Who this covers
Restock holds personal data about your team — names, email addresses, sign-in credentials, pending invitations, and the name stamped on every audit entry. If one of them asks what you hold, or asks to be removed, this page answers it.
Suppliers are not covered, because there is nothing to cover. A supplier here is a company name typed on a product — Restock stores no supplier contact, no email and no phone number anywhere. There is no person in that field to export or erase.
1 · Subject access — export everything held
A complete answer: their account, any invitation sent to their address, and every audit entry their work produced. Credentials are listed as held but never disclosed — a subject-access request is not a way to read someone's password hash or their two-factor seed.
2 · Erasure — remove someone's identifying details
Their name and email are replaced with [removed], any pending invitation to that address is blanked, so is their address on the saved views and forecast events they set up, their password and two-factor secrets are cleared, and their API keys are revoked. The account can no longer sign in.
What survives, and why. Your stock history, sales and purchase orders are business records and are untouched. The audit trail is also untouched — it is append-only, and Restock has no code path that rewrites it. That is deliberate: the log exists to show that a stock figure was changed by someone accountable, and a log that can be edited to remove a name can be edited to remove anything. So past entries keep the name they were written with. Tell the subject this plainly — it is a retention decision you can defend, not an oversight, but it is yours to weigh against your own obligations.
Kept: their address as "Raised by" on the purchase orders they raised, and the audit trail's entries recording what they did, because purchase orders are business records and the audit trail cannot be edited.
Restock refuses to erase an account that can still log in — deactivate it on the Team page first — and refuses to erase the last remaining admin.