Privacy policy
SupKit helps households prepare for emergencies, keep track of their supplies and waste less food. This policy explains what information SupKit uses, why, who it's shared with and the choices you have.
Who we are
SupKit is provided by LASSO LABS LTD (“we”, “us”). We are the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Contact us at support@supkitapp.com.
What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Account details: email address, first name, and an identifier from Sign in with Apple or Google if you use them. If you choose “Hide My Email” with Apple, we only receive Apple's relay address. | To create and secure your account, sign you in and send account emails (confirmation, password reset). | Contract |
| Household information: household name, the number and age bands of people you prepare for, pets (species, size, optional weight and notes), your preparedness target, dietary preferences. | To work out what your household needs and calculate your SupScore. | Contract |
| Supplies: products, quantities, dates, storage locations, shopping list items, checklist ticks and activity history. | To keep your household's shared list, power Use First reminders and show who changed what. | Contract |
| Health and access needs: yes/no answers to whether someone relies on medication, needs refrigerated medication, uses powered medical equipment or has mobility needs, and any health notes you choose to write in your household plan. | To add the right items to your checklist. We never ask for diagnoses or medication names. | Your explicit consent, which you can withdraw by changing or removing the answers |
| Household plan and emergency contacts: meeting points, utility shut-off locations, notes, and the names and phone numbers of contacts you add. | To show your plan, including offline in Emergency Mode. | Contract. For contacts you add, our legitimate interest in providing the feature you asked for; please let them know. |
| Photos you choose to scan, and voice-entry recordings, when you turn on automatic recognition. | To recognise products and turn what you said into items so you can add them quickly. | Your consent, asked before first use and changeable in the app |
| Subscription details from Apple or Google Play when you subscribe to SupKit Plus: the product, its status, renewal and expiry dates, and the store's transaction identifier (on Google Play, the purchase token). Apple or Google handles payment; we never see your card details. | To give your household SupKit Plus and keep it in step with renewals, cancellations and refunds. | Contract |
| Notification settings and a push token for your device. | To send the reminders you choose. | Consent (through your device's notification permission) |
| Technical information: IP address, device and app version, and logs created when your device talks to our servers. | To keep the service secure and reliable and to fix problems. | Legitimate interests |
With accurate voice recognition on, your voice-entry recording is sent to our server and transcribed by OpenAI, then the text is sorted into items by Anthropic. SupKit doesn't keep the recording. With it off, voice entry is turned into text by your phone's own speech recognition and recordings are not sent to us. On iPhone that's Apple's speech recognition on your device (or Apple's service on older devices); on Android it's the phone's on-device speech recognition where available, otherwise the system speech recognition service (usually Google's). Barcode lookups send only the barcode number. We do not use your information for advertising, we do not sell it, and we do not track you across other apps or websites. The app has no analytics or advertising trackers. On this website we only measure visits if you allow it: see cookies on this website.
Sharing within your household
SupKit is built for shared households. Everyone you invite into a household can see and edit that household's information, including supplies, plan, emergency contacts and health notes. Only invite people you trust. Household owners can remove members at any time.
Who else processes your information
We use these service providers to run SupKit. They act on our instructions and are bound by data protection terms:
- Supabase: database, sign-in and server functions, hosted in London (UK).
- Anthropic: AI recognition of photos and of voice-entry text, only when you use automatic recognition. Processed in the United States.
- OpenAI: speech-to-text for voice-entry recordings, only when accurate voice recognition is on. Processed in the United States.
- Resend: sending account and invitation emails.
- Apple: Sign in with Apple, and on iPhone, push notifications, speech recognition for voice entry, and App Store payments for SupKit Plus.
- Google: Sign in with Google, and on Android, push notifications (Firebase Cloud Messaging), speech recognition for voice entry when it isn't done on your phone, and Google Play payments for SupKit Plus.
- Cloudflare: hosting this website and invitation links.
- Google Analytics: measuring how this website is used, only if you accept analytics cookies. Google may process this data in the United States, under the UK Extension to the EU–US Data Privacy Framework.
- Open Food Facts, Open Beauty Facts, Open Pet Food Facts and Open Products Facts: product information for scanned barcodes (no personal data is sent).
Where information is transferred outside the UK, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses. We may also disclose information if the law requires it.
Cookies on this website
The SupKit app doesn't use cookies. On supkitapp.com we use Google Analytics to understand which pages are useful, but only if you choose “Accept” when we ask. It tells us which pages were visited, how people found the site, their approximate location (country or town), and their type of device and browser. It doesn't tell us who you are.
- _ga: tells one visitor from another. Lasts up to 2 years.
- _ga_V2GQ36KJ9Z: keeps track of a visit. Lasts up to 2 years.
The lawful basis is your consent. If you choose “Reject”, Google Analytics doesn't load and no analytics cookies are set. Your choice is saved in your browser's local storage (not a cookie) so we don't ask on every page, and we ask again after 12 months. You can change your mind at any time with “Cookie settings” at the bottom of every page; withdrawing consent removes the analytics cookies. Google Analytics keeps this data for up to 14 months. Invitation pages never load Google Analytics, because their links contain a private invitation code.
How long we keep it
- Account and household information: while your account exists. Deleting your account removes your personal data; a household you share passes to another member, and a household only you belong to is deleted.
- Photos sent for recognition: not stored. Recognised item suggestions: deleted after 30 days.
- Invitations: deleted 30 days after they expire.
- Delivery records for notifications: 60 days. Technical records that stop changes being applied twice: 90 days.
- Server logs and backups are kept for limited periods by our hosting provider and then deleted.
- Website analytics, if you allow them: up to 14 months in Google Analytics.
Your rights
You can access, correct or delete your information, ask us to restrict or stop using it, ask for a copy in a portable format, and withdraw consent at any time. You can delete your account in the app under Household › Account, or by emailing support@supkitapp.com from the address you signed up with if you can't use the app. To use any other right, email support@supkitapp.com. If you're unhappy with how we handle your information you can complain to the Information Commissioner's Office at ico.org.uk.
Children
You must be 13 or over to create a SupKit account. Information about children in a household (their age band) is entered by an adult in that household. We don't knowingly create accounts for children under 13.
Security
Information is encrypted in transit, access is limited to members of each household, and keys for third-party services are kept on our servers, never in the app. No system is perfectly secure, so please use a strong password and keep your device locked.
Changes
We'll update this policy when SupKit changes and tell you in the app about any significant changes.
SupKit helps households prepare for emergencies.