Privacy Policy

Who we are

Goose is run by Get Goose Ltd [company number …, registered office …], the controller of your personal data. ICO registration number: [ZA…]. If you have any questions or requests about your data, email hello@getgoose.co.uk.

What we collect, why, and our legal basis

• Your account — your email address, and either a password (stored only as a one-way hash) or, if you sign in with Google, your Google account ID, name and email. You can add your name and address in Account settings. Legal basis: contract.
• Your bills — the services you tell us about (provider, monthly cost, speed or plan, energy usage), household size, student status, postcode and contract end dates. We use them to find cheaper options. If you're signed in, your comparisons are saved to your account; if you're not, nothing is stored. Legal basis: contract.
• Bill and statement uploads — if you upload a bill or a bank or card statement, we send the file to our AI provider, Anthropic, to read it. Goose never stores the file. We keep only the details you choose to use, and for a mobile number only the last three digits ("SIM ending 123"). A statement can show other transactions, so you may want to crop it first. Legal basis: contract.
• Postcode — used to show providers that serve your area. To check which broadband speeds and mobile coverage are available at your postcode we send your postcode (and nothing else) to Ofcom's coverage service. We keep a summary for that postcode (how many addresses have each speed tier, no addresses or names) for up to 28 days so repeat lookups are quick, then it is deleted. Legal basis: contract.
• How much mobile data you use — only if you tell us, or your uploaded bill states it (we keep the figure, never the file). It is used to tell you if a smaller plan would fit, and only after three months of figures. Legal basis: consent.
• Alerts and reminders — only if you switch them on (see below). Legal basis: consent.
• "Email me my plan" — your email address and a summary of your results. Legal basis: contract.
• Security and fair use — to prevent abuse of our AI features we record each bill read or payment look-up against your account, or against a keyed, irreversible hash of your IP address (never the address itself), and delete these records after 30 days. Our server logs don't record IP addresses or sign-in tokens. Legal basis: legitimate interests.

We don't use analytics or advertising tools, and we don't sell your data.

Deal alerts and reminders

If you opt in to alerts, we check once a month by re-running your most recent saved comparison against current prices, and email you when a deal at least £5 a month cheaper is available for a service you've switched on. If you've told us when a contract ends, we also send reminders about 30 days and 7 days before it ends. This is a separate, explicit opt-in — it is not assumed from providing your email address.

• Legal basis: consent (you actively enable alerts with the toggles on the Alerts tab of your dashboard)
• We record the date and time you consented
• Every alert email includes a one-click unsubscribe link — clicking it immediately disables alerts for that service with no login required
• You can also turn alerts off at any time from the Alerts tab of your dashboard

AI processing

Anthropic processes uploaded bills and statements and payment look-ups for us. The summary at the top of your results is written by our own software from your results, not by an AI provider. Under Anthropic's commercial terms, inputs and outputs are deleted within 30 days (kept for up to 2 years only if flagged by its safety systems) and are not used to train its models.

Who processes your data for us

• Railway (railway.com) — hosting and database, USA
• Vercel (vercel.com) — website hosting
• Anthropic (anthropic.com) — AI reading of bills and statements, USA
• Resend (resend.com) — email delivery, USA

These providers process data only on our instructions. Google (if you sign in with Google) and Ofcom (coverage lookups) receive only what's described above and handle it under their own terms. When data is processed outside the UK we rely on [the UK International Data Transfer Addendum / the UK Extension to the EU–US Data Privacy Framework — to be confirmed for each provider].

How long we keep it

• Your account and saved comparisons: until you delete your account. After you ask, you have 14 days to change your mind by signing back in; then your account and everything linked to it — saved comparisons, alerts, contracts, goals and switches — is permanently deleted.
• "Email me my plan": 2 years from your last request.
• Waiting list: until we contact you or you ask us to remove you.
• Security records (AI usage limits): 30 days.
• Ofcom coverage summaries for a postcode (counts only, not linked to you): up to 28 days.
• Your monthly data-use figures: until you delete your account (you can delete a figure at any time).
• Server logs: 7 days. Email delivery records at Resend: 30 days.

Affiliate relationships

When you click Switch now or Go to deal links, we may earn a referral commission from the provider. This never affects which deals we show or in what order — the cheapest option is always shown first.

Your rights

You can access, correct or delete your data, restrict or object to how we use it, get a copy in a portable format, and withdraw consent (on the Alerts tab, or with the unsubscribe link in any alert email). You can delete your account yourself in Account settings; for anything else, email hello@getgoose.co.uk and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Cookies and browser storage

We use one cookie, goose_oauth_nonce, only while you sign in with Google: it lasts 10 minutes and protects the sign-in. When you're signed in, your browser stores a sign-in token (goose_auth), which is removed when you sign out and is valid for up to 30 days. Both are strictly necessary, so we don't ask for consent. We don't use analytics or advertising cookies. If you follow a link to a provider, that site may set its own cookies.

Automated recommendations

Our comparisons are automated calculations to help you choose. They have no legal or similarly significant effect, and the decision to switch is always yours.

Security

We use encrypted connections (HTTPS), store passwords only as one-way hashes, never put sign-in tokens in web addresses, and limit access to data to the people who need it.

Children

Goose is for adults managing household bills.

Changes

We may update this policy from time to time. The date at the top of this page will always reflect the most recent version.