How it works
Benefits
Trust
Stay informed
Welcome to Identifyi Limited's privacy policy.
We own and operate online data storage platform ("Platform") which can be accessed via a mobile application.
Genie Vault is a digital personal data storage platform that helps people take control of their shopping data and turn it into something useful for them. We operate Genie Vault to securely store, process, and help you use that data according to your instructions. You are in full control of your data and you determine who may access your data, and when the data is erased from Genie Vault.
Genie Vault works like a personal data vault for your shopping history. It allows you to collect and manage information about what you buy, where you buy it, and how much you pay — for example through scanned paper receipts, forwarded electronic receipts, or direct connections with participating retailers.
To help you make sense of this data, Genie Vault uses an AI-powered assistant ("Genie"). Genie helps you organise your data, understand your spending, and access practical benefits based on the information stored in your Vault.
Data is typically inputted into Genie Vault and accessible through mobile applications operated by our retail or loyalty programme partners, where Genie Vault is made available as an embedded feature. You always choose whether to create a Genie Vault, what data you add to it, and whether you want to share any part of your data with a specific partner for a clearly defined purpose.
We do not sell your personal data. Any sharing of data with third parties happens only when you actively decide to do so, for example to receive personalised benefits, insights, or offers from a retailer you trust.
We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we process when you use Genie Vault, why we process it, how we keep it secure, and what rights you have in relation to your data.
Identifyi Limited, a company incorporated in England and Wales under company number 16017432 whose registered office address is at 25 Cabot Square, Canary Wharf, London, United Kingdom, E14 4QZ is the controller and responsible for your personal data (collectively referred to as "Identifyi", "we", "us" or "our" in this privacy policy).
If you have any questions about this privacy policy, please contact us using the details set out below.
Full name of legal entity: Identifyi Limited
Email address: contact@genievault.com
Postal address: 25 Cabot Square, Canary Wharf, E14 4QZ London, United Kingdom
UK's Information Commissioner's Office Registration Number ZC094325
You will always have the right to lodge a complaint with a supervisory body. The relevant authority in the UK (where we are based) is the Information Commissioner's Office (www.ico.org.uk). If you do have a complaint, we would appreciate the chance to deal with your concerns before you approach the ICO, so please do contact us in the first instance, if possible, at the email address above. If you are based in another jurisdiction, you may have additional rights or ability to refer matters to an alternative supervisory body.
We keep our privacy policy under regular review and reserve the right to update this privacy policy from time to time. This privacy policy was last updated on 18 February 2026. Please check our privacy notice posted on the Platform for the latest version.
Our Platform may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Platform, we encourage you to read the privacy policy of every website you visit.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
Depending on how you use Genie Vault, we may collect and process the following categories of personal data.
This includes information you provide when creating or using your Genie Vault account, such as:
This includes information used to communicate with you, such as:
When you access Genie Vault through a mobile application or other interfaces, we may collect technical information, such as:
If you choose to add shopping data to your Genie Vault by scanning paper receipts, uploading or forwarding digital receipts, or connecting supported retailers or services, we may process purchasing data contained in those receipts or purchase confirmations.
Purchasing data may include, where available:
We process purchasing data solely to provide the Genie Vault service to you and according to the choices you make within the app. You decide whether and how this data is added to your Vault.
Based on the data stored in your Genie Vault, we may generate insights or summaries for your personal use, such as:
These insights are derived from your data and do not introduce new personal data from external sources. This aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
If you choose to share parts of your Genie Vault data with a specific retail or loyalty partner, we may process information related to that interaction, such as:
If you contact us for support or provide feedback, we may process:
We do not intentionally collect special category data under data protection laws. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health information or genetic and biometric data. However, some purchasing data you choose to upload (for example, from certain types of retailers) may indirectly reveal sensitive information. We do not require you to provide such data, and you remain in control of what information is added to your Genie Vault.
We do not knowingly collect data relating to children under 13 years old, special category data or information relating to criminal convictions.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. You can do this by logging into your account on our Platform and updating certain information or contacting us directly to update on your behalf.
Where we need to collect personal data by law or contractual terms, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.
We collect personal data in a limited number of clearly defined ways, all of which are connected to your decision to use Genie Vault and the choices you make within the service. The main way we will collect your personal data is through your direct interactions with us, but we will also collect data through automated technologies and third parties or other publicly available sources.
You provide certain personal data directly when you:
This typically includes account, identification, contact information, and purchasing data and any related information contained in those materials. You can decide whether to add, remove, or stop adding such data at any time.
Genie Vault is often accessed through applications operated by retail or loyalty programme partners. If you choose to create a Genie Vault through such an application, and you give your explicit consent, the partner may share certain personal data with us to enable your account and the proper functioning of the service.
This data may include, where applicable:
Partners only share this data with us based on your instructions and in accordance with their own privacy policies.
When you use Genie Vault through a mobile application or other interfaces, certain technical data is collected automatically to ensure the service works securely and reliably. This includes:
This data is used only for technical, security, and performance purposes and not to collect information unrelated to your use of Genie Vault.
We do not collect personal data about you from third-party sources unless you have chosen to connect or authorise such a source within Genie Vault.
We do not intentionally collect personal data that you have not provided, authorised, or chosen to store in your Genie Vault. If, in limited circumstances, additional data is processed to comply with legal obligations or to protect the security and integrity of the service, we will do so in accordance with applicable data protection laws.
Genie Vault is a data-driven service. Processing your personal data is necessary for us to operate Genie Vault and to provide you with the services you choose to use. We will only use your personal data when the law allows us to. This includes UK data protection rules (under the UK GDPR and Data Protection Act 2018) and other applicable laws in countries where we collect and process information.
We will not collect and use your personal data without letting you know. The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:
We process your personal data only for clearly defined purposes as described below. We will not process personal data in a way that is incompatible with the purposes for which it has been collected or subsequently authorised by you. We also will not collect any personal data that is not needed for the mentioned purposes. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful basis we are relying on to process your personal data, where more than one lawful basis has been set out in the list below.
We process your Account and Identification Data, Contact and Communication Data, and Purchasing Data to enable you to create, use, and manage your Genie Vault. This includes:
Legal basis: Performance of a contract (the Genie Vault Terms of Service or Genie Vault Terms of Use for Beta Testers).
Without this processing, we would not be able to provide the Genie Vault service to you.
We process Account and Identification Data, Contact and Communication Data, Purchasing Data, and Insights and Derived Data stored in your Genie Vault to generate insights, summaries, and other outputs designed to help you better understand and benefit from your data. This may include:
These outputs are generated based on the data you have chosen to store in your Vault and are intended to provide you with practical value.
Legal basis: Performance of a contract; Legitimate interests (providing value-added features that form part of the service you expect to receive).
Where Genie Vault is made available through a retail or loyalty partner, or where you choose to connect any further retail or loyalty partners to your existing Genie Vault, you will receive offers, benefits, or information from that partner based on data derived from your Genie Vault.
In such cases, we process Account and Identification Data, Contact and Communication Data, and Purchasing Data to:
We do not independently decide which offers you receive. Partner-related content is delivered only where you have connected your Genie Vault to the relevant partner application.
In this context:
Legal basis: Legitimate interests (to develop and grow our business by enabling our partners to provide offers, benefits, and information to you).
We process Device and Technical Data to:
Legal basis: Legitimate interests; Legal obligation (where applicable).
We process certain Account and Identification Data, Contact and Communication Data, and Support and Feedback Data to:
Legal basis: Performance of a contract with you, Necessary to comply with a legal obligation, Necessary for our legitimate interests (to keep our records updated and to study how customers use our platform, and services displayed to enable us to develop our relationships and grow our business)
We process certain Account and Identification Data, Contact and Communication Data, and Purchasing Data to improve our platform, services, customer relationships and experiences.
Legal basis: Necessary for our legitimate interests (to keep our platform updated and relevant, to develop our business).
We do not use your personal data for independent advertising networks, data brokerage, or the sale of personal data. Any partner-related offers, benefits, or messages are delivered as part of the Genie Vault service and only in accordance with your choices and the permissions you have given.
You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving the marketing. We will process your Account and Identification Data, Contact and Communication Data and Purchasing Data to form a view on what we think you may want or need or what may be of interest to you.
We do not share your personal data with unrelated third parties, which are not partners with whom you have chosen to connect your Genie Vault, for their own marketing purposes, and we do not sell personal data.
You can ask us to stop sending you marketing messages at any time by contacting us at any time. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of use of the Platform, you will still receive service-related communications that are essential for administrative or customer service purposes.
If you no longer wish to receive partner-related offers or communications, you can simply do so by disconnecting your Genie Vault from the relevant partner application. Once the connection is removed, partner-related delivery will stop for that partner.
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see https://ico.org.uk/for-the-public/online/cookies/.
We may require sharing your personal data with the parties set out below for the purposes set out in section 4 above:
| Recipient | What data is shared | Purpose of sharing | Legal basis |
|---|---|---|---|
| Retail and loyalty partners | Structured information and insights derived from your Genie Vault data, limited to the scope required to deliver partner-related features | To enable partners to deliver features, benefits, or services to you as part of the application through which you access Genie Vault | Performance of a contract; Legitimate interests; Consent (where required) |
| Cloud hosting and infrastructure providers | Personal data stored in Genie Vault, including purchasing and account data | To securely host, store, and protect the Genie Vault platform and its data | Performance of a contract; Legitimate interests |
| Data processing and analytics providers | Data processed within controlled environments, including derived and aggregated data | To support data processing, computing, analytics, and AI-assisted features within Genie Vault | Performance of a contract; Legitimate interests |
| Payment and financial service providers | Transaction-related identifiers and billing information (where applicable) | To process payments, manage billing, or handle financial transactions related to the service | Performance of a contract; Legal obligation |
| Professional advisers | Relevant personal data, where necessary | To obtain legal, accounting, auditing, or professional advice | Legitimate interests |
| Public authorities and regulators | Personal data required by law | To comply with legal obligations, regulatory requirements, or lawful requests | Legal obligation |
| Corporate partners | Relevant personal data collected in accordance with this privacy notice. | To share personal data with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice. | Legitimate interests |
Retail and loyalty partners do not receive direct access to your Genie Vault. They only receive specific information derived from your data, structured and limited to support the features or services delivered through their application. Genie Vault remains under your control, and partners cannot access the full contents of your Vault.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
As we provide an online service through our Platform and Site, we may (a) need to transfer your personal data outside the United Kingdom or European Economic Area (EEA) to enable us to provide our Services or (b) receive your data from outside the United Kingdom or EEA.
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
Protecting the security of your personal data is a core part of how Genie Vault is designed and operated. Genie Vault is built to function as a personal data vault, where access to data is strictly controlled and limited. We know that it is incredibly important to protect and manage personal data appropriately, but unfortunately the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted online or through the Platform.
We have put in place appropriate security measures, as set out below, to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Access to Genie Vault is protected through secure authentication mechanisms. Each Genie Vault is logically separated, and users can only access their own Vault. No user can access another user's Vault.
Personal data stored in Genie Vault is protected using industry-standard security measures, including strong access controls and cryptographic protections. Access credentials and identifiers are securely managed and not stored in plain text.
Personal data stored in Genie Vault is hosted within secure cloud environments that follow recognised security standards. We use technical and organisational measures designed to protect data against unauthorised access, loss, misuse, or alteration.
These measures include, where appropriate:
Where personal data is processed by trusted third-party service providers (such as cloud hosting, data processing, or AI service providers), we ensure that:
Third parties are required to implement security measures consistent with the level of protection described in this Privacy Policy.
We regularly review and update our security practices to reflect technological developments, evolving risks, and regulatory requirements. While no system can guarantee absolute security, Genie Vault is designed to minimise risk and to respond promptly to potential security incidents.
If a personal data breach were to occur that poses a risk to your rights or freedoms, we will notify you and relevant authorities where required by law.
As a general rule, we will retain your personal data as long as you are a registered user of our Platform, and for a short period after your use of our Platform ends, as set out below. It is your responsibility to ensure all information held on our Platform is retained by you prior to ending your use of our Platform. If you are participating in a trial, we will retain your personal data for as long as necessary for the purposes for which we collected it, i.e. research and development in relation to improving our Platform and Services.
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may keep your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances you can ask us to delete your data.
While your Genie Vault account is active, we retain your personal data for the purpose of operating your Vault and delivering the services you have chosen to use. This includes the data you add to your Vault and any information required to maintain and secure the service.
Your data remains stored only for as long as you maintain an active Genie Vault account.
If you decide to close your Genie Vault account, we will stop processing your personal data for service purposes.
Following account closure, we retain your personal data only to the extent and for the period necessary to:
We do not retain personal data for longer than necessary, and we apply data minimisation principles during any such retention period.
After account closure, we may retain your data for a limited grace period of up to six (6) months to allow you to reactivate your account if you choose to return.
If you do not reactivate your account within this period, your personal data will be permanently deleted and your Genie Vault cannot be restored.
Genie Vault is not designed to retain or anonymise user data after an account has been closed.
Once the applicable retention and grace periods have ended, personal data relating to a closed Genie Vault is deleted rather than anonymised. We do not keep personal data for analytical, profiling, or historical purposes after account closure.
We may retain limited information where required by law, for example for accounting or compliance purposes, but such data will be retained only for the minimum period required and will not be used to recreate or re-identify a Genie Vault.
The legal rights you have will depend on the country in which you access our Platform and receive the Services. The rights detailed below apply to UK and EU data subjects. Where you are based out with the UK, you may have different or additional rights in respect of your personal data. If this is the case, please contact us and we will confirm any additional rights which may apply.
Under the applicable UK and EU data protection legislation, data subjects have certain rights in relation to your personal data. We have set these out in the below:
| Right | What this means | How this works in Genie Vault |
|---|---|---|
| Right of access | You have the right to access the personal data we hold about you and to check that we are lawfully processing it. | Genie Vault is designed to give you direct access to the personal data stored in your Vault at all times. You can view and manage your data directly within the service. If you require access to additional processed or derived information not directly visible in the interface, you may contact us. |
| Right to rectification | You have the right to request correction of inaccurate or incomplete personal data. | You can update or correct certain account information directly within Genie Vault. Purchasing data added from receipts reflects the source documents you provide. If you believe any data is inaccurate due to processing errors, you may contact us. |
| Right to erasure ("right to be forgotten") | You have the right to request deletion of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. | You can exercise this right by closing your Genie Vault account. Following account closure and the applicable retention and grace periods, your personal data will be deleted without the need for a separate request. |
| Right to restrict processing | You have the right to request that we limit the processing of your personal data. | Because Genie Vault processing is integral to providing the service, restricting processing may not be possible without closing your account. You may contact us to discuss specific circumstances. |
| Right to object | You have the right to object to processing based on legitimate interests, including processing related to service-delivered offers. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object. You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes. | Genie Vault processes data to operate your Vault and deliver the service. If you object to such processing, this will generally require closing your Genie Vault account, as we cannot provide the service without processing your data. |
| Right to data portability | You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. | You may request a copy of your personal data held in your Genie Vault. Where technically feasible, we will provide this data in a commonly used format. |
| Right to withdraw consent | You have the right to withdraw consent where processing is based on consent. | Where specific processing relies on consent, you can withdraw that consent through the relevant service or account settings. In some cases, withdrawal of consent may require disconnecting your Genie Vault from a partner application or closing your account. |
| Right to lodge a complaint | You have the right to complain to a data protection authority. | You may lodge a complaint with your local data protection authority if you believe your rights have been infringed. We encourage you to contact us first so we can address your concerns. |
If you wish to exercise any of the rights set out above, please contact us on the details above.
Genie Vault is designed so that your rights are exercised through the way the service works, giving you direct control over your personal data rather than relying on manual requests.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.