Privacy Policy

This policy explains how Shop Smarty handles personal information. It applies when you browse the website, create an account, sign in with Google, save products, create alerts, receive messages, click retailer links or contact us.

It should be read together with our cookie policy, which gives more detail about information stored on or read from your device.

The controller responsible for the processing described in this policy is Shop Smarty, trading as Shop Smarty.

Privacy questions and requests can be sent via the form below.

The information we handle depends on how you use the service.

Account and identity information

• name, email address and internal account identifier;

• password hash and account security records;

• where you use Google sign-in, the profile information Google makes available with your permission, such as your name, email address and Google account identifier;

• administrator status and account creation or update timestamps; and

• notification, marketing and personalisation preferences.

Saved shopping and feature information

• favourites, wishlists, saved lists and recently viewed products;

• price-alert products, target prices, alert status and alert history;

• push-notification subscriptions and delivery status;

• product, category, brand and retailer interactions; and

• recommendation or promotion impressions, clicks and dismissals.

Device, usage and referral information

• IP address, browser type, device type and operating system signals;

• pages, products and features viewed or used;

• dates, times, session identifiers and approximate interaction order;

• referring page, campaign parameters and traffic-source information;

• retailer links and email links clicked; and

• diagnostic, error, security and fraud-prevention records.

Messages and complaint information

• contact form submissions, emails and other correspondence;

• complaint details, supporting documents and our response;

• identity-verification information where reasonably required; and

• records of privacy requests and marketing objections.

Please do not send sensitive personal information unless we specifically ask for it and explain why it is needed.

We obtain personal information:

• directly from you when you register, save an item or contact us;

• automatically from your browser or device when you use the website, subject to applicable consent requirements;

• from Google when you choose Google sign-in;

• from Apply when you choose Apple sign-in;

• from Email when you register using email;

• from email, push, analytics and affiliate service providers when they report delivery, interaction or referral events;

• from retailers or affiliate networks where needed to attribute an outbound click, lead or purchase; and

• from fraud-prevention, security or public sources where lawful and proportionate.

We may use information about products, categories, brands, retailers and promotions you view or save to infer likely shopping interests. Those signals can be used to choose or order recommendations and promotional modules. We may also use broad audience or session groupings to measure which content performs well.

This activity is designed to make product discovery more relevant. It is not intended to make decisions that produce legal effects or similarly significant effects about you. You can manage relevant consent choices, clear saved browser data, change account preferences or object to legitimate-interest profiling by contacting us.

We distinguish requested service messages from optional marketing. For example, a price alert you create or a security email may be necessary to provide a feature, while a general sale newsletter is marketing.

You can opt out of marketing by using an unsubscribe link, changing available account settings or contacting us. Browser push notifications can also be disabled through your browser or device settings. We may keep a minimal suppression record so that we remember not to send marketing to an address that has opted out.

We do not sell your personal information to third parties. We do not share your email address with a retailer merely because you click a retailer link, although the retailer will collect information from you if you visit its site or buy from it.

We may share information with the following types of recipient:

• Technology and hosting providers that supply website hosting, databases, content delivery, monitoring, security, backups and infrastructure.

• Authentication providers, including Google and Apple, when you choose Google or Apple sign-in.

• Communication providers, including Resend for email and the relevant browser push service for push notifications.

• Consent, analytics and advertising technology providers, including Silktide Consent Manager, Google Tag Manager and any services enabled through the live tag configuration after the required choices.

• Retailers, affiliate networks and commercial partners where needed to redirect you, attribute a referral, calculate commission, prevent fraud or reconcile a campaign. The identifier shared should be limited to what is reasonably required.

• Professional advisers and authorities, such as lawyers, accountants, insurers, auditors, courts, regulators and law-enforcement bodies where disclosure is lawful and necessary.

• A buyer or successor in connection with a proposed or completed investment, reorganisation, merger or sale, subject to appropriate confidentiality and data protection measures.

Suppliers acting for us are expected to use information only for agreed purposes, protect it appropriately and support us in meeting data protection obligations.

When you follow an offer, the retailer receives the normal information sent by your browser, such as your IP address and the referring page. The outbound link may also contain an affiliate or campaign identifier so the retailer or affiliate network can attribute the visit and any later qualifying action.

Once you are on the retailer's service, that retailer controls its own collection and use of personal information. Read its privacy and cookie information before providing details or completing a purchase.

Some suppliers, affiliate networks or group entities may process information outside the United Kingdom. Where UK data protection law restricts a transfer, we will use a recognised safeguard, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. We also consider whether supplementary measures are needed.

We keep personal information only for as long as it is reasonably needed for the purpose collected, including security, accounting, complaint and legal-claim requirements. The live retention schedule should take priority if it is more specific than the summary below.

While the account is active, then 4 years.

First-party website session -The current authentication session cookie expires after 30 days, although related server security records may be retained separately.

Google OAuth state and return destination - The current temporary cookies expire after approximately 10 minutes.

Apple OAuth state and return destination - The current temporary cookies expire after approximately 10 minutes.

Saved items, lists and alerts - Until you delete them or the account closes, then 4 years if they remain.

Behaviour, recommendation and promotion events - 4 years.

Affiliate and email-click measurement records - 4 years.

Customer service and complaints - 4 years.

Security and technical logs - 4 years.

Marketing suppression records - As long as reasonably needed to respect the opt-out and demonstrate compliance.

We may keep a record longer where law requires it, litigation is reasonably anticipated or a regulator asks us to preserve it. Information can also be anonymised so it no longer identifies anyone; anonymised statistics may be kept for longer.

We use technical and organisational measures intended to protect personal information against accidental loss and unauthorised access, alteration or disclosure. Measures may include access controls, password hashing, encrypted transport, supplier controls, logging, backups and software maintenance.

No internet service is completely secure. You should use a unique password, protect access to your email and device, and tell us if you suspect misuse. We have procedures for assessing personal-data incidents and notifying affected people or regulators where the law requires it.

Depending on the circumstances, UK data protection law may give you the right to:

• be informed about how your information is used;

• ask for access to your personal information;

• have inaccurate or incomplete information corrected;

• ask for information to be erased;

• ask us to restrict how information is used;

• receive certain information in a portable format;

• object to processing based on legitimate interests;

• object at any time to direct marketing;

• withdraw consent for future processing where consent is the basis; and

• seek safeguards in relation to qualifying solely automated decisions.

Rights are not absolute and exceptions may apply. To exercise a right, use the form above. We may ask for information needed to verify identity and locate the relevant records. We normally respond within the period required by law and will explain any lawful extension or refusal.

You can make a data protection complaint us - our complaint handling policy explains the process. We will acknowledge a data protection complaint within 30 days of receipt and, without undue delay, make appropriate enquiries, keep you informed and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office. We would appreciate the opportunity to address the issue first, but that does not prevent you from contacting the ICO. Information is available from the ICO complaints service.

Shop Smarty is not designed for children and account features are intended for people aged 16 or over. We do not knowingly seek children's personal information. If you believe a child has provided information contrary to this policy, contact us so we can investigate and take appropriate action.

We may update this policy as the service, suppliers or law changes. The latest revision date appears at the top. Where a change materially affects how we use existing information, we will take reasonable steps to draw it to your attention and request a new choice where required.