TL;DR: HESHE Stocker is a cloud service. Your data is stored on Supabase servers in the EU region (Frankfurt, Germany) — it never leaves the European Union. We do not use advertising or trackers.
HESHE Katarzyna Grodzka, VAT ID: PL7393505797.
Contact: info@heshe.pro
Address: Poland (available on request under Art. 13 GDPR).
At registration we collect:
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Data you and your team enter: parts, products, orders, stock movements, shopping list. This data is accessible only to users within your company (enforced by Row Level Security in Postgres).
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Subscription status (trial / active / expired), billing period end date. Purchase receipts and transaction tokens are processed by Apple / Google as merchant of record — we only receive a status confirmation.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Supabase collects standard API access logs (IP address, timestamp, endpoint). Logs are retained by Supabase for 7 days and used solely for error diagnostics.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest — system security).
Data is processed with the involvement of the following entities:
| Entity | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, realtime, file storage | EU – Frankfurt (AWS eu-central-1) |
| Apple Inc. | In-app payments (iOS), receipt validation | USA (Standard Contractual Clauses) |
| Google LLC | In-app payments (Android), receipt validation | USA (Standard Contractual Clauses) |
Data transferred to Apple and Google is limited solely to the information necessary for purchase verification (transaction token). We do not transfer inventory data outside the European Union.
You have the right to:
We respond to requests within 30 days. Contact: info@heshe.pro.
Data in transit is encrypted with TLS 1.2+. Passwords are stored exclusively by Supabase Auth as a hash (bcrypt). Access to company data is protected by Row Level Security at the database level — users of one company have no technical ability to access data belonging to another company.
The app is a professional tool and is not directed at children under the age of 13. We do not knowingly collect data from children.
We will notify you of material changes through an in-app notification or email at least 14 days before they take effect. The current version is always available on this page.