Privacy Policy

Last updated: 28 April 2026  ·  Effective date: 28 April 2026

This Privacy Policy explains how Stock2Wrap ("we", "us", or "our") collects, uses, stores, and protects your personal data when you use our production costume management software.

EU GDPR (primary) UK GDPR CCPA (California) PIPEDA (Canada)

1. Who We Are

Stock2Wrap is a software-as-a-service platform for film and television production companies, operated by a company registered in the Republic of Lithuania (European Union). For EU GDPR purposes, we act as the data controller for account and billing data, and as a data processor for the production data you enter into the application.

Our supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija — VDAI).

Contact: privacy@stock2wrap.com

2. Data We Collect

Account Data (provided by you)

• Email address and password (hashed with bcrypt — we never store plain-text passwords)
• Company or studio name
• Billing details: company name, registration number, VAT number, address (stored for invoicing purposes)
• Payment method details (handled entirely by Stripe — we do not store card numbers)
• Subscription tier and usage data

Production Data (entered by you)

• Costume catalog entries: item names, descriptions, photos, statuses, quantities
• Team member email addresses and roles
• Production and season names, rental house records, return logs
• Carnet / international shipment records (Studio plan)
• Storage box manifests and own-stock records

This production data belongs to you. We process it only to provide the service.

Technical Data (collected automatically)

• Session identifiers (stored server-side in an httpOnly cookie)
• IP address and browser type (for security rate limiting and fraud prevention only)
• Last login timestamp

We do not use advertising cookies. We do not track you across third-party websites. We do not use analytics services.

3. Legal Bases for Processing (EU GDPR Art. 6)

Purpose	Legal basis
Providing the service (account, data storage, sync)	Contract performance (Art. 6(1)(b))
Billing, invoicing, and subscription management	Contract performance (Art. 6(1)(b))
Retaining financial/accounting records	Legal obligation — Lithuanian Accounting Law (Art. 6(1)(c))
Security: rate limiting, fraud prevention, brute-force protection	Legitimate interests (Art. 6(1)(f))
Responding to support requests	Legitimate interests (Art. 6(1)(f))

4. Data Storage and Security

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Password security: Passwords are hashed using bcrypt (cost factor 12). We cannot recover your password.
• Session security: Sessions use httpOnly, Secure, SameSite=Lax cookies stored server-side in a PostgreSQL database. Sessions expire after 30 days of inactivity.
• Data isolation: Each account's production data is stored in a separate database partition, inaccessible to other accounts.
• Security headers: We enforce Content-Security-Policy, X-Frame-Options, and other security headers.
• Rate limiting: Authentication endpoints are rate-limited (max 10 attempts per 15 minutes per IP).
• Database: Data is stored on encrypted PostgreSQL infrastructure with automated backups.

5. Data Retention

• Active accounts: Data is retained for as long as your account is active.
• Deleted accounts: Upon account deletion, all production data is immediately erased. Account records are soft-deleted and fully purged after 30 days.
• Session data: Sessions are pruned regularly; expired sessions are deleted automatically.
• Financial and accounting records: Payment records, invoices, and billing information are retained for 10 years as required by the Republic of Lithuania's Accounting Law (Buhalterinės apskaitos įstatymas) and EU VAT regulations. After this period they are securely deleted.
• Backups: Database backups are retained for 7 days and then securely deleted.

6. Data Sharing and Third Parties

We do not sell your personal data. We share data only with:

• Stripe — payment processing. Stripe is PCI-DSS compliant and operates under an EU Data Processing Addendum. See stripe.com/privacy.
• Replit — cloud hosting and database infrastructure. Data is processed under Replit's Data Processing Agreement.
• Law enforcement or regulatory authorities — only when required by applicable EU or Lithuanian law, and only to the extent proportionate to the request.

All third-party processors are subject to data processing agreements (DPAs) as required by GDPR Art. 28.

7. International Data Transfers

Your data may be processed on infrastructure located outside the European Economic Area (EEA), including in the United States (Replit infrastructure). Such transfers are made under appropriate safeguards — specifically Standard Contractual Clauses (SCCs) approved by the European Commission (GDPR Art. 46(2)(c)) — to ensure your data receives equivalent protection.

You can request a copy of the applicable transfer safeguards by contacting us at privacy@stock2wrap.com.

8. Your Rights Under EU GDPR

As a data subject under EU GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of all personal data we hold about you
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure / "right to be forgotten" (Art. 17) — delete your account and all production data (exercisable directly in-app)
• Right to restriction of processing (Art. 18) — restrict how we process your data in certain circumstances
• Right to data portability (Art. 20) — receive all your data in a machine-readable JSON format (exercisable directly in-app)
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to lodge a complaint (Art. 77) — with the VDAI (Lithuania) or the supervisory authority in your EU member state of residence

Note: the right to erasure does not override our legal obligation to retain financial and accounting records for 10 years under Lithuanian law. In such cases we will erase all other personal data while retaining only the minimum financial records required by law.

California users (CCPA / CPRA)

California residents additionally have the right to know what personal information is collected, the right to opt-out of sale (we do not sell personal information), and the right to non-discrimination for exercising privacy rights. Contact us at privacy@stock2wrap.com to exercise any right.

Other jurisdictions

Users in Canada (PIPEDA), the UK (UK GDPR), Australia (Privacy Act), and other jurisdictions with privacy legislation have equivalent rights to access, correct, and request deletion of their personal information. Contact us at privacy@stock2wrap.com.

9. Exercising Your Rights In-App

Many rights can be exercised directly without contacting us:

• Export your data: Account Settings → Data & Privacy → "Export my data (JSON)" — downloads all personal and production data we hold about you.
• Delete your account: Account Settings → Data & Privacy → "Delete account" — immediately erases all production data and closes your account.
• Update billing information: Account Settings → Account → Billing information → Edit.

For other requests, email privacy@stock2wrap.com. We will respond within 30 days as required by GDPR Art. 12. For complex requests we may extend this by a further two months and will notify you within the initial period.

10. Cookies

We use a single strictly necessary session cookie (crt.sid) to keep you signed in. This cookie:

• Is httpOnly (not accessible to JavaScript)
• Is set with SameSite=Lax and Secure flags
• Expires after 30 days of inactivity
• Contains only a session identifier — no personal data

Because this cookie is strictly necessary for the service to function, it does not require separate consent under the EU ePrivacy Directive (2002/58/EC). We do not set any advertising, analytics, or tracking cookies.

11. Children's Privacy

Stock2Wrap is a professional B2B service intended for adults working in the film and television industry. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact us immediately at privacy@stock2wrap.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice within the application at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact and Supervisory Authority