rights, contact us at tamateymichael99@gmail.com.

7. Data Retention

We retain your data for as long as your account is active.
If you cancel your account, we retain your data for 30 days in case you wish to reactivate.
After 30 days, all your data is permanently deleted from our systems.
Your audit log is kept for as long as you choose in your settings — 90 days, 6 months, a year, or indefinitely.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect.
Continued use of Tillstock after the effective date constitutes acceptance of the updated policy.

9. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us:
Email: tamateymichael99@gmail.com
Or use the contact form at tillstock.com/contact