Privacy Policy

1. Who we are

Orif-Trolley is a grocery budget-optimisation app designed for Irish families. We are committed to protecting your personal data and being transparent about how we use it. All personal data is stored in Google Cloud infrastructure located in Dublin, Ireland (europe-west1 region).

2. Age restriction

Orif-Trolley is intended for users aged 16 and over. The Irish Digital Age of Consent under the Data Protection Act 2018 is 16. By creating an account you confirm you meet this requirement. If you believe a child under 16 has registered, please contact us at cs-support@orif-trolley.ie so we can remove their data.

3. Data we collect

We collect: your email address (account creation); household information (household name, size, budget, county and area); extracted receipt data (item names, prices, store, date); shopping lists and tracked products; your acceptance of these terms and the date of acceptance; and optional coarse location (county/area only — your precise GPS coordinates are never stored and can be cleared at any time in Settings).

Receipt images are transmitted securely and processed by Google Cloud Vision API for text extraction only. Images are deleted immediately after OCR processing and are never stored.

All data listed above is stored against your user account and is linked to your identity. No personal data is anonymised or de-identified before collection or storage.

4. Legal basis for processing (GDPR Art. 6)

(a) Contractual necessity — to provide core features: account management, receipt scanning, price comparisons, and shopping lists.

(b) Legitimate interests — to maintain service security, detect fraud, and improve product quality using anonymised aggregated data.

(c) Consent — to send you marketing emails (optional). You may withdraw this consent at any time via Settings → Notifications → Marketing Emails or by contacting cs-support@orif-trolley.ie. Withdrawal does not affect the lawfulness of processing before it.

5. Aggregate analytics & insights

We analyse shopping history and receipt data in aggregate to understand usage patterns and improve Orif-Trolley — for example, average grocery budgets by household size, the stores our community shops at most, and periods of higher shopping activity.

This analysis is performed on data aggregated across many households; outputs do not identify any individual user or household, and we only publish or act on statistics drawn from a group large enough that no single household could be singled out. This analysis is for internal product and business purposes only — we do not share or sell these insights to retailers, advertisers, or other third parties.

6. Third-party processors & data sharing

We use the following processors, each under a GDPR-compliant Data Processing Agreement: Google Cloud (europe-west1, Dublin) — hosting and database; Google Cloud Vision API — receipt OCR; Firebase (Google LLC) — push notifications; Resend Inc. — transactional email (verification, password reset, invitations).

We do not sell your personal data and do not share identifiable personal data with any third party except the processors above or as required by law. When a price you report appears in community price comparisons, it is shown to other users without any identifying information — no other user can see who submitted a price or which household it came from. Internally, each price observation remains linked to the receipt and household that reported it, which we use to verify accuracy and investigate suspected fraud or misuse; this internal link is never disclosed to other users or made public.

7. Data retention

We retain your account data for as long as your account is active. You can delete your account and all associated data at any time from Settings → Delete Account. Anonymised price data derived from your receipts may be retained in aggregate form after account deletion.

8. Your rights (GDPR)

Under the GDPR you have the right to access, correct, erase, object to, restrict processing of, and port your personal data. To exercise any of these rights, contact us at cs-support@orif-trolley.ie. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.

9. Security

We use TLS encryption for all data in transit and secure hashing for passwords. All data is hosted within the EU (Google Cloud Dublin). We will notify you of any breach that affects your personal data.

10. Changes to this policy

We may update this policy periodically. We will notify you via the app when material changes are made, and your continued use of the service will require fresh acceptance of the updated policy.

Contact

For privacy-related questions or to exercise your GDPR rights, contact our data controller at cs-support@orif-trolley.ie.