GAIPGoverned Agentic Intelligence Platform

Privacy notice

Privacy notice (UK GDPR).

Draft — pending legal review

Last updated 10 October 2026. Operator: Toby Graham, a sole trader trading as GAIP. Contact: agents@gaipagents.com or gaipagents.com/contact. Post: 11 Hippodrome Mews, London W11 4NN. TODO(founder): add the company registration number once GAIP's company is formed.

Who is responsible

The controller is Toby Graham, a sole trader trading as GAIP. Contact: agents@gaipagents.com or gaipagents.com/contact. GAIP's founder, as a sole trader, is registered with the Information Commissioner's Office as a data controller (registration number ZC268568, on the ICO's public register). GAIP does not need a Data Protection Officer: its core activity is not large-scale monitoring of people and it holds no special-category data.

What GAIP is designed not to collect

GAIP has no accounts and asks for public or non-personal data only. Several routes refuse requests that carry obvious personal-data fields (for example email, phone, address, date of birth or IP address fields). Please do not send personal data.

What is processed

Online shops: the Listing Observer, the free shop check and the Shopify app

This section is final: GAIP's legitimate interests assessment and data protection impact assessment for observing shops were approved on 7 October 2026.

GAIP also reads public pages of online shops, so that AI shopping agents can see whether a shop's product details agree across the shop's own sources. This covers shops that have never contacted GAIP or opted in. A shop's name, web address and any contact details it publishes can identify a person, for example where the shop is run by a sole trader, so GAIP treats them as personal data.

Why. To tell AI shopping agents, at a stated time, whether a shop's own sources agree; to give merchants a dated record of what agents could read about their shop; and to measure and improve the accuracy of these checks. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR), for shops that never contacted GAIP: GAIP has documented a legitimate interests assessment and a data protection impact assessment (it reads only public pages and files published for shoppers and agents, keeps values not copies, gives per-shop results only to the agent that asks, publishes only figures across many shops and honours opt-outs); the remaining risk is low. A summary is available through corrections and opt-out.

Retention. 1,095 days for observation history and daily shop-check rows, as stated above; after that, observation history is kept only for figures across many shops, without page or shop addresses, under the statistical-purposes rule of UK GDPR Article 5(1)(e), and deleted if the shop asks.

Your choices. GAIP honours robots.txt for its shop readers (the GAIP-Listing-Observer group for product pages and the GAIP-Watch group for the shop check, otherwise the * group) and identifies each reader on GAIP's automated clients. A shop owner can opt out of observation, ask for its stored history to be deleted, or correct a record through corrections and opt-out; an opted-out shop is not read again.

Second Look by GAIP (checking a product before you buy)

When you check a product with Second Look (/check or the second_look_check tool), GAIP reads that product's public page and the shop's own public product data, and reads them a second time a few seconds later if they show something other than what you were told. It keeps one signed receipt per check: the product link, the shop's domain, the values it saw (price, stock and option, as published) and when, the product's category and brand as the shop publishes them, how the check was asked (website, API or assistant app, as a label only) and the price, stock and option you named. If you paste what an assistant told you, GAIP keeps only the price, stock and option it names and discards the rest of the text without storing it. No account, no name, no email; a receipt carries no personal data. Second Look never shows a shop's ratings or reviews.

Retention. Receipts are kept for 6 years from the check; after that only their digests and signature remain, so a receipt can still be checked. Each check is also counted once, with the shop's domain only.

Anonymous figures. GAIP builds anonymous, aggregate figures from these checks (for example, how often the prices shoppers were told matched shops' own pages, by product category). No figure names a shop or is given for one shop, and every figure has at least 5 checks behind it. These anonymous figures may be published or licensed to businesses. Personal data is never sold or licensed, and data from GAIP's Shopify app is never used for them.

Recipients. No one is sent your check; anyone you give a receipt's link to can open that receipt. The shop is not told. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR), as for the online-shop reads above. Your choices: nothing is needed to use it; a shop can ask for a check to be reviewed through corrections and opt-out.

Agents' receipts. An agent that presents its GAIP continuity handle with a check gets a receipt bound to that handle by a keyed hash (handle_hash: an HMAC under GAIP's signing key, never the handle itself). The binding is kept for 90 days from the receipt date and then dropped; the receipt, its signature and its place in the chain stay. An agent may also name its own reference to the shopper's mandate; GAIP keeps only its keyed hash (mandate_sha256), never the reference, for as long as the receipt. A handle or mandate hash is personal data where its holder can link it to a person; GAIP cannot, and holds no name, address or account beside it.

Vendor-submitted pairs. A vendor may submit what an AI assistant answered about a product (gaip_second_look_pair): the assistant's name from a fixed list, the SHA-256 of the prompt, the price, stock or option the answer gave (kept as those fields and the excerpt's SHA-256; the text is not kept), and when it was answered. GAIP reads the product page once and keeps the pair as a signed record bound to the vendor's handle (as above), carrying the sentence: “As submitted by the vendor at the stated time; GAIP did not read the assistant's answer at its source. The page values are GAIP's own reading at the time shown.” A pair is shown to whoever holds its code and is never published per assistant: it enters the anonymous accuracy figures only by quarter and field, in cells of at least 5 pairs from 3 shops. Retention as for receipts (6 years, then digests and signature only).

The Names register, lookalike pairs and Notices

This section was adopted by GAIP's founder on 9 October 2026 (decision #51) from the Legal desk's researched answers.

Sources. Public agent and MCP server registries (the Official MCP Registry and the other registries GAIP's Observatory reads), operators' own notices published at /.well-known/gaip-notices.json, registry status changes, and OSV advisories for MCP server packages.

What is kept. Each registry name (which can contain a GitHub username, for example io.github.<user>/<server>), the date GAIP first recorded it, the registry it came from and the host of its remote endpoint; pairs of names on record that look alike; and notices, with the issuer's own words (a hash and a short excerpt) and the operator's reply carried verbatim. GAIP never says why two names look alike or names a motive.

Why, and the lawful basis. A dated record of agent names and of lookalike names, so agents can tell a name from its imitations, and notices of withdrawals and advisories for the agents that depend on a server. The lawful basis is legitimate interests (Article 6(1)(f) UK GDPR).

Telling people. GAIP has no contact details for the publishers whose names it records, and contacting each one would involve disproportionate effort (UK GDPR Article 14(5)(e)); this notice is published here instead, as Article 14(7) requires.

Objecting. A publisher can object at POST /v1/free/record/names/objection with an owner_challenge from POST /v1/free/host-timeline/verify (proof that it controls the name's host). A confirmed publisher's name is removed from lookups and lookalike pairs, and GAIP decides within one month. You can also use corrections and opt-out.

Retention. Names, first-recorded dates and pairs are kept with no deletion date, so the dated record stays complete, within fixed limits of 200,000 names and 50,000 pairs. Notices stay readable after they are withdrawn, with the time of withdrawal, and replies are kept with the record they answer.

GAIP Preferences

This section was adopted by GAIP's founder on 9 October 2026 (decision #51) from the Legal desk's researched answers.

People (or the agents acting for them) can publish an agent-preference record at /.well-known/agent-preferences.json on their own host. GAIP reads these records weekly on the hosts it watches and keeps an index of them. The index holds hashes of the identifiers in each record (never the identifiers themselves), the record's rules and where the record lives (host and location). The hashes are still personal data, because anyone who knows an identifier can compute its hash.

Telling people. The published record format says that GAIP reads and indexes records, so people who publish one already have this information (UK GDPR Article 14(5)(a)).

Checks. When a company's agent asks a preference check, the subject it asks about is hashed in memory and is never stored or logged; only the hash appears in the answer and its receipt, which go to the caller. No answer is consent or a lawful basis for contact.

The caller screen. When your agent asks GAIP about an agent approaching it (/v1/free/preferences/screen), your own identifier, if you pass one, is hashed in memory and never stored, and a receipt the caller showed you is checked and not kept. GAIP keeps only counts per calling host (how often it was screened and how often it showed a receipt), never who was approached.

Lawful basis. Legitimate interests (Article 6(1)(f) UK GDPR): honouring people's own published objections to contact. To remove a record from the index, withdraw it or take it down; GAIP's next weekly read reflects that. You can also use corrections and opt-out.

GAIP Mandates

This section follows the Legal desk's round-two record of 9 October 2026 (R9-R10) and GAIP's founder's decision #52 of the same day approving its wording rule.

People (or the agents acting for them) can publish a mandate record at /.well-known/agent-mandates.json on their own host: which agent may act for them, within which scope classes and period, and whether the mandate has been withdrawn. GAIP reads these records weekly on the hosts it watches and keeps an index of them. The index holds hashes of the principals (never the identifiers themselves; the same hash as a Preferences subject key), the agent's public endpoint or key thumbprint, the scope classes with any limit and currency, the dates, the withdrawal flag and where the record lives (host and location); a note is kept as a hash and a length only. The hashes are still personal data, because anyone who knows an identifier can compute its hash.

Telling people. The published record format says that GAIP reads and indexes records, so people who publish one already have this information (UK GDPR Article 14(5)(e), with Article 14(7)).

Checks. When an agent asks a mandate check, the principal it asks about is hashed in memory and is never stored or logged; only the hash appears in the answer and its receipt, which go to the caller. An answer says only that a mandate was published and whether it was withdrawn, as indexed at the stated time; whether it authorised any act is a matter between the parties. GAIP holds no funds and moves none.

Lawful basis. Legitimate interests (Article 6(1)(f) UK GDPR): honouring and evidencing a person's own published authorisation of an agent, including its withdrawal. To remove a record from the index, mark it withdrawn or take it down; GAIP's next weekly read reflects that. A hosted record for people without a domain is not offered. You can also use corrections and opt-out.

GAIP Revocations

This section follows the Legal desk's round-three record of 9 October 2026 (R17-R18), which needed no new founder decision.

GAIP publishes one feed of the facts in its record that stopped being true as indexed: mandates withdrawn or past their period, keys retired, registry servers deleted, preference records changed, representations removed, notices issued and Deals agreements a party recorded as cancelled. Nothing new is collected for it: each entry repeats what the record it comes from already keeps, under that record's rules, with the hashes and endpoints that record already publishes (a Deals agreement appears only as the SHA-256 of its id). The status lists carry no subject at all, only bits at random positions.

Feed readers. To publish how many distinct readers poll the feed each week, GAIP keeps a one-way hash of the software name each reader sends (its User-Agent), never the address, for that week only as a count.

Every entry says: GAIP publishes that a fact in its record stopped being true as indexed at the stated time; it says nothing about the effect of that on any party.

Lawful basis. Legitimate interests (Article 6(1)(f) UK GDPR), as for the record each entry comes from. Corrections and objections go through corrections and opt-out; a correction to the source record is published in the feed as that record changes.

Disclosures

An agent can record with GAIP that it passed personal data about a person to another agent (witness_disclosure). GAIP never receives the data itself. For each record GAIP keeps a keyed reference to the person's identifier (a keyed hash; never the identifier), the recipient agent's endpoint, the categories from a fixed list, the purpose class, the basis as stated by the discloser, the dates and whether the recipient acknowledged it.

GAIP's basis under UK GDPR is legitimate interests (Article 6(1)(f)): a dated record that helps the discloser show what it did, the recipient show what it received, and you see where agents say your data went. The basis a discloser states is its own statement; GAIP does not assess it. GAIP holds no special-category or criminal-offence data in these records.

GAIP cannot write to you, because it knows you only as a keyed reference (UK GDPR Art 14(5)(e)); this section is the measure Art 14(7) asks for.

Who sees what: the discloser sees its own records, the recipient sees what it acknowledged, and you can see the records about you. For an agent you run, publish a preference record at that agent's own host naming your continuity handle and ask with gaip_disclosures_about_me; for an email address, a phone number or a DID, write to agents@gaipagents.com and show you control it. You can dispute a record, object or have records erased the same way; GAIP acknowledges within 5 working days and acts within one month, and refuses later records about you after an objection.

Records are kept six years from the receipt date, then deleted, leaving only the chain entry. GAIP assessed this processing before starting it (a data protection impact assessment); send your views on it to agents@gaipagents.com at any time.

The agent-commerce record (what a shop commits to agents)

This section follows the Legal desk's shopping record of 10 October 2026 (S6; decision #65), which needed no new founder decision.

A shop can publish a file at /.well-known/agent-commerce.json on its own domain (a Shopify-hosted shop: at /apps/gaip/agent-commerce.json, written for it by GAIP's Shopify app on the merchant's instruction) saying which checkouts it supports, which agents it admits, and what it commits to on price, returns, delivery and reference prices. GAIP reads these files weekly on the hosts it watches and on a host an agent names in a check, and keeps an index: the host, the commitments as published (every value from a fixed vocabulary, a number or a URL), the dates GAIP first and last saw the file, its sha256, version and read time, and the dates it was published, changed or withdrawn. A dispute e-mail address in the file is kept only as "present"; a dispute URL is kept. A shop's name and web address can identify a person where the shop is run by a sole trader, so GAIP treats them as personal data.

Telling shops. The published file format carries GAIP's indexing notice word for word, so a shop that publishes one already has this information (UK GDPR Article 14(5)(e), with Article 14(7)).

What GAIP says. An answer says what the shop's own file said when GAIP read it, with the read date and the file's hash, never more: "The shop's own agent-commerce file as GAIP read it at the stated time; the shop may not have published one, or may have changed it since. Not a statement that the shop accepts, admits or honours anything." GAIP's own file is the example, labelled as such.

The Shopify app. The app writes the file to the merchant's own public address on the merchant's instruction and stores the merchant's choices in the app's own database; nothing passes from the app's access to the shop's data into GAIP's index, which reads the public file exactly as it reads anyone else's (Shopify Partner Program Agreement 9.14). For a Shopify-hosted shop, installing the app (not the record alone) is the merchant's opt-in to GAIP's scheduled reads of the shop's public product pages; uninstalling it ends them. Without the app, GAIP reads such a shop only when someone asks, from the public product page only.

Lawful basis. Legitimate interests (Article 6(1)(f) UK GDPR): keeping a dated record of what a shop published for agents, for agents that are about to buy and for the shop itself. To remove a record from the index, take the file down (GAIP's next read reflects that), or ask for the host's rows to be removed through corrections and opt-out. The format text is CC BY 4.0.

Second Look evidence export (a party's record for a “not as described” dispute)

A party to a Second Look or order-capture receipt can export GAIP's records about it at /v1/free/evidence/export (tool gaip_evidence_export): the receipt, GAIP's own readings of the product page from 30 days before to 7 days after (with the days it could not read), the shop's agent-commerce file as GAIP indexed it that day, vendor-submitted accuracy pairs for that product with their sentence, the hash of any mandate reference the receipt carries, and the field names of card schemes' dispute forms as names only. A party is the holder of the continuity handle that bound the receipt, or of the merchant link token in the receipt's merchant copy: the token sent is hashed in memory under a key GAIP holds and compared with the receipt; it is never stored. Anyone else gets “not a party” and nothing else. A bundle holds nothing about a third party: no other receipt, no other handle.

What GAIP keeps. A count of exports by receipt kind, with the first and last time; never which receipt was exported or by whom. Usage events for the export keep counts only. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR), as for Second Look receipts. Every bundle carries: “GAIP's signed record of what it recorded at the times shown. It is not advice, and not a statement about who is right.”

Order-time capture (in the Shopify app, only if the merchant switches it on)

Switched on at GAIP since 11 Oct 2026, when GAIP's founder signed off its data protection assessment: orders are read only for shops whose merchant switched it on.

When a merchant switches on “Order-time capture” in GAIP's Shopify app, the app sends GAIP, for each new order, only: the order number, the public link to each product ordered, the price and quantity on the order, the option ordered, when the order was placed, how the checkout identified itself (a word from a fixed list) and, where the order carried one, the fact that a software agent identified itself and the identifier it gave (a UCP profile link, a Visa TAP indicator, a Web Bot Auth key id or the id of a GAIP continuity handle). GAIP then reads up to 20 of those product pages on the shop's own site at that moment, the way Second Look reads them, and keeps one signed receipt: what each page showed (price, currency, stock, product name) with the time, what the order said (price and quantity), whether the shop had published an agent-commerce file as GAIP had indexed it, and the agent identifier as given when it is a UCP or Visa TAP https link or a Web Bot Auth key thumbprint (anything else only as a keyed one-way hash).

What never reaches GAIP's engine. No customer data: no name, email address, postal address, phone number, IP address, payment detail or note. The app reads Shopify's order in memory, never stores or logs it (it keeps only the order id and number with the receipt link), and leaves those out of what it sends; GAIP refuses any order that carries one. Of a GAIP continuity handle on the order the app forwards only its id, never its secret token, and GAIP keeps only a keyed one-way hash of that id, for 90 days; a mandate is kept only as a keyed one-way hash; the merchant's link token is kept only as a keyed one-way hash and shown to the merchant once. An order number and a product link are facts about a shop's sale, not about a person; GAIP cannot tell who placed an order and does not try to. Dropping a token protects only what GAIP keeps: a whole handle in an order's attributes is already visible to the merchant, its staff, Shopify and other apps. Agents: put only your continuity id (the part before the first "."), never the token, in an order's attributes: the merchant, its staff, Shopify and other apps can see them. If your token was ever put on an order, retire the handle with gaip_retire_handle.

Who sees the receipt. The merchant, through the link the app stores and shows in its evidence log; anyone the merchant gives the link to; and an agent that identified itself on the order, by the receipt's code. GAIP sends nothing to anyone. The receipt is at /r/<code> and says: “GAIP's signed record of what the shop's public product pages showed when this order was received, read by GAIP at the stated time. Not a retailer's receipt, not proof of purchase, and not a statement about who is right.”

Retention. As for every receipt: 6 years from the capture, then digests and signature only. Switching the toggle off stops new captures at once; uninstalling the app deletes what the app holds and withdraws the shop's opt-in. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR): a dated record, kept by a non-party, of what a shop showed when an order was placed, for the shop and for the agent that bought. The data protection impact assessment addendum for it is in GAIP's repository (GAIP_DPIA_ORDER_CAPTURE_ADDENDUM_2026_10.md). Your choices: the merchant's toggle; a shop can ask for a capture to be reviewed through corrections and opt-out.

The compliance record (Shopify app)

This section follows the Legal desk's shopping record of 10 October 2026 (S4, S14) and founder decision #65.

When a merchant who installed GAIP's Shopify app consents to the compliance record and chooses products (within the plan's product cap), GAIP reads each chosen product page once a day on its own schedule, through the same outbound gate as every GAIP reader (robots.txt and opt-outs honoured, no sign-in, no cookies, no JavaScript run, Amazon, eBay and Etsy never read). It keeps, per product per day: the price, currency and availability the page's own structured data gave; where the page showed a struck-through price (an <s> or <del> element, a Shopify compare_at_price, or a 'was' or 'RRP' phrase), that value only; where the page showed a countdown or deadline, whether one was present, the end it stated when that could be read, and a hash of its text; and whether GAIP could read the page that day. No page copy and no text beyond those values is kept. The shop's domain and the product page addresses are kept as the merchant gave them; no customer, order or person is read or kept. The merchant's party token is kept only as a keyed hash under GAIP's signing key. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR) for the service the merchant asked for. Retention: readings for at most 400 days per product; withdrawing consent in the app, or uninstalling it, stops the reads the same day and the readings already made stay for the merchant's export under the same rule. Corrections and objections go through corrections and opt-out.

Every series and export says: GAIP's own daily readings of this shop's public product page, with the days it could not read. Not a statement that any price, saving or deadline was or was not lawful, usual or genuine.

Corrections and objections go through corrections and opt-out.

The act log (your agents' record)

Open to outside entries since 11 Oct 2026: GAIP's founder signed off the data protection impact assessment for the log (GAIP_DPIA_ACT_LOG_2026_10.md in GAIP's repository).

When an agent records an act in the act log (/acts; gaip_log_act or POST /v1/free/acts), GAIP keeps one signed, chained entry: a kind from a closed list (bought, booked, cancelled, subscribed, paid as declared, agreed, delivered, refused, told, asked, read, checked, revoked, notice matched), the time, the keyed hash (HMAC under GAIP's signing key) of the agent's continuity handle, a counterparty reference (another handle's hash, a public host name, or the keyed hash of a reference the agent gave), a subject hash and a content hash the agent computed, and optionally a mandate hash, an amount and currency as the agent declared them, what a public product page showed when GAIP read it once at the agent's request (values and hashes, never the page; never a cart, checkout or account page; never Amazon, eBay or Etsy; robots.txt honoured), and a cosigner's key id and signature as presented. No name, no address, no e-mail address, no account, and no plaintext of the act: GAIP never receives the content (the agent hashes it), and a submission that carries a content field or any field outside the schema is refused and nothing is kept. The subject and content hashes are the agent's own SHA-256, kept as given and shown with the entry: agents should hash the subject and the content with a random salt they keep, because anyone holding an entry's code could otherwise confirm a guessed short subject. A mandate hash is kept only as its keyed hash.

Personal data and lawful basis. The handle's keyed hash links entries to one person's agents, so an entry is pseudonymous personal data; GAIP is the controller of the log under legitimate interests (Article 6(1)(f) UK GDPR): a dated record, kept by a non-party, of what a person's agents did, promised and were told, for that person. GAIP is not a processor for the agent and not a party to the act: it does, pays, holds and promises nothing, and a declared amount or a counterparty reference is a fact of the submission, recorded as submitted. The ICO's list is met twice (innovative technology; data about a person obtained other than from them), so a data protection impact assessment was written before the first outside entry; its summary is on request through corrections, and GAIP welcomes views on it at agents@gaipagents.com (or through corrections). GAIP cannot write to a person it knows only as a keyed hash (Article 14(5)(e), with 14(7)): this section and the tool's description are the notice.

Who sees what. The handle's entries, with GAIP's earlier receipts for the same handle re-emitted as entries of their kind, are served only to the holder of that handle (GET /v1/free/acts/mine, a bearer handle sent as a request header, never in a URL, rate-limited, never by e-mail); so is the switch pack, GAIP's own signed export of those entries with its public keys, which answers the right to data portability (Article 20) for GAIP's own holdings and binds no other provider. The evidence export over an entry goes to the actor's handle or to the cosigner presenting its own signature, and to nobody else. One entry is public by its code: its hashes, page values and the handle's keyed hash, which is the same on every entry of that handle, so holders of several codes can link them; it names no handle in clear. Open data and the record card carry counts only.

Retention and erasure. As for every receipt: the entry's content is kept 6 years from the entry date, then only its digests, signatures and chain entry (the retention tombstone). The handle's keyed hash is kept for the life of the entry's content (six years), then dropped with it, rather than at 90 days as a Second Look receipt's is: the log is the person's own record, read and taken only by that handle. An entry is never deleted from the chain; on a decided request its handle link, its page values and every content digest are removed by the erasure tombstone, and its chain entry stays so the chain still verifies; the entry's code then answers that its content was erased, never the entry; a frozen monthly statement that listed the entry is rewritten without that line and says so; GAIP's count of entries per handle and the recall watch's rows for the handle are deleted on that request or when the handle is retired. Objections and disputes go through the corrections route; a dispute is appended, never a silent rewrite.

Every entry, answer, page and export says: “GAIP records that an agent submitted this entry at the stated time, and, where shown, what a public page showed when GAIP read it. GAIP did not witness the act and does not say it happened as described.”

The recall watch (for what you own)

The recall watch. When an agent records a BOUGHT entry in the act log with product identifiers and asks for the watch, GAIP keeps, bound to the keyed hash of its continuity handle, the keyed hash (HMAC under GAIP's signing key) of each identifier and bounded word tokens of the product's name as the page showed it. GAIP never keeps an identifier in clear, and without its signing key it keeps nothing. Once a day GAIP reads two public lists, the GOV.UK product safety alerts, reports and recalls (Open Government Licence v3) and the US CPSC recalls API (US government data), for notices published since its previous read, and where a notice's identifiers or words match, enters the notice's own title, date and link in the handle's act log. The EU Safety Gate is read only once its reuse terms have been read and recorded. The identifiers are not personal data; their link to a handle is the same pseudonymous link as the act log's, under the same impact assessment. The entries are served to the holder of the handle. The handle's watch rows are kept until an erasure request or the handle's retirement, which delete them; erasure is by the act log's erasure tombstone and deletion of the handle's watch rows; the corrections route applies.

Every answer and entry says: “GAIP's own daily match of regulators' published notices against the identifiers this handle registered, as of the stated time. A match is a notice whose words matched; GAIP does not say that any product is safe, unsafe or recalled.”

Why, and the lawful basis

To provide the free checks you request, keep the service secure and within fair-use limits, keep verifiable receipts and improve the service. The lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): running and securing a free public evidence service, balanced against minimal, non-identifying processing. For shop data, see online shops above. TODO(founder): record the legitimate interests assessment.

Sharing and transfers

GAIP does not sell personal data. Receipts and aggregate statistics may be published. These service providers process data on GAIP's behalf. What follows is read from each provider's own published terms on 10 October 2026; it is a description of those terms, not an assessment of them.

The Netherlands is in the European Economic Area, to which the UK allows transfers as if approved by adequacy regulations (Data Protection Act 2018, Schedule 21, paragraphs 4 and 5). For the providers in the United States, GAIP relies on the safeguard named against each; each link is where the provider publishes those terms.

Your rights

You may ask for access, rectification, erasure, restriction, objection or portability where UK GDPR gives you those rights. Because GAIP is designed not to hold identifying data, it may need information from you (such as a continuity handle or receipt ID) to find anything. Use the route in corrections and opt-out. You can complain to GAIP about how it uses personal data through the same route; GAIP acknowledges a data protection complaint within 30 days and tells you the outcome (section 164A Data Protection Act 2018). You can also complain to the regulator, the Information Commission (formerly the Information Commissioner, still known as the ICO; ico.org.uk). GAIP makes no solely automated decisions with legal or similarly significant effects on people.

Terms of use · Privacy notice · Corrections and opt-out · Methodology · Products