Legal, privacy and outreach

Trial and recurring billing

The production trial lasts seven calendar days from creation of the customer’s private workspace and does not require a payment card. The workspace displays the remaining trial period. Before any recurring subscription begins, Stoko shows the selected plan, monthly price, billing frequency, first billing date and cancellation method, and records express acceptance. PayFast hosts the card-entry flow; Stoko does not receive card numbers or CVVs. Customers can cancel an activated recurring subscription in the workspace.

Privacy notice

Stoko processes account contact details, organisation membership and invitation records, stock and issuance records, notification preferences, security/audit logs, billing references and support correspondence to provide and secure the service, administer subscriptions, deliver requested service notices, support customers and meet legal duties. Marketing permission is kept separate from essential service messages.

Team invitation links are restricted to the invited email address, expire after seven days and are stored as cryptographic hashes. When AI interpretation is enabled, the user’s instruction and the minimum relevant inventory context may be sent securely to Stoko’s configured AI provider. Payment-card credentials, passwords and unrelated customer records are excluded. AI output is treated as a proposal: server-side permissions and stock rules remain authoritative.

Requests for access, correction, deletion, objection or marketing withdrawal can be sent to katlegoselemela@stoko.co.za. Data is retained only for operational, security, contractual and legal needs; a customer-specific retention and deletion schedule must be agreed before importing production data.

Direct-marketing controls

Stoko blocks electronic marketing unless the contact has recorded consent or qualifies as an existing customer for Stoko’s own similar services. A person who has not previously withheld permission may receive no more than one consent request. Every marketing message must identify Stoko and contain the unique unsubscribe link supplied by the outreach decision service. Opt-outs are placed on a permanent suppression list and are not treated as ordinary deletions.

Automated international outreach is disabled until the destination country has a documented legal review, lawful basis, approved message and suppression process. Purchased or scraped personal contact lists must not be uploaded or contacted merely because an address is publicly visible.

Security and acceptable use

Access is identity-gated and organisation data is isolated in server-side queries. Role checks, input limits, audit events, hosted payment collection and browser security headers reduce common risks. No internet service can truthfully be described as “unhackable”. Independent penetration testing, monitoring, backup restoration testing and an incident-response process remain required operational controls before high-risk or safety-critical use.

Stoko is not an emergency service, safety-control system, certified financial ledger or substitute for legally required records. Do not store payment-card credentials, account passwords, government identifiers, special-category personal data or unlawful material in the platform.

International customers

International onboarding requires country-specific terms, tax and currency handling, cancellation and consumer-right review, privacy roles, cross-border transfer terms, a subprocessor list and agreed data location. Until those are completed, international access is limited to demonstration and sales evaluation without production personal data.

Contact

Customer support, privacy and legal enquiries: katlegoselemela@stoko.co.za. Formal entity name, registration number, physical address, Information Officer details and service-of-notice address must be inserted into the customer terms before Stoko accepts live customers or sends scaled outreach.