Legal

Privacy Policy

Last updated: 10 October 2026

In short: we collect only what we need to run the service and bill for it: your email address, your API usage and payment references. We never see your card details, we do not sell personal data, and you can ask us to see or delete your data at any time.

1. Who we are

This policy explains how BasketWatch ("we", "us") handles personal data when you use our website, dashboard, reports and API (the "Service"). We are the controller of that data. Contact us about anything in this policy at info@basketwatchireland.com.

The grocery product and price data we publish is not personal data.

2. What we collect

Account and billing: your email address, your API key, your plan, your credit balance and purchase history, and the payment references Stripe gives us. We never receive your full card details.
Usage: which parts of the Service you use, when, how many records were returned and the credits charged. Our servers also process your IP address to apply rate limits and keep the Service secure, and keep short-lived technical logs.
Dashboard sign-in: a session cookie that keeps you signed in. It is strictly necessary and is not used for tracking.
Enquiries: the details you give us when you request a demo or contact us, such as your name, email address, company and message.
Website analytics: if you consent, Google Analytics collects information about how the website is used, such as the pages visited, your browser and device, and your approximate location, using cookies.

3. Why we use it, and our legal basis

To provide the Service, issue API keys, meter credits and process payments (performance of our contract with you).
To keep the Service secure, prevent abuse, enforce rate limits and improve the Service (our legitimate interests).
To reply to enquiries and demo requests (our legitimate interests).
To send service emails, such as your key, receipts and important changes (performance of our contract with you).
To measure website use with analytics cookies (your consent, which you can withdraw at any time).
To keep financial records and meet other legal obligations (legal obligation).

We do not sell personal data, and we do not use it for automated decisions that significantly affect you.

4. Who we share it with

We use trusted providers to run the Service. They process personal data on our behalf and under our instructions:

Stripe, to process payments;
Resend, to send service emails;
Fly.io, to host the Service and its backups (servers in the United Kingdom);
Cloudflare, to deliver and protect the website; and
Google, for website analytics, only if you consent.

We may also disclose personal data where the law requires it, or to anyone who takes over the Service, who would be bound by this policy.

5. International transfers

The United Kingdom benefits from an EU adequacy decision. Where a provider processes data in the United States or elsewhere outside the EEA, the transfer relies on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep it

Account, billing and usage records: for as long as your account is active, and then for up to six years to meet accounting and tax obligations.
Enquiries: up to two years after our last contact.
Technical logs: a short period, typically no more than 30 days.
Analytics: as set in Google Analytics, no longer than 14 months.

7. Your rights

You can ask us to access, correct or delete your personal data, to restrict or object to how we use it, or for a copy in a portable format. Where we rely on consent, you can withdraw it at any time. Email info@basketwatchireland.com; we will respond within one month. You also have the right to complain to the Data Protection Commission (www.dataprotection.ie).

8. Security

All traffic to the Service is encrypted in transit, access to systems and data is restricted to those who need it, and we review security as the Service changes. No system is perfectly secure, so please keep your API key confidential.

9. Children

The Service is intended for businesses and is not directed at children.

10. Changes to this policy

We may update this policy. We will post the new version on this page with a new date, and will tell active customers by email about material changes.