StockRecover Privacy Notice

Who we are and the service

Alexander Hickman trading as Quiet Yield operates StockRecover. Contact alex@quietyieldhq.com or 415-787-2039. Postal address: 200 N Vineyard Blvd, Ste A325 -270, Honolulu, HI 96817, United States.

StockRecover lets a shopper request an email when a selected sold-out product variant returns to stock. It does not reserve inventory. The merchant chooses storefront placement and is responsible for a lawful notice and consent. Alexander Hickman is the accountable privacy contact.

Information we process

For shoppers, we process the requested email address, product and variant identifiers, language, consent wording and version, consent time and source, and notification status. Consent evidence can include a hashed IP address and limited user-agent information. A hash can still be personal data. We also process delivery, bounce, complaint, unsubscribe and suppression records.

For merchants and authorized staff, we process store identifiers, session and access information, configuration, product rules, inventory observations and subscription status. Shopify privacy requests can include customer and order identifiers. Historical attribution records may exist; new optional attribution is disabled unless a separate approved policy enables it.

Why we use information

We use this information to provide requested restock alerts, record consent, prevent abuse, manage delivery and opt-outs, support merchants, secure access, and handle verified privacy requests. We do not sell this information or use restock signups for unrelated marketing. The merchant controls its shopper relationship; Quiet Yield processes service data for that merchant and maintains necessary service and security records described here.

Service providers and location

We use Shopify as the commerce platform, Vercel for application hosting, Neon for the database, and Resend for email delivery. The database is in AWS us-east-2 and the application uses Vercel iad1. Processing and support can occur in the United States. Appropriate provider agreements and transfer safeguards are required where applicable; an email region alone does not determine every processing location.

Retention and deletion

We keep information only for its service, consent, security, compliance or documented legal purpose. Verified erasure requests use separate request-driven controls. Unsubscribing stops future alerts; it does not necessarily delete every record. A new affirmative signup may reactivate an ordinary unsubscribe, but cannot override a bounce, complaint, manual block or erased-identity restriction.

Our approved routine schedule sets a 180-day limit for pending alert requests from their latest consent, a 7-day expiry for unsent queued messages, removal of contact and content data within 30 days after a terminal outcome, and up to 12 months for minimal pseudonymous consent proof. Minimal suppression and erased-identity safeguards remain while the installation is active and are reviewed after 12 months; verified shop erasure removes the shop-scoped safeguards. Routine service logs are limited to 30 days, or 90 days for a recorded security investigation. Inactive staff sessions are limited to 30 days. Merchant service records have an active-contract period and up to 90 days of wind-down. Minimal resolved privacy-duty receipts may be retained for 24 months. Open duties, unresolved sends and verified legal holds are reviewed rather than silently discarded. Current routine-cleanup status and scope appear below.

A live-database deletion does not instantly erase every provider backup or independent copy. Neon's observed restore history is six hours; its separate general backup policy describes encrypted backups for 30 days. Resend describes email and log retention for 30 days and backups for seven days, with separate termination rules. Independently created database branches are separate copies. We verify the applicable action and provider limits before describing an erasure as complete.

Access and privacy requests

Merchants can access collected subscriber information through authenticated private views and downloads. Prepared Shopify privacy exports are bound to the authenticated recipient and require an explicit acknowledgment; downloading alone does not mark delivery complete. Shoppers should contact their merchant first, or use the Quiet Yield contact above. We verify identity and store scope. We aim to complete applicable Shopify-mandated actions within 30 days, subject to documented legal holds. Requests involving an uncertain prior installation remain open for verified matching; receiving a webhook is not fulfillment.

Security and updates

Controls include verified identities, tenant-scoped access, encrypted stored access tokens, signed Shopify webhooks and proxy requests, and controlled privacy exports. No system can guarantee absolute security. Material changes are published here and communicated in the app where required.

Current routine-cleanup status

Routine cleanup is enabled for records created from 2026-10-21T04:10:00.000Z. Earlier existing records are outside the routine deletion scope, including older records with renewed consent. Open privacy duties, unresolved sends and verified holds can defer cleanup.