Privacy Policy

1. About GStocky

GStocky is a cloud-based business management platform available to businesses worldwide. We are committed to protecting personal and business data in accordance with applicable data protection laws.

This policy explains what information we process, why we use it, where it may be processed, and the choices available to individuals. It applies to our public website, GStocky accounts, workspaces, subscriptions, and support interactions.

2. Information We Collect

We collect information you provide directly, information businesses enter into their workspaces, and limited technical information needed to operate and protect GStocky.

• Account and contact information, such as name, email address, phone number, company details, and login information.
• Subscription, billing, support, and communication records.
• Business records entered into a workspace, which may include customers, suppliers, contacts, invoices, orders, employees, documents, transactions, and CRM records.
• Technical and usage information, such as browser and device details, service logs, IP-derived security signals, and interactions with the platform.

3. How We Use Information

We use information to create and administer accounts, provide requested features, process subscriptions, respond to support requests, maintain platform security and reliability, communicate important service information, meet legal obligations, and improve GStocky.

4. Customer-Controlled Data

There are two main data relationships in GStocky. For information you provide when creating an account, purchasing a subscription, contacting support, or interacting directly with us, GStocky generally decides why and how that information is processed.

For business data entered into a GStocky workspace—such as customer, supplier, employee, invoice, order, transaction, document, and CRM data—the business using GStocky generally decides why that information is collected and used. GStocky provides the software and infrastructure that process it on the business's instructions.

In legal terms, GStocky will commonly act as a controller for direct account and service information, and as a processor or service provider for customer-controlled workspace data. If your information was entered by a GStocky customer, that business is usually the best first point of contact for a privacy request.

5. Legal Bases Where Applicable

Where applicable law requires a legal basis, we rely on the basis appropriate to the activity. This may include performing a contract, taking steps requested before entering a contract, pursuing legitimate interests such as securing and improving the service, complying with legal obligations, or obtaining consent where consent is required.

Where we rely on consent, you may withdraw it for future processing. Withdrawal does not affect processing that was lawful before withdrawal.

6. Hosting and Infrastructure

GStocky uses trusted international cloud providers. Our current core architecture is configured as follows:

• Application and API hosting: Hetzner infrastructure in Germany.
• Main MySQL database: Hetzner infrastructure in Germany.
• File storage: Google Firebase / Google Cloud Storage configured in the European Union.
• DNS, content delivery, network security, and DDoS protection: Cloudflare's global network.

7. International Data Transfers

Depending on your location and the services used to operate GStocky, personal data may be processed in countries other than your country of residence. Where required, GStocky uses appropriate contractual, technical, and organizational safeguards for international data transfers.

The use of international infrastructure means we do not represent that all information always remains within a single country.

8. Service Providers and Subprocessors

We use carefully selected providers to deliver and protect GStocky. The current infrastructure providers listed below may process information on our behalf. This list is designed to be updated as our services evolve.

9. Data Retention

We retain information only for as long as reasonably needed to provide the service, maintain security, comply with legal and accounting obligations, resolve disputes, and enforce agreements. Retention periods vary by the type of record, the customer's instructions, and applicable law.

A deletion request does not always require immediate deletion. GStocky or the relevant customer may need to retain certain records where legally permitted or required, including for tax, accounting, fraud prevention, security, or dispute-resolution purposes.

10. Security

We use appropriate technical and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or loss.

• Encrypted HTTPS/TLS connections.
• Account, role, and production-system access controls.
• Infrastructure and database access restrictions.
• Backups, monitoring, and security updates.
• Trusted cloud and network service providers.

11. Your Privacy Rights

Depending on applicable law, you may be able to request access to personal data, correction of inaccurate information, deletion where legally applicable, objection to certain processing, restriction of processing where applicable, or information about how your data is processed.

We may need to verify your identity and clarify the scope of a request. If a GStocky customer controls the relevant workspace data, we may direct your request to that customer or assist them in responding.

12. Cookies

Our website uses cookies and similar technologies that are necessary for core functionality and may use optional technologies for analytics or marketing. Where required, optional cookies are used based on your choice in our cookie notice.

You can accept or decline optional cookies when the notice is shown and can also manage cookies through your browser settings. Blocking some cookies may affect parts of the website.

13. For Users and Customers in Morocco

For processing activities subject to Moroccan law, GStocky takes steps to comply with Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data and the requirements of the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).

GStocky is undertaking the applicable CNDP compliance and notification procedures.

14. International Users

Depending on where you are located, additional privacy rights and requirements may apply. GStocky aims to provide appropriate privacy controls and respond to valid data-protection requests in accordance with applicable law.

This policy does not claim certification under, or automatic compliance with, every privacy law in every country.

15. Changes to This Policy

We may update this policy as GStocky, our providers, or legal requirements change. We will publish the revised policy on this page, update the date above, and provide additional notice when required.

16. Contact

For privacy questions or requests, use our Privacy Request link or contact the GStocky support team through the contact page. Please do not include passwords or other highly sensitive credentials in your message.