Privacy Policy

1. What we collect (and why)

• Account: name, email, password hash (bcrypt 12), role, last login IP/time — to authenticate and audit.
• Customers / suppliers you create: name, email, phone — to fulfill sales/purchase orders. Email & phone are optional.
• Operational: products, stock movements, damages/returns — your inventory ledger.
• Technical: minimal cookies (auth refresh httpOnly), rate-limit counters, error logs with redacted secrets.

No unnecessary data: we do not collect birthdays, government IDs, or biometric data. Do not enter such data in free-form notes.

2. Legal basis (EEA) & age

Contract (providing the inventory service), legitimate interest (security, rate limiting), and consent where you check a box. Service is not directed to children under 16. If you are under 16, do not create an account; if we learn a child’s data was entered, we delete it. Guardians contact privacy@shenodev.tech.

3. Third-party SDKs

Audit 2026-09-21: Front-end — Angular 22, AnalogJS, Tailwind, @fontsource (Sora/Inter), RxJS, marked/prism (docs). Back-end — Laravel 11, Sanctum (auth), Aiven MySQL with TLS. No analytics, ads, maps, or payment SDKs are loaded. See Licenses for attributions.

4. Cookies

Essential only: refresh_token (httpOnly, Secure, SameSite=Lax, 7d) and XSRF/session if enabled. No advertising/tracking cookies. You can block non-essential cookies in the Cookie Policy. Use the banner to withdraw analytics consent (currently none are loaded).

5. Your rights & deletion

Access, correction, deletion, portability, and objection. Use Data deletion request or email privacy@shenodev.tech. We delete from app DB, caches and logs (retention 14 days) and confirm by email. Backups expire in 30 days.

6. Contact & business details