Privacy Policy

ShouldIBuyIt.co.uk is an AI-powered shopping recommendation service operated from the United Kingdom. For any privacy-related question, including the rights described in section 9 below, please contact us at hello@shouldibuyit.co.uk.

• To generate a buying recommendation in response to your question.
• To maintain the context of a conversation if you ask a follow-up question.
• To improve recommendation quality over time (e.g. learning that certain queries are commonly downvoted).
• To count unique voters for public approval percentages, using only the non-reversible hash described in section 2.2.
• To track affiliate clicks in aggregate so we can report retailer performance.
• To respond to enquiries you send by email.

We rely on the following lawful bases under Article 6 UK GDPR:

• Legitimate interests (Art. 6(1)(f)) for processing search queries, chat messages and aggregate analytics so we can provide and improve the recommendation service.
• Consent (Art. 6(1)(a)) for any optional analytics or marketing cookies — you decide via the cookie banner.
• Contract / pre-contractual steps (Art. 6(1)(b)) where you choose to contact us by email about a service.
• Legal obligation (Art. 6(1)(c)) where retention is required by law (for example, tax or accounting records).

When you submit a query, the text of that query is sent to our AI model provider (Anthropic, Inc.) to generate a response. The provider processes your query only to produce that response and does not use it to train their models. No personally identifying information is required to use the service — please do not include personal data (names, email addresses, financial details, health information) in your queries. See our AI Disclaimer for the limits of AI-generated recommendations.

When you click a "Find on Amazon" or "Buy on Amazon" button, you are taken to Amazon's UK site. Amazon may set its own cookies and process your data under its own privacy policy. As an Amazon Associate we earn a commission from qualifying purchases at no extra cost to you. The commission does not influence the recommendation. See our Affiliate Disclosure for full details.

• Anthropic (claude.ai/api) — AI model that generates recommendations from your queries.
• Amazon UK — destination of all 'Find on Amazon' affiliate links.
• Wikipedia — public read-only API used to look up royalty-free product images. No user data is sent.
• Our cloud hosting provider — processes requests and stores the database. No third-party analytics scripts are loaded without your consent.

• Search queries and chat messages: retained for up to 24 months for quality improvement, then permanently deleted or anonymised.
• Affiliate click events: retained as aggregate counts indefinitely; no per-user records.
• Voter fingerprints (hashes): retained as long as the vote remains relevant to the recommendation it relates to.
• Email enquiries: retained for up to 24 months after the last reply, then deleted.

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Have inaccurate personal data corrected (Art. 16).
• Have your personal data erased where the lawful basis no longer applies (Art. 17).
• Restrict or object to processing based on legitimate interests (Art. 18 & 21).
• Withdraw consent at any time for processing based on consent (Art. 7(3)) — including reopening the cookie banner from the footer.
• Receive a portable copy of personal data you provided to us (Art. 20).
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your rights have been infringed.

To exercise any of these rights, email hello@shouldibuyit.co.uk. We will respond within one calendar month.

The Site is intended for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We use HTTPS in transit, encryption-at-rest where supported by our hosting provider, scoped admin authentication, and limit access to production data to a small number of authorised individuals. No system can be 100% secure; if we become aware of a breach affecting your data we will notify the ICO within 72 hours where the law requires it and contact affected users where appropriate.

Some third-party services we use (notably Anthropic and Amazon) may process data outside the UK and EEA. Where data is transferred, we rely on the UK adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses with the appropriate UK Addendum.

We may update this policy from time to time. The "Last updated" date at the top of the page will always reflect the most recent change. Material changes will be highlighted in the cookie banner the next time you visit.

Email: hello@shouldibuyit.co.uk