How Cognilist handles personal data

1. When this policy applies

This policy applies to:

• visitors to our website;
• people who contact us about demos, pilots, partnerships or other business enquiries;
• users of the Cognilist demo app;
• Cognilist's own handling of personal data in connection with retailer integrations.

When Cognilist is integrated into a retailer's app, website, self-scanning device or smart cart, the retailer will usually be the controller of shopper data and Cognilist will usually act as a processor or service provider on the retailer's behalf. In those cases, the retailer's privacy notice should explain how shopper data is collected and used.

2. Personal data we collect or receive

We may collect or receive:

• identity and contact data, such as your name, work email address, employer, job title, and the contents of emails or other communications;
• technical data, such as IP address, browser type, device information, referring page, timestamps, and similar log or security data;
• service input data, such as shopping list items, scanned product or barcode data, images of handwritten lists, recipes, receipts or screenshots, correction feedback, and preference or context information supplied with a request;
• commercial data, such as records of demo requests, pilot discussions, and contract-related communications.

We receive this data directly from you, automatically from your browser, device and infrastructure when you use the website or demo app, and from retailer customers or their systems when they send data to Cognilist in connection with a shopper-facing integration.

3. How we use personal data

We use personal data to:

• operate, secure and maintain the website, demo app and Cognilist services;
• respond to enquiries, arrange demos, discuss pilots and manage business relationships;
• provide requested Cognilist functionality, including list extraction and matching shopping list items to scanned or selected products;
• personalise matching outputs when relevant context is included in a request;
• monitor reliability, investigate misuse, prevent fraud, and address bugs or security issues;
• comply with legal, regulatory, tax and accounting obligations;
• establish, exercise or defend legal claims.

4. Our legal bases

We generally rely on:

• legitimate interests, to run and secure our website and services, respond to business enquiries, and protect our business and users;
• contract, or steps taken at your request before entering into a contract, where you ask us for a quote, pilot, demo or service arrangement;
• legal obligation, where we must retain or disclose data to comply with law.

Where consent is required for a specific activity, we will ask for it.

5. Retailer integrations and the demo app

Cognilist is an API-first service for retailers. In retailer deployments, the retailer normally decides what shopper data is collected and why. The retailer also retains control of shopper preference data and may pass relevant context to Cognilist with each request.

Data sent to the core Cognilist matching service, such as shopping list items, scanned product information, shopper preferences or similar context, is processed only to generate a response and is then immediately discarded. Cognilist does not use that customer data for model training.

If you use the Cognilist demo app directly, we may process the data you submit so the demo can work. The demo app is provided for evaluation purposes, does not currently require account sign-up, and its barcode-to-product lookup may rely on publicly available product data.

6. Cookies and similar technologies

We do not currently use analytics cookies, advertising pixels or other non-essential tracking technologies on the website. We may use strictly necessary technologies needed for site delivery, security and core functionality.

If we introduce non-essential cookies or similar technologies later, we will update this policy and, where required, request consent.

7. Sharing, international transfers and retention

We may share personal data with hosting, cloud, email, security and infrastructure providers that help us operate the website and services, and with professional advisers or public authorities where required by law or needed to protect rights, safety or property. We do not sell personal data.

Some providers may process personal data outside the UK. Where we make restricted transfers, we use the safeguards required by UK data protection law.

We keep personal data only for as long as necessary for the purposes described in this policy. Core service input data sent to the Cognilist matching service is processed only to generate the requested response and is then immediately discarded. Business correspondence, operational logs and compliance records may be kept for longer where reasonably necessary.

8. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No system is completely secure, so we cannot guarantee absolute security.

9. Your rights

Depending on applicable law, you may have the right to:

• access your personal data;
• correct inaccurate or incomplete personal data;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent where we rely on consent;
• lodge a complaint with the Information Commissioner's Office ("ICO") or another relevant regulator.

If your data was processed through a retailer's use of Cognilist, you should usually contact that retailer first. We will support our customer where required by law and contract.

10. Children and automated decisions

Cognilist is a B2B service and is not directed to children. We do not knowingly seek to collect personal data from children through the website or demo app.

Cognilist uses automated systems to generate matching and list-structuring outputs requested by users and retailer customers. We do not use personal data collected through this website to make solely automated decisions that produce legal or similarly significant effects about individuals.

11. Changes and contact

We may update this Privacy Policy from time to time. When we do, we will post the updated version and revise the "Last updated" date.

If you have questions or want to exercise a privacy right, contact:

If you are unhappy with how we handle personal data, you can also complain to the ICO at ico.org.uk.