UK GDPR & Data Protection Act 2018

Privacy Policy

Last updated: 19 October 2026 • Effective for all users of eloapp.co.uk and the Elo mobile application.

1. Who We Are & Our Privacy Commitment

Elo – Smart Supermarket Basket (“Elo”, “we”, “us”) operates eloapp.co.uk to help UK households compare supermarket grocery prices across Aldi, Asda, Morrisons, Ocado, Sainsbury's, Tesco, and Waitrose. You can browse our entire price catalog, build trolley comparisons, and share Smart Lists without creating an account. We never sell your personal data to advertisers or data brokers.

2. Information We Collect & Lawful Basis

Account Credentials (Consent / Contract): If you register an optional Elo account, we store your email address, display name, and a salted cryptographic password hash (scrypt). We never store plaintext passwords.
Price Watchlists & Smart Lists (Contract): When you set a target price alert on a grocery item or create a Collaborative Smart List, we store the product IDs, target price thresholds, and list share code so we can notify you of price drops and hydrate shared links.
Local Browser Storage & PECR Compliance (Strictly Necessary — Reg 6(4)): Under Regulation 6(4) of the UK Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025, Elo uses strictly necessary client-side localStorage keys solely to deliver the service you explicitly request: elo_trolley_basket_v1 (active shopping basket), elo_theme (light/dark accessibility mode), and elo_token (optional signed-in session token). Elo sets zero third-party advertising, behavioral profiling, or cross-site tracking cookies.
Outbound Supermarket Clicks & Daily Salted IP Pseudonymisation (Legitimate Interest): When you click through from Elo to a supermarket checkout page (via /r/:offerId), we record an anonymised click audit (supermarket slug, product ID, and timestamp) and may append an affiliate publisher tag (such as Awin or TradeDoubler) to sustain Elo as a free consumer tool. For fraud prevention and rate limiting, visitor IP addresses are irreversibly hashed using a daily rotating UTC cryptographic salt (SHA-256(ip + utc_day + secret_salt)) in accordance with UK GDPR Recital 26—raw IP addresses are never written to database storage.

3. Your UK GDPR Rights, Data Portability & Instant Account Deletion

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the statutory right to access (Article 15), rectify (Article 16), export in machine-readable format (Article 20), or permanently erase (Article 17) your personal data at any time:

Self-Service Right to Erasure (Article 17): Signed-in users can permanently delete their account, email address, and all saved price watchlists at any time via the account menu (DELETE /api/auth/account). Deletion executes immediately in a single ACID database transaction.

Self-Service Data Portability Export (Articles 15 & 20): Signed-in users can download a complete, machine-readable JSON archive of their profile, saved watchlists, and smart lists at any time via GET /api/auth/data-export.

4. Data Hosting, Security & Retention

All production databases and caches are hosted in London, United Kingdom (LON1) inside a private Virtual Private Cloud (VPC) with TLS 1.3 encryption in transit, AES-256 encryption at rest, and PostgreSQL Row-Level Security (RLS). Server error logs are automatically pruned after 30 days.

5. Contact Our Data Protection Team

For any privacy questions, data subject access requests (DSAR), or UK Information Commissioner's Office (ICO) enquiries, contact [email protected] or visit our Help & Support Centre.

Back to Grocery Comparison Read Terms of Service