Privacy Policy

This Privacy Policy describes how Inventory Assassin (“we,” “us”) collects, uses, and protects information when you use Inventory Assassin (the “Service”). It applies to visitors of our public website and to merchants who create an account.

We collect the following categories of information:

• Account information: the email address and password (stored as a salted hash by our authentication provider, Supabase — we never see or store your plaintext password) you use to sign up, and your name if you provide one.
• Company/organization information: your company name and any organization details you enter, such as industry or currency.
• Inventory data you upload: the contents of the CSV files (or, in the future, other connected data sources) you upload — product names, SKUs, categories, vendors, quantities, unit costs, retail prices, and sales history. This data is uploaded voluntarily by you for the purpose of generating an analysis.
• Billing identifiers: if you subscribe to a paid plan, our payment processor (Stripe) collects your payment card details directly — we never receive or store your full card number. We do store a Stripe customer ID and subscription status so we know your account's billing state.
• Trial redemption records: if your organization redeems a promotional invite-trial code, we store which code was used, your organization ID, the redeeming user, and the redemption and expiration timestamps, so we can grant and later expire the correct access. Redeeming a trial does not require or collect a payment method.
• Usage information: basic technical information generated by using the Service, such as sign-in timestamps and error logs, used only to operate and troubleshoot the Service.
• Acquisition source: if you sign up after using one of our free single-item calculators (under /tools), we record that the signup came from that channel and which calculator — for example, “organic search tool, dead-stock-calculator.” This is captured once, at signup, from the page you came from; we do not track your browsing before you create an account, and the calculators themselves never send the numbers you enter into them anywhere — see Section 2a.

2a. Free calculators

Our free single-item calculators (under /tools) run entirely in your browser. The numbers you enter — units, cost, dates, and similar — are never sent to our servers, never stored, and never included in any analytics event. Using a calculator does not require an account and collects no personal information.

We use Vercel Web Analytics, a first-party, cookieless analytics tool, to understand aggregate page traffic and which free calculators are used (e.g. a page view or that a calculation was completed) — it does not use cookies or cross-site tracking, and does not receive the values you enter into a calculator. We do not use third-party advertising trackers. If that changes, this policy will be updated before any such tool is enabled, and this section will name it.

• To provide the Service: authenticate you, store your uploaded inventory data, and run the analysis, IA Move, and results features you request.
• To operate your subscription: process payments, apply free-tier limits, and manage billing status through Stripe.
• To communicate with you: respond to support requests and send account-related notices (e.g. billing issues, material changes to these policies).
• To maintain and secure the Service: troubleshoot errors, prevent abuse, and enforce our Terms of Service.

We do not sell your information. We do not use your uploaded inventory data (“Merchant Data”) to train shared or cross-customer models, and we do not use an AI model to process or interpret Merchant Data at runtime — the scoring, IA Move, and results calculations in the Service are deterministic software logic, not an AI system, and your uploaded data is not sent to any AI provider.

We do not sell or rent your information. We share information only with the service providers that are necessary to operate the Service, each acting under its own privacy and security commitments:

• Supabase — hosts our database, file storage, and authentication. Your account data and Merchant Data are stored in a Supabase-managed Postgres database and storage bucket.
• Vercel — hosts and serves the application itself (the web application you interact with), and provides the first-party, cookieless Web Analytics described in Section 2.
• Stripe — processes subscription payments and stores your payment method on our behalf; we do not store full card numbers ourselves.

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, property, or safety of Inventory Assassin, our users, or others.

We use only the cookies strictly necessary to keep you signed in and to protect the Service (session and authentication cookies set by Supabase Auth). We do not currently use advertising or cross-site tracking cookies.

We retain your account and Merchant Data for as long as your account is active, so that historical analyses, decisions, and results remain available to you. If you close your account, you may request deletion of your account and associated Merchant Data by contacting us (see Section 9); we will delete it within a reasonable time, except where we are required to retain limited records (such as billing records) for legal or accounting purposes.

Depending on your location, you may have rights to access, correct, export, or delete your personal information. You can review and update most account information directly in the Service, or contact us using the details in Section 9 to make a request.

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS), database-level access controls that isolate each organization's data (row-level security), and restricted internal access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Questions about this Privacy Policy, or requests regarding your data, can be sent to inventoryassassins@gmail.com or via our Contact page.

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, for material changes, provide reasonable notice.

Additional details on international data transfer mechanisms and region-specific rights (such as under GDPR or CCPA), including any designated Data Protection Officer, will be published in a future update to this policy as they become applicable to our operations.