Stockly connector privacy policy

Last updated 2026-10-26

This policy covers the Stockly connector for AI assistants such as Claude and ChatGPT ("the connector"), operated by Analytos Labs ("we"). Your use of Stockly itself is covered by your organisation's agreement with Analytos Labs.

What the connector handles

When you connect

• Your Stockly username and password. Sent once, over HTTPS, to Stockly's own sign-in to check them. The connector does not store your password.
• Your Stockly user id, username, display name and email address, read from your Stockly account so actions can be recorded under your name.
• A Stockly session token issued by Stockly at sign-in, stored encrypted so the connector can act as you. It expires with your Stockly session (at most 30 days) or when you disconnect.
• Connector tokens (access token: one hour; refresh token: up to 30 days), stored only as one-way hashes, and the registration details your AI assistant sends (its name and redirect address).
• Your IP address, held in memory only, to limit repeated failed sign-ins.

When you use the tools

The tools return your organisation's Stockly planning data: parts (SKUs), recommendations, forecasts, inventory positions, suppliers and their scores, purchase orders, sales and work orders, customers named on orders, schedules and simulation results. Some results include people-related fields:

• whoami: your username, display name, Stockly role and permissions.
• get_audit_log: the user names of colleagues who made each recorded change.
• get_purchase_queue: the user name that submitted each purchase order.
• get_notifications: your notifications, including your user id and role.
• Action results: your user name as the person who approved, rejected, modified, submitted or applied the change.

Tool results go to the AI assistant you connected, and its provider handles them under its own privacy policy. The connector does not keep copies of tool results.

What we do not do

• We do not sell data or use it for advertising.
• We do not use your data to train AI models.
• The connector does not read anything your Stockly account cannot read.

Retention and deletion

Connector tokens expire as above; disconnecting or revoking the connector deletes your stored session token and connector tokens straight away. Changes you make through the connector are kept in Stockly's audit log like changes made in the Stockly app. Standard web-server logs (time, address, path, status) are kept for up to 30 days for security and troubleshooting.

Security

All traffic uses HTTPS. Sign-in uses OAuth 2.1 with PKCE. Stored session tokens are encrypted and connector tokens are stored as hashes.

Contact

Questions or requests: support@analytos.ai.