Restocked Privacy Policy

Last updated 2026-11-01

1. Who we are

Restocked is provided by Arken, LLC d/b/a Restocked, a Delaware limited liability company based in Huntingdon Valley, Pennsylvania ("Restocked", "we", "us"). Restocked is an inventory planning platform for retailers, distributors and brands, covering demand forecasting, replenishment, purchasing and reporting.

This policy explains what information we handle through the Restocked platform and our website at restockedapp.ai, why we handle it, and the choices available to you. If you installed Restocked from the Shopify App Store, the Shopify app privacy policy at https://restockedapp.ai/shopify/privacy applies to that installation instead.

2. Our role

We provide Restocked to organizations (our "customers") under a written agreement.

  • Business data a customer brings to Restocked. We process it on the customer's behalf and under its instructions, as its service provider (a "processor" under European and UK law). The customer decides what data to connect. Where a customer's agreement with us addresses data protection, that agreement governs where it differs from this policy.
  • Account, usage and website information. We decide how this information is used, as described below (a "controller" under European and UK law).

3. Information we handle

Business data a customer connects

Depending on how a customer connects Restocked (for example a Shopify store, a database or data warehouse such as Snowflake or SQL Server, a warehouse management system, or file uploads), this can include:

  • Catalog: products, SKUs, attributes, costs and prices
  • Vendors: vendor names and codes, lead times, purchasing terms, and vendor contact details such as contact names, email addresses, phone numbers and business addresses
  • Inventory: on-hand, on-order and in-transit quantities by location
  • Orders and returns: order lines, quantities, prices, dates and channels
  • Purchasing: purchase orders, receipts and transfer orders

Order data can include limited information about the customer's own buyers if the source provides it: a customer name, identifier and type, and the shipping city, state or region, postal code and country. We do not store buyers' street addresses or phone numbers, and we do not keep their email addresses beyond the import process. We use this information only to provide the service to that customer, for example to analyze demand by region. Our customers agree not to send us consumer personal data beyond what the service needs.

Account information

  • Name, email address and role of each user a customer invites
  • Sign-in credentials (passwords are stored only as one-way hashes) and two-factor authentication settings
  • Business contact details of the people we work with at each customer, such as billing and legal notice contacts

Usage and technical information

  • Request logs: IP address, pages and features used, timestamps and response times
  • A history of changes made in the application, such as edits to settings, forecasts and purchase orders, and who made them
  • Error information used to diagnose problems

Communications

  • Messages you send us through support channels, and our replies

4. How we use information

  • To provide forecasting, replenishment, purchasing and reporting to each customer
  • To import and refresh data from the sources a customer connects
  • To authenticate users and enforce the permissions a customer's administrators set
  • To send service emails, such as sign-in and password-reset messages, alerts, and product updates (you can opt out of product updates at any time using the link in the email)
  • To provide support, diagnose errors, and keep the service secure and reliable
  • To improve the service, as described in section 5
  • To meet legal obligations and enforce our agreements

Where European or UK law applies, we rely on these legal bases: performing our contract with the customer; our legitimate interests in operating, securing and improving the service; your consent, where we ask for it; and compliance with law.

5. Improving Restocked

We use customer business data in our development and testing environments to design, test and validate forecasting methods, model settings and features. We use identifiable data only to support that customer's own service and to develop features available to it. We never use one customer's identifiable data to configure another customer's service, never show it to another customer without permission, and never use it for sales or marketing. Improvements we develop this way may be made available to all customers.

We may also create aggregated or de-identified information that does not identify any customer or person, and use it for any purpose.

6. AI features

Some features use AI models from Anthropic, for example to review a SKU's forecast. When you use them, the relevant business data, such as product descriptions, sales and inventory figures and notes entered by users, is sent to Anthropic to produce the result. We do not intentionally send personal data to the AI provider, and user identities are not included in AI requests.

Where a customer supplies its own Anthropic API key, those requests run under the customer's Anthropic account and its agreement with Anthropic governs Anthropic's use. Where requests run under our account, our agreement with Anthropic prohibits training on the data we send. We do not use customer data to train AI models.

7. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information only:

  • With service providers that help us run Restocked, only as needed and under obligations to protect it. Our main providers are:

    Provider Purpose Location
    DigitalOcean Hosting and database United States
    Twilio SendGrid Email delivery United States
    Anthropic AI analysis (section 6) United States

    This table is not a complete list. Other providers support functions such as error and uptime monitoring and business email. We will provide our current list of service providers on request.

  • With another Restocked customer, at a customer's written direction, for data-sharing arrangements the customer sets up.

  • For legal reasons, when required by law, subpoena or court order, or to protect the rights, property or safety of Restocked, our customers or others.

  • In a business transfer, to a successor in a merger, acquisition or sale of our business, which would remain bound by our commitments to customers.

8. Retention

  • Business data is kept while the customer's agreement is active and deleted within 90 days after it ends (or as that agreement otherwise provides), except copies in routine backups, which expire in the ordinary course.
  • Account information is kept while the customer's agreement is active and deleted within 90 days after it ends, unless we need to keep specific records longer for security, legal or accounting reasons.
  • Request logs and change history are kept for as long as we need them for security, audit and troubleshooting, which can extend beyond the end of the customer's agreement.
  • Business contact and billing records are kept as long as needed for accounting, tax and legal purposes.
  • De-identified and aggregated information may be kept indefinitely.

9. Security

  • Encryption in transit (TLS) and encrypted storage of connection credentials and API keys
  • Each customer's data kept logically separate from every other customer's
  • Role-based permissions, and two-factor authentication available to every user and enforceable by each customer
  • Restricted network access to our production database

No system is perfectly secure. If we confirm unauthorized access to a customer's data, we will notify the customer without undue delay, and in any case within 72 hours of confirming it.

10. Cookies

We use only the cookies needed to run the service, such as one that keeps you signed in for your session, an optional "remember me" cookie if you choose it, a short-lived cookie used during Shopify sign-in, and a cookie that remembers your Shopify store's domain on the sign-in page for one year. We do not use analytics, advertising or cross-site tracking cookies.

11. International transfers

Restocked is hosted in the United States. If you access it from outside the United States, your information is transferred to and processed in the United States. For customers subject to European or UK data protection law, our data processing addendum, available on request, provides the safeguards the law requires for those transfers.

12. Your choices and rights

  • Users of a customer's account: your organization's administrators control your account and can update or remove it. You can also contact us directly.
  • Your rights: depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal information, to object to certain uses, and to withdraw consent. Residents of some U.S. states have similar rights. We will not discriminate against you for exercising them. To make a request, contact us using section 15. We will verify the request and respond within the time the law requires.
  • People whose data a customer sends us (for example, the customer's own buyers): we process that data for the customer, so please contact that business directly. We will help it respond.
  • European and UK residents may also complain to their local data protection authority.

13. Children

Restocked is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16.

14. Changes to this policy

We may update this policy. The "Last updated" date shows when it last changed. We will tell customers about material changes through the application or by email before they take effect.

15. Contact

For privacy questions or requests, email [email protected], or write to Arken, LLC d/b/a Restocked, Huntingdon Valley, Pennsylvania, USA.