Privacy Policy

Stocky is developed and provided by Muhammed Mustafa Geldi (Türkiye), operating under the name Swanky Software (referred to in this policy as “Swanky Software”). The developer name of the application on Google Play is “Swanky”.

With regard to the personal data of users who create a Stocky account, the data controller is Swanky Software. Questions and requests concerning personal data may be sent to [email protected].

This policy covers the personal data of Stocky account holders and the technical records generated while the service is provided.

Stocky is available worldwide, and this policy applies in the same way to all users regardless of the country in which they are located. As the data controller is established in Türkiye, all processing activities are subject to the KVKK; processing relating to users in the European Economic Area is additionally subject to the GDPR. Where the laws of your country grant you rights in addition to those set out in this policy, those rights remain unaffected.

Users decide for what purposes and on what legal basis the customer, supplier and supplier contact details they record in the application are processed. With regard to this information, the data controller is the user who created the relevant record. Swanky Software stores and processes this information solely on behalf of the user and for the purpose of technically providing the service; in this capacity it acts as a data processor. Informing the individuals concerned and, where required, obtaining their consent is the responsibility of the user.

The following categories of data are processed in order to provide the service. Completing optional fields is at the user’s discretion.

Personal data are collected electronically through the information entered by the user in the application, the information provided by Google during Sign in with Google and Google Play purchases, and the records generated when the application communicates with the server, and are processed for the following purposes:

• Provision of the service: Creating and managing the account, storing records and making them accessible from different devices, and generating receipts and PDF documents. Legal basis: conclusion and performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
• Subscription management: Verifying purchases, granting premium entitlements, processing renewal, cancellation and refund notifications, and applying free plan limits. Legal basis: performance of a contract (Art. 5(2)(c) KVKK; Art. 6(1)(b) GDPR).
• Security: Preventing unauthorised access and misuse, and detecting and fixing errors. Legal basis: legitimate interest of the data controller (Art. 5(2)(f) KVKK; Art. 6(1)(f) GDPR) and the legal obligation relating to data security (Art. 12 KVKK).
• Responding to requests: Handling support requests and requests concerning personal data. Legal basis: performance of a contract and legal obligation (Art. 5(2)(c) and (ç) KVKK; Art. 6(1)(b) and (c) GDPR).
• Legal obligations and disputes: Complying with lawful requests from competent authorities and protecting rights in possible disputes. Legal basis: legal obligation and the establishment, exercise or defence of a right (Art. 5(2)(ç) and (e) KVKK; Art. 6(1)(c) and (f) GDPR).

Permissions other than internet and network status are optional. They may be refused or withdrawn in the device settings; in that case, only the related feature cannot be used.

• Camera: Used to scan barcodes. The image is processed on the device; no photos or videos are saved and nothing is sent to the server.
• Contacts: Used to select a contact from the address book when adding a customer or supplier. Only the details of the selected contact are transferred to the relevant form; the rest of the address book is not read and is not sent to the server.
• Bluetooth and nearby devices: Used to find and connect to a thermal printer. Printer details are stored only on the device.
• Photo selection: Only the image selected by the user is accessed in order to upload a company logo.
• Internet and network status: Required for communication with the server, authentication and subscription verification.
• Vibration: Used to provide feedback when a barcode is scanned.

Personal data are not sold and are not shared for advertising purposes. Data are disclosed only to the recipients listed below and only for the stated purposes.

In accordance with Article 12 of the KVKK and Article 32 of the GDPR, Swanky Software takes appropriate technical and organisational measures to ensure the security of personal data.

• Encrypted communication: All communication between the application and the server is encrypted with TLS.
• Access control: Each user can access only their own records. Direct access to the database is disabled; all operations are carried out through functions that authenticate the user and whose authorisation is checked on the server side.
• Subscription verification: Premium entitlements are granted only after the purchase has been verified with Google Play on the server side.

• Account and business records: Retained for as long as the account remains open. When the user deletes a record, that record is deleted; when the user deletes the account, all records belonging to the account are deleted immediately and permanently. Deletion methods are described on the Account and Data Deletion page.
• Subscription record: Deleted together with the account. Google Play purchase and payment records are retained by Google in accordance with its own policies.
• Technical and security records: Retained for as long as required for security and error detection purposes and deleted at the end of that period.
• Correspondence: Correspondence relating to support requests and data protection requests is retained for as long as necessary to resolve the request and to provide evidence in possible disputes.
• Data on the device: The cache on the device is cleared when the user signs out or deletes the account. Theme, language and printer preferences remain on the device until the application is uninstalled or its data is cleared. If Android backup is enabled on the device, these preferences may be included in the device backup in the user’s Google account.

Regardless of the country in which you are located, you have the following rights regarding your personal data (Art. 11 KVKK; Arts. 15–22 GDPR):

• Information: To learn whether your personal data are processed and, if so, to request information about it, and to learn the purpose of the processing and whether the data are used in accordance with that purpose.
• Recipients: To know the third parties to whom your personal data are transferred, whether domestically or abroad.
• Rectification: To request the rectification of incomplete or inaccurate personal data.
• Erasure: To request the erasure or destruction of personal data under the conditions provided for by law.
• Restriction: To request, in certain cases, that the processing of your personal data be restricted.
• Data portability: To request the personal data you have provided in a structured, commonly used format.
• Notification: To request that rectification, erasure or destruction be notified to the third parties to whom the data have been transferred.
• Objection: To object to processing based on legitimate interest and to a result to your detriment arising from analysis carried out exclusively by automated systems.
• Compensation: To claim compensation for damage suffered as a result of the unlawful processing of your personal data.

You may send requests concerning your rights to [email protected] from the email address registered to your Stocky account. Additional information may be requested if your identity cannot be verified.

Requests are handled as quickly as their nature allows and free of charge within thirty days at the latest.

If you are not satisfied with the outcome of your request, you may lodge a complaint with the competent data protection authority. Users in Türkiye may apply to the Turkish Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of the request; see the KVKK right to apply page for details. Users in the European Economic Area may apply to the data protection authority of the country in which they reside or work, and users in other countries may apply to the competent authority in their country.

Requests concerning customer or supplier information recorded by a Stocky user should be directed to the relevant business, which is the data controller. Where such requests reach Swanky Software, the necessary support is provided to enable the business to fulfil its obligations.

Stocky is an application designed for managing business activities and is not intended for persons under 18 years of age. Accounts found to belong to a person under 18 may be closed and the associated data may be deleted.

This policy may be updated in line with changes to the application, the services used or the applicable law. The current version is published on this page, and the date of the last update is shown at the top of the page. Updates that materially change the purposes of processing or data transfers will also be announced in the application or by email.