Security and data
What happens to your data, in plain words.
Who can see it, where it is processed, what automatic reading does, and how to get it back or delete it.
The protections in place
Every store isolated
Each store’s data is separated at the database level. One store can never read another’s.
Role-based access
Owner, manager or sales staff: everyone can only do what their role allows.
Encrypted connections
All traffic with the site and the software goes over HTTPS.
Encrypted passwords
Passwords are stored in encrypted form by the authentication service. No one can read them.
Protected technical tasks
The software’s automated operations only run with a secret key.
Customers anonymized
Your customers’ contact details are anonymized automatically two years after delivery or cancellation.
Automatic reading: what it does, and what it doesn’t
The packing lists you import are read by Google’s AI models (Gemini), through Lovable’s AI gateway.
It does
- Read every line of the document: item, finish, packages and quantity.
- Prepare a draft your team can correct.
- Keep factory names exactly as written.
It doesn’t
- Change your inventory. Only a confirmed receipt increases it.
- Approve anything for you. Every import waits for a manager’s approval.
- Guarantee zero errors. Automatic reading can make mistakes, which is why your team reviews it.
Who hosts and processes your data
Your data is never sold or rented. Only these technical providers can access it, to run the service.
| Provider | Their role |
|---|---|
| Lovable Labs Incorporated | Platform, application hosting and service emails |
| Supabase, Inc. | Database, files and accounts |
| Cloudflare, Inc. | Site delivery and network security |
| Google (Gemini models) | Automatic reading of imported packing lists |
These providers may process data outside the European Union, notably in the United States. These transfers are covered by each provider’s safeguards: European Commission standard contractual clauses and/or the Data Privacy Framework.
Your data belongs to you
Get a copy
At any time: the owner downloads a complete copy from Settings, in CSV and JSON.
Delete everything
The owner deletes the store from Settings. Data, files and team accounts are erased immediately.
When the pilot ends
Your data is deleted 30 days after access ends, unless you ask to retrieve it.
A written GDPR framework
For your customers’ contact details, you remain the data controller and Dockwell acts as processor, under the Article 28 GDPR agreement attached to the terms.
Questions about your data?
Write to us and we’ll reply by email. Full details are in the terms of use and the privacy policy.