Your finds stay yours.

Who is responsible?

Kendall Group Ltd operates Restokk and is the controller of the personal information described here. For privacy questions or requests, email [email protected], or write to our registered office.

What information do we use?

• Your account: name, email address, a password hash, verification status and account timestamps. We store verification and reset credentials in hashed form.
• Your watchlist: the product URLs you save, public product names and stock details, check times and results, and your choices about pausing and email alerts.
• Your alerts: detected restocks, read status and email or push delivery results.
• Your device, if you enable push: the browser’s delivery subscription and the keys needed to send encrypted notifications.
• Security and support: session information, request and network details used to operate and protect the service, rate-limit records, and information you include when contacting us.

Account details come from you; public product information comes from the retailers you choose. Your watchlist is private to your account. We do not need shop passwords, card details or access to your checkout.

Our cookies and storage notice covers the sign-in cookie, temporary product links and email addresses stored in your browser, and offline app assets.

Why do we use it?

• To provide the service you request: create and verify your account, keep your watchlist, check public product pages, recover access and deliver selected stock alerts. Our lawful basis is performing our agreement with you or taking steps you request before it starts.
• To protect and support the service: prevent misuse, secure accounts, investigate faults and answer support messages. We rely on our legitimate interests in running a safe, reliable service, while considering your rights.
• For optional device notifications: we ask for your permission before subscribing your browser to push alerts. You can turn them off at any time.
• Where required by law: handle applicable legal obligations and rights requests.

We use your email for account messages and the stock alerts you enable. The current service has no marketing mailing list, advertising trackers or third-party analytics scripts. We do not sell your personal information or use it to make decisions with legal or similarly significant effects on you.

Without an email address and account credentials, we cannot provide a private account. You can browse the public website without signing up.

Who receives information?

Our Kitcloud hosting environment stores account and watchlist information and handles outgoing email. Your email provider receives messages sent to your address. Cloudflare helps deliver and protect the website and can process network and request information.

If you enable Android push, encrypted notification content is sent through your browser’s push service, which also processes delivery information. Retailers receive requests from our server when we check the public links you save; we do not send them your Restokk account email or password.

These services can involve processing outside the UK, particularly through global security, email and notification networks. Provider arrangements and applicable transfer safeguards depend on the service involved. Contact us for information about the providers and safeguards relevant to your use. Cloudflare describes its processing in its privacy policy.

Authorised people operating Restokk may access information when needed to provide support, maintain the service or respond to a lawful request. Retailer websites you visit have their own privacy notices.

How long is it kept?

Account and watchlist data remains available while your account is in use, until you remove a watch or request account deletion. Removing a watch deletes its saved record and associated alerts from the active database.

• Verification links and codes expire after 30 minutes. Unverified registrations are eligible for removal after 24 hours and are cleared by the next successful maintenance run.
• Password-reset links expire after 30 minutes. Expired reset records are cleared by maintenance; used credentials cannot be reused.
• Sign-ins normally last up to 12 hours. “Keep me signed in” allows up to 30 days, with expiry after 14 days of inactivity. Security actions can end sessions earlier.
• Expired application rate-limit records are cleared by maintenance after a further 24 hours.

Support correspondence, operational logs and recovery backups are retained only while needed to resolve enquiries, investigate security issues, recover the service or meet applicable legal obligations. The relevant criteria are the enquiry’s status, ongoing incidents, recovery needs and any required legal retention. They do not all follow the account-token expiry periods above.

Removing live data does not immediately rewrite historical backups. If you request erasure, we consider retained copies and any legal need to keep information, and explain any limits that apply to your request.

Your controls and rights

Pause a product to stop further checks, or remove it to delete its watch and alerts. To change an existing watch’s email choice, remove it and add it again with the email option you want. Turn off push in Alert settings on each device, or revoke the browser’s notification permission. An alert already being delivered may still arrive.

You can change your password and sign out of all devices in your account. To request a copy of your information, a correction or account deletion, email [email protected]. We may need proportionate information to verify your identity; never send your password.

Depending on the circumstances, UK data-protection law gives you rights to access, correct or erase information, restrict or object to its use, and receive certain information in a portable format. You can withdraw permission where we rely on consent, without affecting earlier lawful use. These rights have conditions and exceptions; we will explain any that affect a request.

Questions, complaints and updates

Please contact us if you have a concern about your information. You can also complain to the Information Commissioner’s Office, the UK data-protection regulator.

We will update this page when the service or our handling of information changes, and provide an appropriate notice of material changes. The date at the top shows the latest update.