Privacy Policy

Last updated: 25 August 2026 · Applies to storealertpro.com and the embeddable restock widget.

StoreAlert Pro (“we”, “the service”) monitors public storefront URLs and captures optional restock emails for merchants. This policy explains what we collect and why.

1. Data we collect

• Account email — used as your login identifier (no password is stored today).
• Store monitors — names, public HTTP(S) URLs, check intervals, last status and latency.
• Alert channels (Pro) — Telegram bot token / chat ID and Slack webhook URL that you paste in. Treat these as secrets.
• Restock leads — shopper email (required) and optional phone, product name, and the merchant monitor they came from.
• Billing — Stripe processes payments. We store plan status, period dates, and Stripe customer/session IDs when a webhook succeeds. We do not store card numbers.
• Technical logs — request metadata needed to operate the API (IP for rate limiting, error logs on the host).

2. How we use it

• Provide monitoring, dashboards, and restock capture.
• Send downtime alerts on channels you configured.
• Activate or cancel Pro after Stripe events.
• Enforce plan limits (store count, check interval, restock cap).

We do not sell personal data. We do not use restock emails for our own marketing.

3. Legal bases (GDPR-style)

We process account and monitor data to perform the service you request. Restock emails are collected on behalf of the merchant; the merchant is typically the controller of those shopper contacts. Stripe is an independent processor/controller for payment data under its own terms.

4. Sharing

• Hosting: Vercel (application), Neon / Postgres (database).
• Payments: Stripe.
• Email (optional): Resend, only if the operator enables RESEND_API_KEY.
• Telegram / Slack: only if you provide those credentials.

5. Retention

Account, monitor, alert-log, and restock records remain until you delete monitors or the operator deletes the database. Alert logs are capped in the application. You can export restock leads as CSV from the dashboard.

6. Security

Transport is HTTPS in production. Private/local monitor targets are blocked. Telegram tokens are not returned in list APIs. Auth is email-session based (header) — suitable for an MVP; a future owner may add magic links or passwords. Rotate secrets after any account transfer.

7. Cookies

The dashboard stores your login email and plan display hints in localStorage. We may load Vercel Web Analytics on public pages. We do not run advertising pixels.

8. Your choices

• Sign out from the dashboard to clear the local session.
• Delete monitors you added.
• Cancel Pro at period end from Manage subscription.
• Email the operator to request account or restock-lead deletion.

9. Children

The service is for business users. It is not directed at children under 16.

10. Contact

Questions: use the support email published by the current operator after takeover, or the contact method listed on the live site footer. The buyer of this business should replace this contact with theirs.