Privacy Policy

Effective Date: 30 June 2026 Last Updated: 15 July 2026

This Privacy Policy explains how Mimisys LTD ("we", "our", or "us") collects, uses, shares, and protects your information when you use the AislePilot app (for shoppers) and the AislePilot Partner app (for shop owners and their staff), together with our website at https://aislepilot.co.uk (collectively, the "Service"). AislePilot (aislepilot.co.uk) is a product of Mimisys LTD.

AislePilot is a platform that connects local grocery shops ("Shops", operated by "Partners") with nearby shoppers ("Shoppers"). This policy covers both audiences. Where a practice applies to only one app, we say so.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Who We Are (Data Controller)

For the purposes of UK GDPR, EU GDPR, and similar laws, the data controller is:

• Mimisys LTD
• Registered address: 46A Claughton Street, Saint Helens, WA10 1SN, England, United Kingdom
• Contact: contact@aislepilot.co.uk

When a Shop processes data about its own customers and orders inside AislePilot Partner, the Shop acts as an independent controller for that activity, and we act as a processor providing the software. See Section 5.

2. Information We Collect

2.1 Information Shoppers provide (AislePilot app)

• Account information: your name, email address, and password, plus an optional phone number. Sign-in is handled by Firebase Authentication (Google): your password is set and verified there — it is never stored by, or visible to, Mimisys. We only receive a secure account identifier from Firebase.
• Addresses: delivery addresses you save or enter to place an order.
• Orders: the items in your basket, order totals, your chosen fulfilment method (delivery or click & collect), your selected payment method, order notes, and which Shops you have saved.
• Payment information (card payments): when you pay online by card, your card details are entered into and processed by our payment processor, Stripe (see Sections 5 and 6). We do not receive or store your full card number. We receive only limited details, such as the card brand, expiry, and last four digits, together with a payment or refund status. If you choose to save a card for future orders, Stripe stores it securely and provides us with a token (not the card number) so you can reuse it.
• Item requests: products you ask a Shop to stock.
• Reviews and ratings: content you post about a Shop, shown under your display name.
• Messages: the content of chat messages you send to a Shop, and support messages you send us.

2.2 Information Partners provide (AislePilot Partner app)

• Account & owner information: owner name, email address, password, and phone number. As with Shoppers, passwords are managed by Firebase Authentication and are never stored by Mimisys.
• Shop profile: shop name, contact email and phone, website, description, address (including map location/coordinates), opening hours, fulfilment settings, accepted payment methods, and your shop logo and banner images.
• Catalogue: products, descriptions, prices, categories, stock, and product images (added individually or via spreadsheet/CSV import).
• Order handling: information about orders your Shop receives, including the Shopper's name, contact details, delivery address, and order contents, so you can fulfil them. You may also add private notes or flags about a customer.
• Staff: if you add staff, the name, email address, and account you create for each of them.
• Messages: chat messages you exchange with your customers, and support messages you send us.
• Billing details: the information needed to set up and collect your monthly subscription (agreed with you during onboarding).
• Payout account (card payments): if you choose to accept online card payments, you connect a Stripe account. Stripe collects the identity, business, and bank-account information it needs to pay you and to meet its own legal obligations directly from you; we receive only a status summary — for example, whether your account is ready to accept payments and receive payouts.

2.3 Information collected automatically

• Device & technical data: app version, device model, and operating system version, used for compatibility and troubleshooting.
• Identifiers: an account user ID assigned by our authentication provider.
• Push notification token (AislePilot app): a token that lets us send you order-status notifications, if you allow notifications.

We do not use third-party advertising, ad identifiers (IDFA), or cross-app/cross-site tracking, and we do not use third-party analytics SDKs.

2.4 Device permissions

• Camera (AislePilot app): to scan a Shop's QR code so you can add it. We do not store photos or video from scanning.
• Photo library (AislePilot Partner app): to let Partners choose shop and product images.
• Notifications (AislePilot app): to send order updates. You can turn these off in your device settings.
• Location/Maps (AislePilot Partner app): to help Partners set their shop's map location. The AislePilot shopper app does not collect precise device GPS location; delivery locations come from the address you enter.

3. How We Use Your Information

We use information to:

• Create and manage your account and authenticate you.
• Provide the core Service: showing Shops, baskets, orders, delivery/collection, item requests, and reviews.
• Pass order details to the relevant Shop so it can pick, pack, and fulfil your order (see Section 5).
• Send transactional messages, such as order-status updates and important service notices.
• Operate Partner accounts, including onboarding, approval, and billing the monthly subscription.
• Process online card payments and refunds through our payment processor, pass payouts to Shops, and collect our per-order service fee (see Section 5).
• Maintain safety and integrity, prevent fraud and abuse, and enforce our Terms (including suspending or locking accounts where permitted).
• Provide customer support and respond to your requests.
• Comply with legal obligations.

We do not sell your personal information, build advertising profiles, or use your data for automated decisions that produce legal or similarly significant effects without a lawful basis.

4. Legal Bases for Processing (UK & EU GDPR)

• Performance of a contract: to provide the Service you request (accounts, orders, fulfilment, Partner subscriptions).
• Legitimate interests: to secure the Service, prevent fraud/abuse, support users, and improve the Service — balanced against your rights.
• Consent: for optional device permissions (camera, photos, notifications) and any future marketing. You can withdraw consent at any time.
• Legal obligation: to meet tax, accounting, and other legal requirements.

5. How We Share Your Information

We do not sell or rent personal information. We share it only as described here.

• Between Shoppers and Shops (core to the Service): when you place an order, we share your name, contact details, delivery address (for delivery orders), and order contents with the Shop so it can fulfil your order. Chat messages you send a Shop are shared with that Shop. Partners only see data relating to their own Shop's orders, subscribers, messages, and reviews — never other Shops' data. Reviews you post are visible to the Shop and other Shoppers under your display name.
• Service providers (processors): we use trusted providers to run the Service (see Section 6). They may process data only on our instructions and must protect it.
• Payments: where a Shop offers online card payment, your payment is processed by Stripe (our payment processor) on the Shop's behalf. Stripe handles your card details directly under its own security standards (PCI DSS); AislePilot never receives or stores your full card number. We receive only limited information — such as the card brand, expiry, and last four digits, a payment or refund status, and (if you choose to save a card) a secure token that lets you reuse it. For in-person and cash payments — card on delivery or collection, or cash — you pay the Shop directly and we do not handle those payments. See Section 6 for more about Stripe.
• Legal and safety: we may disclose information where required by law, to respond to lawful requests, or to protect the rights, property, or safety of AislePilot, our users, or the public.
• Business transfers: if we are involved in a merger, acquisition, or sale of assets, information may transfer as part of that deal; we will notify you of any change in control of your data.

6. Third-Party Services

Images you upload (shop logos and banners, product photos, and item-request photos) are stored on our image hosting and may be accessible via a unique URL. These URLs are not indexed by search engines or intentionally made publicly searchable, but you should treat anything you upload as potentially accessible to anyone who has its link.

Online card payments are processed by Stripe, which handles your card details directly under the PCI DSS security standard. AislePilot does not store your full card number — see Section 5.

7. Data Retention

• Account data: kept while your account is active.
• Orders and transaction records: kept while your account is active and for as long as needed for accounting, tax, and dispute-resolution purposes.
• Reviews and item requests: kept while relevant to the Shop and the Service.
• Partner & billing records: kept for the life of the subscription and as required by law afterwards.
• Push tokens: removed when you disable notifications or delete your account.

When you delete your account, we delete or anonymise your personal data within a reasonable period (typically within 30 days), except where we must retain certain records to comply with the law or resolve disputes. Deleted information may also remain in encrypted backups for a limited period, for disaster-recovery purposes, before being permanently overwritten.

8. Data Security

We use reasonable technical and organisational measures, including encryption in transit (TLS/HTTPS), authentication and access controls, and server-side rules that restrict each account to its own data. Account passwords are managed entirely by Firebase Authentication and are never stored on our own systems. No method of transmission or storage is completely secure, but we take commercially reasonable steps to protect your information.

9. Your Rights

Subject to your local law, you can:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (much of which you can edit in-app).
• Delete your account and data (available in-app under account settings, or by contacting us).
• Export a portable copy of your data.
• Object to or restrict certain processing, and withdraw consent at any time.

To exercise these rights, email contact@aislepilot.co.uk. We will respond within the time required by law (generally 30 days).

For UK & EU residents (UK GDPR / EU GDPR)

You also have the right to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office (ICO) at https://ico.org.uk. Where we transfer data outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

For California residents (CCPA/CPRA)

You may request the categories and specific pieces of personal information we collected, request deletion, and correct inaccurate information. We do not sell or "share" (as defined by the CPRA) your personal information, and we will not discriminate against you for exercising your rights. Submit requests to contact@aislepilot.co.uk.

For India residents (DPDP Act)

We act as a data fiduciary. You may access, correct, and erase your personal data, nominate a representative, and raise a grievance with us at contact@aislepilot.co.uk or with the Data Protection Board of India.

10. International Transfers

We and our service providers may process and store your information on servers that may be located outside your country (for example, our database and image-hosting providers' data centres). Where required, we put appropriate safeguards in place for such transfers, such as Standard Contractual Clauses or reliance on adequacy decisions.

11. Children's Privacy

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact contact@aislepilot.co.uk and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last Updated" date above, post the new version at https://aislepilot.co.uk/privacy, and, for material changes, notify you in-app or by email. Your continued use of the Service after changes take effect means you accept the updated policy.

13. Contact Us

• Email: contact@aislepilot.co.uk
• Controller: Mimisys LTD, 46A Claughton Street, Saint Helens, WA10 1SN, England, United Kingdom
• Website: https://aislepilot.co.uk