1. Who is responsible for your information
The controller for personal information processed through TrueCost is TrueCost.
Before public launch: add the appropriate controller or business contact address using NEXT_PUBLIC_LEGAL_CONTACT_ADDRESS.
Before public launch: add a privacy contact email using NEXT_PUBLIC_LEGAL_CONTACT_EMAIL.
2. Information processed when you use TrueCost
Depending on how you use the service, TrueCost may process:
- product names, URLs and other search terms that you submit;
- technical request information such as IP address, browser information, timestamps and server logs;
- a hashed or otherwise transformed network identifier used for rate limiting, abuse prevention and service security;
- communications you choose to send through a corrections or contact channel; and
- operational information needed to diagnose errors and protect the service.
Do not enter confidential information, health information or other sensitive personal data into a product search.
3. Why the information is used
Information may be used to provide product research, return cached results, protect TrueCost against excessive or abusive automated use, maintain security, investigate faults, improve the service and respond to enquiries or correction requests.
4. Legal bases
Where UK data-protection law applies, processing will normally rely on one or more appropriate legal bases. For basic service operation, security, fraud or abuse prevention and service improvement this may include legitimate interests. Where consent is legally required, for example for certain non-essential storage or tracking technologies, consent will be requested before those technologies are used.
The exact legal basis should be reviewed if TrueCost later introduces accounts, newsletters, behavioural analytics, advertising or other new uses of personal information.
5. Service providers
TrueCost uses third-party infrastructure and technology providers to host the application, store data and perform AI-assisted research. Those providers may process information on TrueCost's behalf in order to provide their services.
The current technical architecture includes cloud hosting, database services and AI services. Before public launch, the operator should ensure its provider agreements, privacy settings and any international-transfer safeguards match the way the production service is actually configured.
6. International transfers
Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, appropriate contractual or other recognised safeguards should be used.
7. Retention
TrueCost should keep personal information only for as long as it is reasonably needed for the purpose for which it was collected. Short-lived security and rate-limit records should be deleted or expired automatically where possible. Operational logs may be retained by infrastructure providers for their configured retention periods.
The production retention periods should be documented before public launch and updated here if they materially affect users.
8. Your rights
Depending on the circumstances, UK data-protection law may give you rights to ask for access to personal information, correction, deletion, restriction, objection or portability, and to withdraw consent where processing relies on consent.
You may also have the right to complain to the UK Information Commissioner's Office.
9. Changes to this notice
This notice may be updated as TrueCost develops. Material changes should be reflected on this page together with an updated revision date.