Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how TrolleySpy ("we", "us", "our") collects, uses, and protects your personal data when you use trolleyspy.ie. We are committed to complying with the General Data Protection Regulation (GDPR) and the Data Protection Acts 2018 as applicable in Ireland.

1. Who We Are

TrolleySpy is an independent Irish grocery price comparison service operating at trolleyspy.ie. For data protection queries, contact us at: [email protected]

2. What Data We Collect

When you register and use TrolleySpy, we collect:

Account data: your email address and a hashed (encrypted) password — we never store or see your plain-text password
Price entries: products, prices, shops, dates, and quantities you record yourself
Shopping lists: lists and items you create
Price notes: personal price observations you enter
Suggestions: product or shop suggestions and any photos you attach
Feedback: messages and screenshots you send us
Login logs: date, time, IP address, and browser type — used for security only
Cookies: a session cookie and, if you consent, analytics cookies (see section 6)

We do not collect payment information, phone numbers, or your physical address.

3. How We Use Your Data

We use your data to:

Provide and operate the TrolleySpy service
Maintain your price history, shopping lists, and notes
Send password reset emails when requested
Respond to feedback and suggestions you submit
Detect and prevent fraud or abuse
Understand how the service is used so we can improve it (via Google Analytics — see section 6)

We do not sell your personal data. We do not use your data for advertising. TrolleySpy does not display ads and does not share data with advertisers.

4. Legal Basis for Processing

Contract performance: processing your account and price data to provide the service you signed up for
Legitimate interests: login logs and security measures to protect accounts and prevent abuse
Consent: analytics cookies — you can withdraw consent at any time via the cookie settings banner

5. Data Retention

We retain your account and price data for as long as your account is active. To request deletion of your account and all associated data, email us at [email protected] and we will process it within 30 days in line with GDPR Article 17.

Login logs are retained for 12 months then automatically deleted. Password reset tokens expire after 1 hour. Suggestion photos are retained until the suggestion is reviewed and closed.

6. Cookies

We use two types of cookies:

Cookie	Type	Purpose	Duration
PHPSESSID	Essential	Keeps you logged in during your session. Contains no personal data. Deleted when you close your browser or log out.	Session
_ga, _ga_*	Analytics	Google Analytics. Helps us understand how many people visit TrolleySpy, which pages are popular, and how the site is being used. IP addresses are anonymised. No personal data is shared with Google for advertising.	Up to 2 years
ts_cookie_consent	Essential	Remembers whether you have accepted or declined analytics cookies, so we don't ask you again.	1 year

The essential session cookie (PHPSESSID) does not require consent as it is strictly necessary for the service to function.

Google Analytics cookies require your consent. When you first visit TrolleySpy, a banner asks whether you accept analytics cookies. If you decline, Google Analytics will not be loaded and no analytics cookies will be set. You can change your choice at any time by clicking Reset cookie preferences.

We use Google Analytics with IP anonymisation enabled. We have configured it to not share data with Google for advertising or benchmarking purposes. For more information, see Google's Privacy Policy .

7. Your Rights Under GDPR

You have the right to:

Access the personal data we hold about you
Rectify any inaccurate data
Erase your data ("right to be forgotten")
Restrict how we process your data
Portability — receive your data in a machine-readable format (use the Export CSV feature in your account)
Object to processing based on legitimate interests
Withdraw consent for analytics cookies at any time

You also have the right to lodge a complaint with the Data Protection Commission (DPC) — the Irish supervisory authority.

8. Data Security

We protect your data with: bcrypt password hashing (your password is never readable by us), HTTPS encryption for all data in transit, CSRF protection on all forms, session security measures, and storage of sensitive files above the web root.

9. Third Parties

We use the following third-party services:

Web hosting: shared hosting provider with servers in the EU. Your data is processed under a standard data processing agreement.
Google Analytics: website analytics (only if you consent). Data is processed by Google LLC under the EU-US Data Privacy Framework. See Google's Privacy Policy.

We do not share your personal data with any other third parties.

10. Changes to This Policy

We may update this policy when the service changes. The "last updated" date above always reflects the current version. Continued use of TrolleySpy after changes constitutes acceptance of the updated policy.

11. Contact

Questions about this policy or your data?
Email: [email protected]
Website: trolleyspy.ie

← Home · Register · Login