Privacy policy

Last updated 1 November 2026

Repeat Shopping ("Repeat") is a service operated by Klolabs. Klolabs is the trading name of Christian Tamakloe, a sole trader based in England, United Kingdom, who is responsible for the personal data described in this policy. For privacy questions or requests, contact support@repeatshopping.com.

We don't sell your data, show advertising, or use tracking or analytics cookies.

What we keep

• Your account: your name, email address and password (stored only as a one-way hash), the spaces you belong to and whether you own them.
• What you put in a space: items and their usual amounts, shopping lists, what's ticked off, meals, groups and plans, and who made each change.
• Purchases you add: receipt photos, screenshots of online orders, PDFs and emails you forward to your space, and what is read from them: shops, dates, products, quantities, prices and order references. Emails and PDFs can contain a delivery address and part of a card number.
• Lists you import: the photos or text you give the importer, while it reads them.
• Invitations: the email address of someone you invite, and whether they joined.
• Sign-in: a record of each signed-in session with its IP address and browser, and a cookie that keeps you signed in.
• Connected assistants: which assistants (such as ChatGPT or Claude) you connect, the spaces you let each one use, its access tokens, and a record of the changes it asks for, so a repeated request isn't made twice.
• Server logs: the time, address and result of requests, with IP addresses, for security and fixing problems.

Why we use it

• To provide Repeat: keep your lists, share them with your space, read the purchases and lists you add, and let assistants you connect work with your space. This is necessary to perform our agreement with you (the terms).
• To send emails you ask for or need: invitations and password resets.
• To keep Repeat secure and working, and to answer you when you contact us. These are our legitimate interests.

We don't use your data to build advertising profiles, and we don't train AI models on it. The AI that reads what you add is Anthropic's, under the terms below. Assistants you connect, such as ChatGPT or Claude, are separate: their providers' own policies cover what you share with them.

Who else sees it

• People in your space see and can change what's in it, including purchases added there, and each other's names and email addresses.
• Assistants you connect receive what you ask them about, from the spaces you let them use. What happens to it there is covered by that assistant's own privacy policy. You can disconnect one at any time.
• Service providers who process data for us under contract and only on our instructions:
  • Hetzner Online (servers, in the European Union) and Hatchbox (manages the servers).
  • Anthropic (United States), whose AI reads the receipts, screenshots, PDFs, emails and lists you add. Under Anthropic's commercial terms it doesn't train its models on this data.
  • Postmark (United States), which sends our emails and receives the emails you forward.
• Authorities, if the law requires it.

When data goes to a provider outside the UK, it is protected as UK data protection law requires, through the UK's adequacy regulations or the providers' data transfer agreements.

How long we keep it

• Receipt photos and screenshots are deleted 90 days after they're added, whether or not the purchase was finished, unless your space's owner chooses to keep them in Space settings. One still being read then is deleted once the reading ends. You can delete a photo sooner yourself.
• PDFs and the text of forwarded emails are deleted a week after they're read, whatever that setting says. If a purchase read from one is waiting for someone to check it, or it couldn't be read and may be tried again, it's kept until then, and never more than 90 days.
• Lists you import are deleted within 3 days.
• An assistant's record of the changes it asked for is kept for 7 days; its tokens go a week after they expire or you disconnect it.
• Your account is kept until you ask us to delete it. Content in shared spaces, including what was read from purchases, remains available to their members until it is deleted from those spaces, subject to applicable data protection rights and retention requirements.
• A space is shared, so what you added to one stays for its other members when you leave it or delete your account.

Your choices and rights

• Change your name in Account settings; reset your password from the sign-in page.
• Delete lists, items, meals and groups in Repeat. Leave a space in Space settings; owners can remove members.
• See and disconnect assistants in Account settings, under Connected apps.
• To delete your account, or for a copy of your data, email support@repeatshopping.com. We'll respond within one month and explain how we'll handle your request, including anything we have to keep.

Under UK data protection law you can ask to see, correct or delete your data, to receive a copy of it, and to object to or restrict how we use it. If you're unhappy with how we handle it, tell us first; you can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies

Repeat uses only the cookies it needs to work: one that keeps you signed in, and one that protects forms. There are no analytics, advertising or third-party cookies.

Children

Repeat is for people aged 16 and over. If you think a younger child has an account, email us and we'll delete it.

Changes

If this policy changes, the new version will be here with a new date. We'll email you about changes that matter.