Privacy Policy

A TURNKEY SOLUTION LLC dba My Stash Online ("Stash", "we", "us", "our") provides a multi-property inventory tracking service available at mystash.online and through our mobile applications (collectively, the "Service"). A TURNKEY SOLUTION LLC dba My Stash Online is the data controllerresponsible for personal information processed in connection with the Service. This Privacy Policy explains what information we collect, how we use it, the legal basis we rely on, and the choices you have. By using Stash you agree to this policy.

We collect only what is needed to operate the Service:

• Account information — your email address, password (stored hashed), and optional display name when you sign up.
• Authentication metadata — sign-in timestamps, IP addresses, and provider identifiers (e.g. Google) when you authenticate.
• Content you create — household names, property names, inventory items, quantities, locations, colors, materials, and any notes you choose to add.
• Sharing data — invite tokens and the email addresses you invite to join your household.
• Technical data — browser type, device type, and basic diagnostic logs needed to keep the Service running.
• Billing data — when you purchase a paid plan or AI pack, our payment processor Paddle collects and processes your billing details (name, billing address, payment method, transaction history, tax identifiers). We receive limited order metadata back from Paddle (plan, amount, status, last four digits of the card) but never the full payment instrument.

We do not directly collect or store full payment card numbers — payment data is handled by Paddle as Merchant of Record (see Section 4). We do not collect location data, contacts, photos, or device identifiers beyond what your browser sends automatically.

Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases:

• Performance of a contract — to create your account, operate the Service, process purchases, and provide household features you request.
• Legitimate interests — to secure the Service, prevent fraud and abuse, diagnose bugs, and improve reliability, provided these interests are not overridden by your rights.
• Legal obligation — to keep tax, accounting, and other records required by law, and to respond to lawful requests from authorities.
• Consent — where we ask for it (e.g. optional marketing emails or non-essential cookies). You may withdraw consent at any time.

• To provide, maintain, and secure the Service.
• To authenticate you and keep your session active.
• To allow members of your household to view and edit shared inventory.
• To send transactional emails (account verification, password reset, household invites).
• To process purchases, subscriptions, renewals, refunds, and tax compliance (via Paddle).
• To diagnose bugs and improve reliability.
• To comply with legal obligations.

We do not sell your data. We do not use your data for advertising. We do not share your inventory contents with third parties.

We share information only in these limited cases:

• Within your household — anything you add to a household is visible to other members of that household.
• Service providers — we use Lovable Cloud (backed by Supabase) for hosting, database, and authentication. These providers process data on our behalf under their own security and privacy commitments.
• Payment processor (Merchant of Record) — Paddle.com Market Limited ("Paddle") acts as our Merchant of Record and reseller for all paid plans and AI packs. Paddle collects and processes your billing information (name, billing address, payment method, tax identifiers, transaction history) to handle checkout, billing, sales tax / VAT compliance, invoicing, refunds, chargebacks, and fraud prevention. Paddle's processing is governed by the Paddle Checkout Buyer Terms and the Paddle Privacy Notice.
• Legal compliance — when required by law, court order, or to protect the rights, property, or safety of users or the public.
• Professional advisers — legal, accounting, and tax advisers, where reasonably necessary.

All traffic is encrypted in transit (HTTPS). Passwords are hashed using industry-standard algorithms. Access to your data is enforced at the database level through row-level security policies, so members of one household cannot access data from another. No system is perfectly secure, but we work to follow industry best practices.

We retain your account and inventory data for as long as your account is active. If you delete your account, your personal information and inventory data are permanently removed within 30 days, except where we are legally required to retain certain records.

You have the right to:

• Access and export your data.
• Correct inaccurate information.
• Delete your account and associated data at any time from within the app.
• Withdraw consent for processing where applicable.
• Lodge a complaint with a data protection authority (if you are in the EU/UK).

To exercise any of these rights, contact us at support@mystash.online.

Stash is not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Your data may be processed in countries other than your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) to protect your information.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Questions, requests, or complaints? Email us at support@mystash.online.