Legal
Privacy policy
What we collect, why we collect it, and what we deliberately do not collect.
Last updated: August 10, 2026
Controller
Who is responsible for your data
The data controller is ORIGO BYTE LTD, trading as VisionPrices, a company registered in England and Wales.
- Registered in: England and Wales
- Company number: 16948065
- Privacy contact: [email protected]
Which law applies
Why a UK law governs a US site
VisionPrices serves shoppers in the United States, but the company that runs it is registered in the United Kingdom.
UK data protection law applies to what a UK company does with personal data wherever in the world the person is. So it applies to your data even though you are in the US, and the UK Information Commissioner's Office is our regulator.
That works in your favor. You get a defined, enforceable set of rights over your data regardless of which state you live in, and we apply one standard to everyone.
Data collected
What we collect
You do not need an account to compare prices. If you browse the site and never sign up, we hold no personal data about you at all. Everything below applies only if you choose to create an account or to email us.
- Your email address: required for an account.
- Your password: stored only as a one-way hash. We never store, see or can recover the password itself. If you sign in with Google only, we store no password at all.
- A display name and avatar, if you set them.
- If you use Sign in with Google: your Google account identifier, the email address on that account, and the name and avatar picture you have set with Google. We never receive your Google password.
- The lenses, brands and stores you save, so they are there next time.
- Your email preferences.
- The time you last signed in, and when your account was created.
- A salted, one-way hash of your IP address, used only to rate-limit sign-up, sign-in and password-reset attempts. The address itself is never stored against your account, and the hash cannot be reversed back into an address.
- Anything you write in an email to us.
- Your cookie choice and when you made it, so we can honour it without asking again.
- If, and only if, you allow analytics: the pages you view and standard measurement data Google Analytics collects, which does not include your name, email or account.
Not collected
What we deliberately do not collect
This list matters as much as the one above, and most comparison sites could not publish it.
- We do not log which retailer links you click. A click-out passes straight through to the retailer. Commission, where it exists, is attributed by the affiliate network on the retailer's own side, not by anything we record about you.
- We run no advertising technology. No advertising pixels, no retargeting tags, no session replay, no tag manager, no advertising network of any kind. We build no advertising profile of you, because we have nothing to build one with and nobody to sell it to.
- We never see a prescription. We do not ask for one, store one, or verify one.
- We never see payment details. No card, no billing address, no order. None of it passes through us.
- We know nothing about your eyes. Not your prescription strength, not your eye health, not your vision. The site takes no clinical input at all.
Lawful bases
Why we use it
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and run your account | Email, password hash, name, avatar, Google account identifier | Contract |
| Save lenses, brands and stores for you | Your saved items | Contract |
| Send account emails: confirm your address, reset your password | Email address | Contract |
| Protect sign-up, sign-in and password reset from abuse | Hashed IP address, rate-limit counters | Legitimate interests: keeping accounts and the service secure |
| Answer a message you send us | Your message and contact details | Legitimate interests: responding to you |
| Send marketing email, if you have asked for it | Email address, your stated preference | Consent, which you can withdraw at any time |
| Measure which pages and comparisons get used | Google Analytics page views and measurement data | Consent, which you can withdraw at any time |
| Remember your cookie choice, so we honour it and stop asking | Your choice and when you made it, held in a cookie on your device | Legal obligation: a choice we did not act on would not be a choice |
| Meet legal, tax and accounting duties | Records required by law | Legal obligation |
Processors
Who else touches it
We use a small number of service providers to run the site. They act on our instructions, handle only what a specific feature needs, and cannot use your data for their own purposes.
- An email provider, to send account emails. Address confirmation and password reset are the only emails the site sends today.
- A hosting provider, which runs our servers.
- A security provider, which sits in front of the site and filters abuse.
- Google, in two separate cases: if you choose Sign in with Google, and (only with your consent) Google Analytics.
If you want to know exactly which companies these are, email [email protected] and we will tell you.
We do not sell personal data. We do not share it for advertising. We do not trade it, rent it, or hand it to data brokers.
We may disclose data where the law requires it, or to professional advisers under a duty of confidence.
Transfers and retention
Where it goes and how long we keep it
Some of our service providers process data outside the United Kingdom. The clearest case is Google Analytics, which sends the measurement data described above to Google in the United States, but only if you have allowed analytics. Where personal data leaves the UK, we rely on the safeguards UK law provides for such transfers. Email [email protected] if you want details of the safeguards that apply.
How long we keep things:
- Account data: for as long as your account exists. Closing your account deletes it, and everything attached to it (saved items, sign-in methods, preferences), straight away. Any remaining copies are removed within 30 days.
- Unverified sign-up and password-reset codes: unusable after 24 hours, and deleted within 30 days.
- Rate-limit counters: expire automatically within an hour of the last attempt.
- Messages you send us: kept while we deal with your enquiry and for a reasonable period afterwards.
- Analytics data, if you allowed it: held by Google Analytics for 2 months, its shortest retention setting, after which Google deletes the user-level records.
- Your cookie choice: 6 months on your device, after which we ask again. Withdrawing deletes it sooner.
- Records we must keep by law: for the period the law requires.
Your rights
Your rights
You can ask us to:
- give you a copy of the data we hold about you;
- correct it if it is wrong;
- delete it;
- restrict or stop a particular use;
- send it to you or to another provider in a portable format;
- withdraw your consent, where we relied on consent.
Email [email protected]. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk: that is the regulator for the company behind this site, whichever country you are in. If you are in the US, you may also raise a concern with your state Attorney General.
California and other states
US state privacy laws
Comprehensive state privacy laws, including the California Consumer Privacy Act, apply to businesses above set revenue and data-volume thresholds. VisionPrices is below all of them, so those laws do not currently apply to us, and we are not a "business" as the CCPA defines one.
We have chosen to offer the rights described above to everyone regardless of where you live.
And to be unambiguous about the two things those laws exist to police: we do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is no advertising technology on this site to share it with.
If that ever changes, this page changes before the technology ships, not after.
Children
Children
VisionPrices is meant for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 13.
Contact lenses are prescribed to under-18s, so a younger reader may well land here. Nothing on this site requires an account, and comparing prices needs no personal data at all.
If you believe a child has given us personal data, email [email protected] and we will delete it.
Updates
Changes to this policy
We will update this page when our services, our suppliers or our legal obligations change, and we will change the "Last updated" date at the top when we do.
Questions: [email protected].