Privacy Policy

This Privacy Policy describes how Inventory Assassin (“we,” “us”) collects, uses, and protects information when you use Inventory Assassin (the “Service”). It applies to visitors of our public website and to merchants who create an account.

We collect the following categories of information:

• Account information: the email address and password (stored as a salted hash by our authentication provider, Supabase — we never see or store your plaintext password) you use to sign up, and your name if you provide one.
• Company/organization information: your company name and any organization details you enter, such as industry or currency.
• Inventory data you upload: the contents of the CSV files (or, in the future, other connected data sources) you upload — product names, SKUs, categories, vendors, quantities, unit costs, retail prices, and sales history. This data is uploaded voluntarily by you for the purpose of generating an analysis.
• Billing identifiers: if you subscribe to a paid plan, our payment processor (Stripe) collects your payment card details directly — we never receive or store your full card number. We do store a Stripe customer ID and subscription status so we know your account's billing state.
• Trial redemption records: if your organization redeems a promotional invite-trial code, we store which code was used, your organization ID, the redeeming user, and the redemption and expiration timestamps, so we can grant and later expire the correct access. Redeeming a trial does not require or collect a payment method.
• Usage information: basic technical information generated by using the Service, such as sign-in timestamps and error logs, used only to operate and troubleshoot the Service.
• Acquisition source: if you sign up after using one of our free single-item calculators (under /tools), we record that the signup came from that channel and which calculator — for example, “organic search tool, dead-stock-calculator.” This is captured once, at signup, from the page you came from; we do not track your browsing before you create an account, and the calculators themselves never send the numbers you enter into them anywhere — see Section 2a.

2a. Free calculators

Our free single-item calculators (under /tools) run entirely in your browser. The numbers you enter — units, cost, dates, and similar — are never sent to our servers, never stored, and never included in any analytics event. Using a calculator does not require an account and collects no personal information.

We use Google Analytics on our public marketing site and free calculators — never within the authenticated product you sign in to use — to understand aggregate page traffic and which free calculators are used (e.g. a page view or that a calculation was completed); it does not receive the values you enter into a calculator. Google Analytics sets cookies in your browser to distinguish visits, and the resulting usage data (pages viewed, general location, device type) is sent to and processed by Google under Google's own Privacy Policy. We have not enabled Google Signals or any advertising/remarketing feature within Analytics, and we do not use any other third-party advertising trackers. If that changes, this policy will be updated first.

• To provide the Service: authenticate you, store your uploaded inventory data, and run the analysis, IA Move, and results features you request.
• To operate your subscription: process payments, apply free-tier limits, and manage billing status through Stripe.
• To communicate with you: respond to support requests and send account-related notices (e.g. billing issues, material changes to these policies).
• To maintain and secure the Service: troubleshoot errors, prevent abuse, and enforce our Terms of Service.

We do not sell your information. We do not use your uploaded inventory data (“Merchant Data”) to train shared or cross-customer models, and we do not use an AI model to process or interpret Merchant Data at runtime — the scoring, IA Move, and results calculations in the Service are deterministic software logic, not an AI system, and your uploaded data is not sent to any AI provider.

We do not sell or rent your information. We share information only with the service providers that are necessary to operate the Service, each acting under its own privacy and security commitments:

• Supabase — hosts our database, file storage, and authentication. Your account data and Merchant Data are stored in a Supabase-managed Postgres database and storage bucket.
• Vercel — hosts and serves the application itself (the web application you interact with).
• Google Analytics — provides the aggregate traffic/usage analytics described in Section 2a. Google processes this data under its own privacy policy.
• Stripe — processes subscription payments and stores your payment method on our behalf; we do not store full card numbers ourselves.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, property, or safety of Inventory Assassin, our users, or others. A current, maintained list of our subprocessors — including any future additions — is published in our Data Processing Addendum, which also covers GDPR Article 28 processor terms for organizations that require them.

We set session and authentication cookies (via Supabase Auth) strictly necessary to keep you signed in and protect the Service — these cannot be declined without breaking sign-in, and we do not ask for consent to them, consistent with the “strictly necessary” cookie exemption. Google Analytics is the only non-essential cookie we set (see Section 2a for what it collects), and it only runs on our public marketing site and free calculators — never within the authenticated product, and never until you accept it.

The first time you visit, a banner asks you to accept or decline analytics cookies; declining never limits your access to Inventory Assassin. You can change your choice at any time using the Cookie Preferences link in the site footer. We do not use advertising or cross-site tracking cookies, and we do not currently respond to browser “Do Not Track” signals (there is no standardized way to honor them, and we have no advertising/tracking cookies for one to apply to regardless).

We retain your account and Merchant Data for as long as your account is active, so that historical analyses, decisions, and results remain available to you. If you close your account, you may request deletion of your account and associated Merchant Data by contacting us (see Section 12); we will delete it within a reasonable time, except where we are required to retain limited records (such as billing records) for legal or accounting purposes.

Depending on your location, you may have rights to access, correct, export, or delete your personal information. You can review and update most account information directly in the Service, or contact us using the details in Section 12 to make a request. Section 9 (GDPR) and Section 10 (CCPA/CPRA) below set out additional, region-specific rights and how to exercise them.

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS), database-level access controls that isolate each organization's data (row-level security), and restricted internal access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you are located in the European Economic Area, the UK, or Switzerland, this section applies in addition to Section 7.

Legal bases for processing

• Account information and Merchant Data — necessary to perform our contract with you (providing the Service you signed up for).
• Usage information and security logs — our legitimate interest in operating, securing, and troubleshooting the Service.
• Billing identifiers — necessary to perform our contract with you and to comply with accounting/tax obligations.
• Analytics cookies (Section 5) — your consent only, given or withdrawn at any time via the Cookie Preferences link in the footer.

Your rights

You have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure (“right to be forgotten”) — see Section 6 for how account deletion works;
• request restriction of processing;
• receive a portable copy of your data in a structured, commonly used, machine-readable format;
• object to processing based on our legitimate interest; and
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us using the details in Section 12. We will respond within one month, extendable by a further two months for complex requests (we will tell you if an extension is needed and why). You also have the right to lodge a complaint with your local data protection supervisory authority at any time, whether or not you have contacted us first.

Under the categories defined by Cal. Civ. Code §1798.140, in the preceding 12 months we have collected: identifiers (email address, name if provided), commercial information (subscription/billing status — Stripe collects and processes your actual payment details directly, not us), internet or network activity (the aggregate analytics described in Section 2a), and the inventory, cost, and sales records you upload as Merchant Data. We collect these for the business purposes described in Section 3, and disclose them only to the service providers named in Section 4.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA — we have not enabled Google Signals or any advertising/remarketing feature, and we use no other ad-tech trackers. Because we do not sell or share, no “Do Not Sell or Share My Personal Information” opt-out mechanism is required for us to offer; you can still confirm and change your analytics cookie choice at any time via the Cookie Preferences link in the footer.

Your rights as a California resident

• the right to know what personal information we have collected, used, and disclosed about you;
• the right to delete your personal information (see Section 6);
• the right to correct inaccurate personal information; and
• the right to non-discrimination — we will never deny you the Service, charge a different price, or provide a different level of service or quality because you exercised a CCPA right.

To exercise these rights, email inventoryassassins@gmail.com with “CCPA Request” in the subject line. We will verify your identity using the email address on your account before responding, and will respond within 45 days (extendable once by an additional 45 days, with notice to you). You may designate an authorized agent to submit a request on your behalf by providing us their signed written permission from you. We do not knowingly collect personal information from minors under 16 — the Service is intended for business use by adults.

Our service providers (Section 4) may process information in the United States and other countries outside your own. Where personal information is transferred from the EEA, UK, or Switzerland to a country not found to provide an adequate level of data protection, we and/or our service providers rely on appropriate safeguards recognized under GDPR — such as the European Commission's Standard Contractual Clauses, or a provider's own certification under an approved transfer framework — to protect that information.

Questions about this Privacy Policy, or requests regarding your data (including GDPR or CCPA requests), can be sent to inventoryassassins@gmail.com or via our Contact page.

We may update this Privacy Policy from time to time. A material change (such as a new data use or a new category of information collected) requires every signed-in user to affirmatively re-accept before continuing to use the Service, not just new signups — see the Terms of Service's acceptance requirement. We will update the “Last updated” date above for every change.