Privacy Policy

1. Introduction

Basket List ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using Basket List, you agree to the collection and use of information in accordance with this policy.

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

3. How We Use Your Information

We use your information for the following purposes:

• Service Provision: To provide, maintain, and improve Basket List functionality
• Account Management: To create and manage your user account
• Authentication: To verify your identity and maintain secure access
• Communication: To send service-related notifications and respond to inquiries
• Security: To detect and prevent fraud, abuse, and security incidents
• Analytics: To understand aggregate website usage and improve Basket List without advertising or cross-site tracking
• Legal Compliance: To comply with applicable laws and regulations

4. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing is necessary to provide the Service you've requested (Article 6(1)(b))
• Legitimate Interests: We have legitimate interests in maintaining security, using privacy-friendly analytics, processing operational service events, and preventing fraud (Article 6(1)(f))
• Legal Obligation: We may process data to comply with legal requirements (Article 6(1)(c))

5. Data Sharing and Third Parties

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We only share data with service providers necessary to operate Basket List:

• Electric SQL: Provides real-time data synchronization between your devices
• Supabase: Database hosting infrastructure (data stored in UK/EU regions)
• Umami Analytics: Provides aggregate, cookieless website analytics
• Fly.io: Hosts the Basket List application and processes data needed to serve it
• Stripe: Processes subscription payments and manages billing
• Resend: Delivers authentication, account, and onboarding emails
• Google: Provides Google sign-in when you choose to use it
• Recipe import service: Processes recipe URLs and recipe content only when you request an import

These service providers are contractually obligated to protect your data and only use it to provide services to us.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. If you request account deletion, we will remove your account data through the account-deletion process, except where we must retain limited information to meet legal, tax, accounting, fraud-prevention, or dispute-handling obligations. Payment providers may retain transaction records under their own legal obligations.

Authentication sessions expire or are revoked according to our security settings. Basket List does not keep application or route logs.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing of your personal data
• Right to Restrict Processing: Request limitation of how we process your data
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at the email address provided in Section 12. We will respond to your request within one month.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure password hashing using industry standards
• Regular security assessments and updates
• Access controls and authentication mechanisms
• Secure backup procedures

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. International Data Transfers

Some service providers may process data outside the United Kingdom. Where personal data is transferred internationally, we rely on an applicable adequacy regulation or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, as appropriate.

10. Children's Privacy

Basket List is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by email or through a prominent notice on our Service. Your continued use of the Service after such notification constitutes acceptance of the updated policy.

12. Contact Information and Data Controller

Basket List is the data controller responsible for your personal data. If you have questions, concerns, or wish to exercise your rights under UK GDPR, please contact us at:

Basket List

United Kingdom

Email: support@basketlist.co.uk

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your data protection rights have been violated. Visit ico.org.uk for more information.