Privacy Policy

1. Introduction

Shrewd.ie ("we", "us", "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Shrewd ("the Service").

We are the data controller for the purposes of the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

Data Controller Details:
Shrewd
Email: privacy@shrewd.ie

2. What Data We Collect

2.1 Information You Provide Directly

Account Information: When you create an account, we collect your name, email address, and password (stored encrypted).

Household Profile: To provide our service, we collect information about your household including eircode, property type (detached, semi-detached, terraced, apartment), heating type (gas, electric, oil, heat pump, other), number of adults and children, and when you moved in.

Bill Information: When you upload a bill, we collect:

• The bill image or PDF (if you upload a photo rather than entering details manually)
• Structured data extracted from the bill including supplier name, account number, meter point reference numbers (MPRN/GPRN), plan name, monthly cost, contract end date, and billing address
• Any additional bill-specific information you provide (e.g., number of mobile lines)

Payment Information (when payments are enabled): When paid features are enabled, we will collect your billing address and the last 4 digits of your card number (provided by Stripe). We do not store full card details — these are handled securely by our payment processor, Stripe. The Service is currently free to invited users and no payment information is collected.

Communications: If you contact us by email or through support channels, we collect the content of your messages and any attachments you send.

2.2 Information We Collect Automatically

Usage Data: We collect information about how you use the Service, including pages visited, features used, time spent on pages, and actions taken (e.g., uploading a bill, viewing a verdict).

Device and Browser Information: We collect information about your device including IP address, browser type and version, operating system, and device identifiers.

Cookies: We use cookies and similar technologies to maintain your session, remember your preferences, and analyse how the Service is used. See our Cookie Policy at shrewd.ie/legal/cookies for details.

3. How We Use Your Data

We use your personal data for the following purposes:

To Provide the Service: We process your household profile and bill data to analyse your bills, compare available tariffs, and generate recommendations. This is necessary to perform our contract with you.

To Send Service Communications: We send you audit results, verdict updates, renewal alerts, and monthly summaries as part of the Service. For paid subscribers, these communications are necessary to deliver the service you paid for.

To Process Payments: We use your payment information to charge fees and process refunds. This is necessary to perform our contract with you.

To Improve the Service: We analyse usage data and aggregated bill data to improve our tariff comparison algorithms, add new features, and fix bugs. This is based on our legitimate interest in improving the Service.

To Comply with Legal Obligations: We may process your data to comply with legal requirements, including tax reporting, responding to lawful requests from authorities, and enforcing our Terms of Service.

To Protect Our Rights: We may process your data to detect and prevent fraud, abuse, and security incidents. This is based on our legitimate interest in protecting the Service and other users.

4. Legal Basis for Processing

Under GDPR, we must have a legal basis to process your personal data. Our legal bases are:

Contract: Processing is necessary to provide the Service you signed up for (household analysis, verdicts, ongoing monitoring for subscribers).

Legitimate Interests: Processing is necessary for our legitimate interests in improving the Service, preventing fraud, and ensuring security, provided these interests do not override your rights.

Legal Obligation: Processing is necessary to comply with legal requirements such as tax laws and responding to lawful requests.

Consent: For marketing communications (if you opt in) and certain cookies. You can withdraw consent at any time.

5. How Long We Keep Your Data

Bill Images: Uploaded bill images and PDFs are stored for 90 days after extraction is complete, then automatically deleted. This retention period allows you to verify the extraction was accurate and request corrections if needed.

Structured Bill Data: Information extracted from bills (supplier, plan, cost, meter references, contract dates) is retained for as long as your account is active. This data is necessary to provide ongoing monitoring, historical comparisons, and verdict updates.

Account Data: Your account information, household profile, and verdict history are retained for as long as your account is active, plus 7 years after closure for tax and legal compliance purposes.

Payment Data: Payment transaction records are retained for 7 years to comply with Irish tax law and accounting requirements.

Usage Data: Aggregated, anonymised usage statistics may be retained indefinitely for analytics purposes.

6. Who We Share Your Data With

We do not sell your personal data to anyone. We share your data only with the following categories of recipients:

Service Providers: We use third-party service providers to help deliver the Service:

• Supabase (database, authentication, and bill image storage; EU data centres in Frankfurt)
• Fly.io (application hosting, EU region — Frankfurt)
• Anthropic (bill text extraction via Claude AI, data processed in accordance with Anthropic's data processing agreement)
• Sentry (error and performance monitoring, EU data centres)
• PostHog (product analytics, EU hosting in Frankfurt — only loaded after you consent via the cookie banner)
• Stripe (payment processing, EU data centres — only active when paid features are enabled)
• Resend (transactional email delivery — account confirmation, verdicts, and reminders; EU processing)

These providers are contractually obligated to protect your data and use it only to provide services to us.

Legal Requirements: We may disclose your data if required by law, court order, or regulatory authority, or to protect our rights, property, or safety.

Business Transfers: If we are acquired by or merge with another company, your data may be transferred to the new owner, who will be required to comply with this Privacy Policy.

7. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Our primary infrastructure is hosted by Supabase in Frankfurt, Germany.

Some service providers (e.g., Anthropic for bill text extraction) may process data outside the EEA. Where this occurs, we ensure adequate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your data.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access: You can request a copy of the personal data we hold about you.

Right to Rectification: You can ask us to correct inaccurate or incomplete data.

Right to Erasure ("Right to be Forgotten"): You can request deletion of your data, subject to our legal obligations to retain certain records (e.g., for tax purposes).

Right to Restriction: You can ask us to restrict processing of your data in certain circumstances.

Right to Data Portability: You can request a copy of your data in a structured, commonly used format.

Right to Object: You can object to processing based on legitimate interests. If you object, we will stop processing unless we have compelling legitimate grounds.

Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at privacy@shrewd.ie. We will respond within 30 days.

You also have the right to lodge a complaint with the Irish Data Protection Commission at dataprotection.ie if you believe we have not complied with data protection law.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration.

Security measures include:
• Encryption of data in transit (TLS/HTTPS) and at rest
• Access controls limiting who can access your data
• Regular security audits and monitoring
• Secure authentication mechanisms
• Automatic deletion of bill images after 90 days to minimise data retention

However, no system is completely secure. If you become aware of any security vulnerability, please report it to us immediately at privacy@shrewd.ie.

10. Children's Privacy

The Service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email or through a notice on the Service at least 30 days before the changes take effect.

Your continued use of the Service after the changes take effect constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:
Email: privacy@shrewd.ie