The short version. We collect what we need to run your membership: your email, your payments (handled by our payment provider, we never see your full card number), your claims and their proofs, and your questions to the assistant if you use it. We do not sell your data. If you joined from an advert, we tell the advertising partner that showed it that you signed up. You can ask to see it, correct it or delete it at any time by emailing help@shopping-protection.com.
1. Who is responsible for your data
APH Services LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA ("Shopping Protection", "we") is the controller of the personal data collected through shopping-protect.com and the Shopping Protection Services. You can reach us at help@shopping-protection.com.
We process personal data under the UK General Data Protection Regulation and the Data Protection Act 2018.
2. What we collect
| Data | Where it comes from |
|---|---|
| Email address; name and phone number if you give them | Checkout, login, contact form, claims |
| Payment data: card brand, last four digits, expiry, payment history, statement descriptor | Our payment provider. Your full card number is entered on its secure fields and never reaches our servers |
| Subscriptions: which ones you hold, start dates, status, credit on your balance | Created when you subscribe |
| Claims: retailer, order number, amount, description, and the proof you upload (receipts, order emails, photos) | Sent by you when you file a claim |
| Assistant conversations: your questions, the answers, and the pages consulted to answer | Only if you use the shopping assistant |
| Support: emails, calls, contact-form messages, cancellation requests | When you contact us |
| Technical data: IP address, browser and device type, pages visited, timestamps, login events | Automatically, from your browser; see our Cookie policy |
| The advert that brought you: the reference of the click, the page you arrived on | Our advertising partner, when you arrive from one of its adverts |
We do not collect special-category data and we do not want it: please do not include health, financial or identity documents in a claim unless we ask for a specific document.
3. Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Provide the Services, your account, and your claims | Performance of our contract with you |
| Take payments, issue refunds and credit, detect and prevent fraud, handle chargebacks | Contract, and our legitimate interest in protecting the business |
| Send transactional emails: login codes, receipts, trial and renewal reminders, cancellation confirmations | Contract and legal obligation |
| Answer your questions and complaints | Contract and legitimate interest |
| Keep accounting and tax records | Legal obligation |
| Improve the Services, fix bugs, measure how the Site is used | Legitimate interest, using the least data possible |
| Confirm to an advertising partner the sign-ups that came from its adverts, and measure what our adverts bring | Legitimate interest: paying our partners for the members they bring, and no more |
| Send you news or offers about Shopping Protection by email | Only with your consent, which you can withdraw in one click in every email. We do not do this today |
We do not sell personal data. We share it with an advertising partner in one case only: to confirm a sign-up that came from one of its adverts, as described in section 4. We do not make automated decisions with legal or similarly significant effects about you: claims are reviewed by a person.
4. Who we share it with
We use service providers who process data only on our instructions, under contracts that require them to protect it:
- Our payment provider (payments and fraud prevention). It is also an independent controller for some fraud and regulatory purposes.
- Supabase (database and login, hosted in London).
- Railway (hosting of the Site).
- Brevo (sending our emails).
- HubSpot (our support desk, where your messages and claims are handled).
- Anthropic (the AI model behind the shopping assistant). It receives the text of your questions and the pages needed to answer, not your name, email or payment details. Anthropic does not use this data to train its models.
- Our advertising partners, only if you joined from one of their adverts. On the page that confirms your sign-up, we tell the partner whose advert brought you that you signed up, with the reference of the click and the details you gave us when signing up: your email address, and your name and phone number if you entered them. The partner uses them to count the sign-up once and to choose the offers from other companies that this page may show. It never receives your payment details, your claims or your conversations with the assistant.
- A measurement tool, on the pages of our offers, to count visits and sign-ups and to compare two versions of a page.
- Our accountants, lawyers and insurers, when needed.
- Authorities or a court, when the law requires it, or to establish or defend a legal claim.
5. Transfers outside the UK
Some providers process data outside the United Kingdom, mainly in the United States and the European Economic Area. Where they do, we rely on the UK Government's adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the provider's own safeguards.
6. How long we keep it
| Data | Kept for |
|---|---|
| Account, subscription and payment records | While you have an account, then 6 years, for tax and to defend claims |
| Claim files and proofs | 2 years after the claim is closed |
| Assistant conversations | As long as you keep them in your account; you can delete them at any time |
| Support messages | 3 years |
| Technical logs | 90 days |
When a retention period ends we delete the data or anonymise it.
7. Your rights
You have the right to:
- ask for a copy of the data we hold about you;
- have it corrected if it is wrong;
- have it deleted, where we no longer need it;
- restrict or object to how we use it;
- receive the data you gave us in a portable format;
- withdraw consent at any time, where consent is the basis;
- complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Email help@shopping-protection.com to use any of these rights. We answer within one month and we do not charge for it. We may ask you to confirm your identity by replying from the email address on the account.
8. Security
Data is encrypted in transit and at rest. Access is limited to the people who need it to do their job and is logged. There is no password to steal: you log in with a one-time code sent to your email. Card numbers are handled by our payment provider, which is certified to PCI DSS Level 1, and never touch our servers. Claim proofs are stored in a private bucket and shared with our support team through links that expire.
9. Children
The Services are for adults. We do not knowingly collect data from anyone under 18. If you think we have, email help@shopping-protection.com and we will delete it.
10. Changes to this policy
We may update this policy. The date at the top always shows the current version. If a change affects how we use your data in a way that matters to you, we will email you before it takes effect.
11. Contact
APH Services LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA Email: help@shopping-protection.com