Privacy policy

1Who we are

My Van Stock is a stock control system, on the web and as a phone app, for security, fire and network installers. It is run by Ryan McCloskey, trading as MyVanStock (a sole trader, not a limited company), 3 Dodley Hill Barns, Swanbourne, MK17 0SR.

For anything in this policy, email [email protected].

2Who is in charge of your data

Each company that uses My Van Stock (our "customer") has its own portal at myvanstock.co.uk/their-name.

• The company is the data controller for everything in its portal. It decides who gets a login, what is recorded and how long it's kept.
• We are the data processor. We only use that data to run My Van Stock for the company, on its instructions, under a data processing agreement with it.
• We are the controller for a small amount of our own business information: contact details for the people we deal with at each customer (for setup, billing and support), demo requests from our website, and emails people send us.

If you use your company's portal as an engineer or in the office, your employer's own privacy notice for staff should explain why it uses My Van Stock. Questions about your data in a portal are best sent to your employer first. We'll help them answer.

3What we hold

Company details

Company name, portal web address, email domain, logo, brand colour, the address that stock emails go to, which stock alerts are switched on, and when the daily stock summary is sent.

If a company connects a supplier account (such as ADI) or uploads a supplier's price file, we also hold that account's login details and the prices and stock levels it returns. Supplier login details are stored where nobody can read them back, including us.

Staff names and logins

First and last name, username (first.last), the login email address made from it, login tier (Super Admin, Admin, User or Engineer) and what that tier is allowed to do, which van the person is assigned to, their password (hashed, see section 6), and whether they've replaced their starting password yet.

People can also add an email address for notifications, such as being told when a stock request is done. It can be a work or personal address. Their admin can set it, or they can set it themselves under Account.

If someone sets up two-step sign-in, Supabase stores the key their authenticator app uses to make codes. We can't see the codes.

Stock and job records

Vans and stores (names and registrations), products, part numbers, barcodes, suppliers and costs, and how many of each item is on each van. Every stock movement is recorded with who made it and when, along with the job reference typed in when stock is used. Stock requests, any note sent with them and the office's reply are kept too.

Demo requests

When you book a demo or ask to get started on our front page, we keep your name, company, email address, phone number (if you give it), how many vans you have and your message. They're stored with Supabase and emailed to us through Resend.

Technical information

When you use the site, our providers record standard technical details such as your IP address, browser type and the time. These are used to keep the service secure and to fix problems.

What we don't hold

• Camera pictures. Barcode scanning happens on your phone, in the website and in the phone apps. Pictures from the camera aren't sent to us.
• Card or bank details. Companies pay by card or Direct Debit through Stripe. Stripe takes the payment and holds the card or bank details. We only see whether each payment worked, the amount, and Stripe's reason if it failed.
• Your customers' details. Job references and notes are free text, so we ask companies not to put their own customers' names, addresses, phone numbers or alarm codes in them. A job number is enough.

4What we use it for

• Running the service: signing people in, showing each person the right stock, recording movements, fetching supplier prices a company has asked for, and sending stock request, stock alert and daily summary emails.
• Keeping it secure: stopping misuse, keeping each company's data separate and investigating problems.
• Support: we look at a company's stock data only when we need to, to answer that company's support request or fix a fault. The My Van Stock platform admin page doesn't show any company's stock.
• Our own customer relationship: setting companies up, billing them and telling them about changes to the service.
• Demo requests: replying to you and arranging a demo or setup. We don't add you to a mailing list.

We don't sell data, use it for advertising, or share it with anyone other than the providers in section 5. For our own business information, we rely on our legitimate interest in running and protecting the service and on our contract with each customer. For demo requests, we rely on our legitimate interest in answering you, and on taking the steps you asked for before a contract. Each company decides its own lawful basis for the data in its portal.

5Where it's stored and who helps us

The website and phone apps load their fonts and code from myvanstock.co.uk itself. Nothing is loaded from Google, analytics or advertising companies. If a company connects a supplier account, the company's part numbers and that account's login details are sent to the supplier to fetch its prices. No personal data goes to the supplier.

If you install the phone app from Google Play or the App Store, Google or Apple handle the download under their own privacy policies. The app itself sends no analytics to us or to them.

Some of these providers are based in, or have staff in, the United States. Where data may leave the UK, it's covered by the provider's data processing terms and the safeguards UK law approves, such as the UK International Data Transfer Addendum or the UK–US data bridge.

We'll tell our customers at least 30 days before we add or change a provider that handles portal data, so they can object.

6How we keep it secure

• Hashed passwords. Supabase stores passwords scrambled (hashed). Nobody can read them, including us. If someone forgets theirs, their office resets it. We can't look it up.
• One-time starting passwords. Every new person, and every password reset, gets their own random starting password. It's shown once, to the person who set it up. It works once and stops working after 7 days.
• Nothing visible until changed. Someone signed in with a starting password can't see any data until they've chosen their own. The database enforces this, not just the screen.
• Two-step sign-in. Super Admins, Admins and our own platform admins enter a 6-digit code from an authenticator app as well as their password. A company can require it for everyone.
• Strong chosen passwords. At least 10 characters, nothing containing the person's own name or the company name, and common passwords are refused.
• Each company kept separate. Every record is tied to its company, and the database's own security rules only return a company's records to that company's logins. Engineers only see their own van. Admins can't see anything belonging to another company.
• Resets sign people out. Resetting someone's password signs them out on every device.
• Encryption. Everything travels over an encrypted (HTTPS) connection, and Supabase encrypts stored data.

If we find a security breach affecting a company's data, we'll tell that company without undue delay, and within 48 hours, with what we know. That gives it time to meet its own duty to report to the ICO within 72 hours.

7How long we keep it

• While a company uses My Van Stock, we keep its data so the app works. Stock history builds up over time, so the company can look back at what was used on each job. A company can ask us to delete history older than a date it chooses.
• When someone leaves, a company admin can set them to "No access", which stops them seeing anything straight away. To remove a person's login and name completely, the company asks us and we do it within 30 days. Their past stock movements then show as "Removed user".
• Starting passwords stop working after 7 days.
• When a company stops using My Van Stock, it can download its stock, products and history as spreadsheets from Setup → Company settings → Export. We delete its portal, logins and records within 30 days of the agreement ending, unless the law requires us to keep something. Backups containing it are overwritten within a further 7 days.
• Demo requests are deleted 12 months after we last hear from you, unless your company becomes a customer.
• Technical and email logs are kept by our providers for their standard periods, usually 1 month.
• Our own business records, such as invoices, are kept for 6 years because UK tax law requires it.

8Cookies and storage on your device

We don't use advertising or tracking cookies, and we don't run analytics.

The app keeps your sign-in in your browser's storage so you stay signed in. It also remembers a few things to save you time: the tab you were on, the van you were working on, how you last sorted the stock list and the last job reference you typed. These are needed for the app to work as you'd expect, so we don't ask for consent. Signing out removes your sign-in.

The phone apps also remember which company's portal you chose, so they open straight to it next time. They ask permission to use the camera for barcode scanning; you can turn that off in your phone's settings and type barcodes instead. Spreadsheets you download in the app are saved on your phone only so you can share or save them.

9Your rights

Under UK data protection law you can ask to see the personal data held about you, have it corrected or deleted, limit or object to how it's used, and get a copy to take elsewhere.

• For data in a company portal, ask your employer, because it is the controller. If you contact us instead, we'll pass your request to them (with your permission) and help them answer.
• For our own business information, email [email protected]. We'll reply within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd be grateful for the chance to put things right first.

10Changes to this policy

We'll post any changes on this page and update the date at the top. If a change affects how a company's data is handled, we'll email that company's admins before it takes effect.

11Contact us

Ryan McCloskey, trading as MyVanStock, 3 Dodley Hill Barns, Swanbourne, MK17 0SR.
Email [email protected].

See also our terms of use.