Data Compliance Policy

This document describes how Quick Stock handles the inventory and sales data you upload, the controls we have in place, and your rights as a data owner.

1. Data ownership

You own the data you upload. Quick Stock processes it solely to deliver the service to you. We do not use it to train third-party models, do not sell it, and do not share it with marketplaces.

2. Tenant isolation

Every tenant-scoped database table enforces row-level security. Each query is scoped to the authenticated tenant’s identifier before it reaches the data layer. Cross-tenant reads are not possible from the application.

3. Authentication

Sessions use a 15-minute access token held in browser memory and a 7-day refresh token in an httpOnly cookie. Refresh tokens are rotated on every use and revoked on detected reuse.

4. Encryption

All HTTP traffic is served over TLS 1.2 or higher. Database connections are encrypted in transit. Cache traffic to Redis uses TLS.

5. Sub-processors

We use the following sub-processors to deliver the service:

• Vercel (application hosting)
• Supabase (PostgreSQL database, authentication)
• Upstash (Redis cache)
• Resend (transactional email)
• Sentry (error monitoring)

Each sub-processor has its own data processing agreement and complies with industry standard security practices.

6. Data residency

Your data is stored in data centres operated by the sub-processors listed above. Specific region details are available on request from support@quickstock.in.

7. Retention and deletion

Raw uploaded files are deleted from disk immediately after parsing. Structured inventory and sales data is retained while your workspace is active. Deleting a workspace from Settings is a hard delete that cascades across all tenant tables.

8. Data subject requests

Email support@quickstock.in with a data access, correction, portability, or deletion request. We acknowledge within 5 business days and complete within 30 days.

9. Incident response

If we detect unauthorised access to your data we will notify the registered workspace administrator within 72 hours of confirmation, along with the scope, remediation steps, and any actions you should take.

[This document is a working draft prepared by the Quick Stock team and has not been reviewed by legal counsel. Update this notice when the policy is reviewed.]