SmartCart privacy policy

1. Who we are and what this policy covers

SmartCart is operated by Cetia Solutions in the United Kingdom. Cetia Solutions is the controller of personal data processed through SmartCart. This policy applies to the SmartCart marketing website, browser app, Android app and iPhone/iPad app.

It explains what personal data we process, why we use it, who may receive it, how long we keep it and the choices and rights available to you.

2. Personal data we collect

SmartCart does not receive your full payment-card number. Payments are processed by Google Play or Apple's App Store. SmartCart clients obtain product and price data from SmartCart's Supabase database; they do not scrape supermarket websites.

3. Where the data comes from

We receive information:

• directly from you when you create an account, make lists, search or contact support;
• from Google or Apple when you choose their sign-in service;
• from Google Play or Apple when a subscription needs to be verified; and
• automatically from the app, browser, device and service infrastructure when SmartCart is used.

4. How and why we use personal data

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before it was withdrawn.

5. Analytics and app measurement

The Android and iOS apps use Firebase Analytics to help us understand app performance and feature use. Events can include screen views, sign-in method, list or item actions, price-search result counts, comparison activity and subscription-plan events. We do not intentionally send shopping-list item names, complete search phrases, support-message contents or your email address as custom analytics events.

Firebase may also collect identifiers and technical information automatically in accordance with Google's documentation and your device settings. Firebase Analytics is not enabled in SmartCart's browser app at the date of this policy.

When you are signed in, SmartCart also stores a limited record of product actions in its Supabase service so the account activity and product-use features can work. These records may include the action type (for example, adding or checking a list item), platform, app version and time. We do not include item names, list names or full search phrases in these usage-event records. Guest activity is not linked to an individual account in this first-party event stream. We remove account-linked usage events when the account is deleted, after recording the deletion audit.

6. Sign-in, voice input and device features

Google and Apple sign-in

If you use Google or Apple to sign in, that provider authenticates you and supplies the account information needed by SmartCart, such as an identifier, email address and any name or profile image you have chosen to share. SmartCart does not receive your Google or Apple password.

Voice search

On supported mobile devices, you can choose to use speech input. Microphone access is requested only when you use that feature. SmartCart uses the recognised text and does not deliberately retain the raw audio. Your operating-system speech service may process voice input under its own privacy terms.

Sharing

If you share a list using your device's share sheet, you choose the receiving app or person. Their handling of the shared content is outside SmartCart's control.

7. Who we share personal data with

We disclose data only where needed to provide, protect or lawfully operate SmartCart:

• Supabase provides authentication, database, storage, realtime and server-side functions and generally processes SmartCart end-user data on our instructions.
• Google provides Google sign-in, Google Play subscription and distribution services, and Firebase Analytics for the mobile app.
• Apple provides Apple sign-in, App Store subscription and distribution services.
• Stripe processes web subscription payments and related billing events.
• Vercel and website infrastructure providers host and deliver the marketing website and browser-app files.
• Support and communications providers help deliver messages you send to SmartCart and our replies.
• Professional advisers, regulators or authorities may receive information where reasonably necessary to comply with law, protect rights or handle legal claims.

We do not sell personal data. We do not share the contents of your lists for third-party targeted advertising.

8. International transfers

SmartCart's primary Supabase project is configured in the United Kingdom. Some providers, their group companies or subprocessors may nevertheless process data outside the UK. Where required, we rely on an adequacy decision or appropriate contractual safeguards, such as the UK International Data Transfer Agreement, the UK Addendum or standard contractual clauses, together with additional safeguards where appropriate.

9. Browser storage and similar technologies

The browser app uses local browser storage needed to keep you signed in, remember your settings, cache app and catalogue information, support pending offline changes and retain your recent popular products. Clearing browser data or signing out may remove some or all of this locally stored information. The SmartCart marketing website does not currently use advertising cookies.

10. How long we keep data

We keep personal data only for as long as reasonably needed for its purpose:

• account, profile and shopping data is normally kept while your account is active;
• after an account-deletion request, live account data is deleted or anonymised as the request is processed, while limited backup, security or legal records may remain for a restricted period;
• support and feedback records are kept as needed to resolve the matter, improve support and manage legal claims;
• subscription and transaction records are kept for verification, accounting and legal obligations; and
• service logs and analytics follow limited operational or provider-configured retention periods.

The exact period depends on the type of record, account status, security needs and legal requirements. We securely delete or anonymise information when it is no longer required.

11. How we protect data

We use measures designed to protect personal data, including encrypted connections, Supabase authentication, access controls and database row-level security. Public catalogue and price data is separated from user-owned account data. No online service can guarantee absolute security, so please use a strong password and protect access to your device and email.

12. Your data-protection rights

Depending on your circumstances and the applicable law, you may have the right to:

• be informed about how your data is used;
• ask for a copy of your personal data;
• correct inaccurate or incomplete information;
• ask us to erase information;
• restrict or object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where we rely on it.

To exercise a right, email smartcart@cetia-solutions.co.uk. You can also follow our account and data deletion instructions. We may need to verify your identity before completing a request.

You may complain to the UK Information Commissioner's Office (ICO). We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO. Visit ico.org.uk for current complaint options.

13. Children

SmartCart is not directed to children under 13 and we do not knowingly collect their personal data. If you are a parent or guardian and believe a child has supplied personal data to SmartCart, please contact us so we can investigate and take appropriate action.

14. Automated processing

SmartCart may automatically classify products, match list entries to catalogue items and rank or recommend products to make the service useful. SmartCart does not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

15. Third-party services and links

SmartCart may link to app stores, supermarkets or other external services. Those organisations act under their own privacy notices when you use their services. We encourage you to read them.

16. Changes to this policy

We may update this policy when SmartCart, our providers or legal requirements change. We will publish the revised policy here and update the date above. If a change materially affects how we use personal data, we will provide additional notice where appropriate.