Stock Alchimie

Data protection

Privacy policy

This policy explains what data Stock Alchimie uses, why it is needed, and how you can exercise your rights.

1. Data controller

The data controller is Samir MEHAL, Entrepreneur individuel (EI), operator of Stock Alchimie.

Address: 9 allée Bartholdi 77270 Villeparisis
Privacy contact: digitalalchimistes@gmail.com

The publisher acts as controller for professional contact details, support, security, and contract administration. For Shopify data synchronized on the merchant's instructions, the publisher acts as the merchant's processor and the merchant remains the controller of its store data.

2. Data we process

When a merchant installs the app, the service may process:

  • the Shopify store identifier and domain;
  • protected Shopify authorization tokens used only to access authorized APIs;
  • catalog data, including products, variants, SKUs, prices, statuses, and suppliers entered in the app;
  • inventory levels and inventory locations;
  • order data required to calculate sales, including dates, amounts, statuses, quantities, and line items;
  • planning settings, supplier rules, SKU overrides, and the alert email address;
  • forecasts, recommendations, evaluations, and statistical models generated by the service;
  • plan and subscription status information provided by Shopify;
  • technical logs required for security, troubleshooting, and service operation.
Stock Alchimie does not request Shopify's read_customers permission and does not store customer names, postal addresses, phone numbers, or email addresses. Payment card data is never received by us because billing is handled by Shopify.

3. Purposes and legal bases

PurposeLegal basis
Install the app, synchronize authorized data, and provide forecasts, recommendations, and settings.Performance of the merchant contract.
Send inventory alerts requested by the merchant.Performance of the contract and the merchant's configuration choice.
Verify the plan, limits, and subscription status.Performance of the contract.
Secure the service, prevent abuse, and troubleshoot errors.Legitimate interest in service security and reliability.
Meet accounting, tax, and legal requirements.Legal obligation.

4. Recipients and service providers

Data is accessible only to the publisher and, where necessary, to:

  • Shopify, for installation, APIs, authentication, and app billing;
  • Amazon Web Services (AWS), for application and database hosting;
  • Resend, only when a merchant enables email alerts.

These providers may process data outside the European Economic Area. Where required, transfers rely on a recognized safeguard such as an adequacy decision or standard contractual clauses.

We do not sell data or use it for advertising.

5. Retention

  • stored daily forecasts are retained for 90 days;
  • operational database backups are retained for 7 days;
  • store data, settings, aggregated sales history, recommendations, and models are retained while the service is used;
  • after uninstall, Shopify access is revoked and store data is erased when the Shopify shop/redact request is processed, unless the law requires retention;
  • technical logs are retained only as needed for security, troubleshooting, and technical log rotation;
  • accounting records are retained for the applicable statutory period.

6. Security

Appropriate safeguards include HTTPS encryption, access-token protection, access controls, Shopify signature verification, restricted backups, and data minimization.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, or portability of relevant personal data.

Contact digitalalchimistes@gmail.com. Identification may be requested only where there is reasonable doubt about the requester's identity. You may also lodge a complaint with the French data protection authority (CNIL).

Requests concerning a store's customers can also be submitted by the merchant through Shopify's privacy mechanisms.

8. Cookies and local storage

The app uses only technical mechanisms required for authentication, security, language preference, and operation. It does not use advertising cookies. If non-essential analytics are added, this policy and the consent mechanism will be updated first.

9. Updates

This policy may change to reflect service or legal developments. Last updated: September 19, 2026.