If they were scraping the information/pictures off the supermarket sites, then I'd have expected the cease and desist to come from the supermarkets.
Given that the letter came from "a company" then I presume they were taking their information from an aggregator - and seems entirely fair that you should "pay the aggregator" (as there's clearly a company out there doing something similar to what they're doing - but they were taking their data).
If this company was just a data-hose, then I'd have thought you could monetize your consumer-focussed product, simply by flogging anonymized data from your users back to the supermarkets. "Customer X, dropped product Y from their weekly basket (or swapped supermarket), when you raised the price of Z (or other supermarket dropped it)"