1. Who We Are

Runner Technology Ltd ("we", "us", "our") operates the ShopRunner application and website at stockrunner.app. We are the data controller responsible for your personal data.

For any privacy-related queries, contact us at [email protected].

2. What Data We Collect

Information you provide

Account details - name, email address, phone number, password.
Organisation details - shop name, address, business type.
Product data - catalogue items, barcodes, prices, shopping lists, photos you upload.
Payment information - processed securely by our payment provider; we do not store card numbers.

Information collected automatically

Device information - device type, operating system, browser type, app version.
Usage data - pages visited, features used, timestamps.
Log data - IP address, request headers, error reports.

3. App Permissions

When you use the ShopRunner mobile app, we may request the following device permissions:

Camera - used to scan product barcodes and capture product photos. The camera feed is processed on your device in real time and is not streamed or uploaded to our servers. Only photos you explicitly choose to save (for example, attaching an image to a product) are uploaded.
Photos / Storage - used when you select an existing photo from your device to attach to a product.
Notifications - used to alert you to shared list updates or approval requests. Optional; you can disable them in your device settings at any time.

You can revoke any of these permissions at any time through your device settings. Revoking camera access will disable barcode scanning.

4. How We Use Your Data

We use your data to:

Provide, maintain, and improve the Service.
Sync your shopping lists and catalogue data across your devices in real time.
Send you transactional messages (OTP codes, password resets, account notifications).
Provide customer support.
Monitor and analyse usage patterns to improve the product.
Detect, prevent, and address technical issues and security threats.

We do not sell your personal data to third parties.

5. Legal Basis for Processing (UK GDPR)

Contract - processing necessary to provide the Service you signed up for.
Legitimate interest - analytics, security monitoring, product improvement.
Consent - marketing communications (you can opt out at any time).
Legal obligation - where we are required to retain data by law.

6. Who We Share Data With

To run ShopRunner we use a small number of carefully chosen service providers (processors). They only handle your data on our instructions and for the purposes described below. We disclose them by category rather than by individual name; specific vendor information is available on request.

Category	What it's for	Data sent	Region
Hosting & infrastructure	Running the application and storing your data securely.	All data stored in the Service.	UK / EU
Object storage	Storing product photos you upload and encrypted backups.	Image files and filenames.	EU
Payment processing	Subscription billing and invoicing.	Billing email, plan, period dates. No card numbers ever reach us.	EU / US
SMS & WhatsApp delivery	Sending one-time passcodes and login messages.	Phone number and OTP code.	EU / Asia
Email delivery	Sending transactional emails (OTP, password reset, receipts).	Email address, subject, body.	EU
Push notifications	Delivering alerts to your mobile device.	Device token and message payload.	EU / US
Real-time sync & search	Keeping data in sync across devices and powering catalogue search.	Catalogue and list metadata; no payment data.	EU
AI for catalogue enrichment	Categorising catalogue items for better discoverability.	Product name and brand (no personal data).	EU / US
Bot protection	Preventing automated abuse of public forms.	IP address and challenge token.	Global edge
Public barcode databases	Looking up product information by barcode.	Barcode number (no personal data).	EU

International transfers outside the UK or EEA are covered by appropriate safeguards (such as Standard Contractual Clauses or applicable adequacy decisions). The full list of vendors in each category is available on request - email [email protected].

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we begin a 30-day grace period during which you can reverse the deletion. After 30 days, your personal data is permanently deleted from our systems, except where we are required by law to retain it (e.g. financial records for up to 7 years).

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Encryption in transit (TLS 1.2+) and at rest.
Regular security audits and vulnerability assessments.
Access controls limiting who can view your data internally.
Automated encrypted database backups.

9. Your Rights

Under UK GDPR, you have the right to:

Access - request a copy of your personal data (Settings → Export My Data).
Rectification - correct inaccurate personal data via your account settings.
Erasure - delete your account and data. See our account deletion page for in-app and email instructions.
Portability - receive your data in a structured, machine-readable format.
Objection - object to processing based on legitimate interest.
Restriction - request we limit processing of your data.
Withdraw consent - where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Cookies

ShopRunner uses essential cookies required for authentication and session management. We do not use advertising or third-party tracking cookies. See our Cookie Policy for the full list and how to control them.

11. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

12. International Transfers

Some of our sub-processors operate outside the UK. Where personal data is transferred internationally, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or UK adequacy decisions).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice within the Service at least 14 days before the changes take effect.

14. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

15. Contact

Runner Technology Ltd
Email: [email protected]