Privacy Policy

FlyHandled Ltd. ([Legal form, e.g. private limited company]), [Registered office address], [Company register and registration number], is the controller of personal data processed through FlyHandled. Contact our privacy team at privacy@flyhandled.example or our Data Protection Officer at dpo@flyhandled.example.

Representatives: [EU representative under Art. 27 GDPR, if required]; [UK representative under Art. 27 UK GDPR, if required].

To check a flight you enter a flight number and a date. We look the flight up with our flight-data provider and show what the rules may say. You don't need an account, and we don't ask who you are.

• What we process: the flight number and date you enter, the flight's public schedule and status, and the result shown to you.
• Technical data: IP address, device and browser type and request logs, used to run and secure the Service and kept for up to 30 days.
• If you save the flight, it is stored on your device. It is linked to you only if you create an account or sign in.

Legal basis: taking the steps you ask for before any contract, and our legitimate interest in answering your request and keeping the Service secure (Art. 6(1)(b) and (f) GDPR).

• Account data: name, email address, how you sign in (email code or password), language, country and preferences. Passwords are stored only as one-way hashes.
• Trips: flight numbers, dates, routes, airlines and booking references you add, and the status we fetch for them.
• Alerts: if you turn on phone alerts, a push subscription for this device; if you turn on email alerts, your email address.
• Payment data for plans: our payment provider processes your card. We receive only a reference, the amount, the card brand and the last four digits.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

A claim needs much more than a check. We collect it only when you start a claim, and only what the airline, the rules or a court require:

• Identity: full names of every passenger on the claim and, where an airline or court asks for it, a copy of an identity document.
• Booking: booking reference, e-ticket or booking confirmation, boarding passes, and what happened on the day.
• Payment details: the bank account (IBAN) where you want the money paid, and the account holder's name.
• Signature: your signature on the claim authorisation (mandate), with the date, time and the version you signed.
• Co-travellers: names and, where needed, contact details of the people on your booking you claim for. You confirm you're allowed to act for them; for a child, you must be their parent or legal guardian.
• Evidence and correspondence: receipts, photos, baggage reports and every message exchanged with the airline about the claim.
• Consent and audit records: which permissions you gave, when, the document versions, and a log of everything sent in your name.

Legal basis: performance of our contract with you to handle the claim (Art. 6(1)(b)); for co-travellers, our legitimate interest in pursuing the claim you asked us to bring for them (Art. 6(1)(f)); and compliance with tax and accounting obligations (Art. 6(1)(c)).

When FlyHandled Protect handles a claim, you sign a claim authorisation (mandate). It allows us to contact the airline in your name, submit and follow up the claim, negotiate and accept a settlement within what you agreed, receive the payment for you, deduct the fee shown to you before you signed, and pay you the rest.

If a claim can only move forward in court, we will tell you before anything happens and explain the cost; independent, licensed counsel would act in that case. Nothing is filed in court without you being told first. The exact wording is in the Claim Authorisation, and you can withdraw it as it describes.

• The airline (and its agents or insurers) that the claim is against: only the claim file needed for that claim.
• Service providers that process data for us under contract: hosting, databases, email delivery, flight data (which receives flight numbers and dates, not who you are) and payment processing.
• Independent counsel, courts and enforcement bodies: only if a claim is escalated, and after you have been told.
• National enforcement bodies or dispute resolution schemes, where you ask us to complain to them.
• Authorities, where the law requires it, and professional advisers bound by confidentiality.
• Meta (Instagram, Facebook): only as described in section 7.

We do not sell your personal data.

We advertise on Instagram and Facebook. When you see or tap one of our ads there, Meta processes your data as its own controller under its own policy.

Today the FlyHandled app and website load no advertising pixels or advertising cookies. If we add ad measurement (for example the Meta Pixel or Conversions API), it will stay off until you allow marketing cookies in the cookie banner or Settings, and you can refuse or withdraw that at any time with the same switch. We would never send Meta your claim data, documents or bank details.

You can object to any use of your data for marketing at any time, free of charge, by writing to us or using the unsubscribe link in a marketing email.

• The free check and the Service you ask for: steps before a contract and performance of a contract (Art. 6(1)(b)).
• Handling a claim under your mandate: performance of a contract (Art. 6(1)(b)).
• Security, fraud prevention and establishing or defending legal claims: legitimate interests (Art. 6(1)(f)).
• Accounting and tax records: legal obligation (Art. 6(1)(c)).
• Analytics, marketing cookies and marketing messages: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Eligibility estimates are automated guidance. They do not produce legal effects about you, and you can always ask a person to review your case.

Some providers process data outside the European Economic Area or the United Kingdom. When they do, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards.

• Free checks: the result isn't stored against you; server logs are kept for up to 30 days.
• Account and trips: while your account is open, and up to 30 days after you delete it.
• Claim files, the mandate and correspondence: up to 6 years after a claim closes, to cover legal limitation periods.
• Identity documents: deleted 90 days after a claim closes, unless needed for ongoing proceedings.
• Bank details: deleted once the payout is made and the claim is closed, except what accounting law requires us to keep.
• Payment and accounting records: as long as tax law requires, usually up to 10 years.
• Analytics data (with consent): up to 14 months.

Under the GDPR and UK GDPR you can access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting what happened before. You can object at any time to marketing.

You can complain to the data protection authority where you live or work, in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP); in the UK, the Information Commissioner's Office.

To use your rights, open Settings to download your data or delete your account, or write to privacy@flyhandled.example. We answer within one month and may need to confirm your identity first.

We protect data with encryption in transit, access controls and the principle of least privilege. Identity documents and bank details are only accessible to what is needed to handle your claim. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

You must be at least 18 to use FlyHandled. We process children's data only when a parent or guardian includes them as passengers on a trip or claim.

FlyHandled gives general information about passenger rights and handles claims under your mandate. It is not legal advice, not a law firm, and not insurance. Compensation is never guaranteed.

We only look for flight bookings you allow. We don't read the rest of the mailbox.

• Nothing happens until you tap Connect in the app and agree on Google's own screen. Signing in with an email address never lets us read that mailbox.
• We ask Google for read-only access to Gmail. We search only emails sent by airlines and booking sites on a fixed list, from the last 3 years, and take out flight numbers, dates and booking codes.
• It is one search, at the moment you connect. We give the access back to Google straight after and keep no access token. We don't store your emails or anything else from the mailbox.
• The flights found are shown to you for a few minutes. They are saved to your trips only if you choose to add them.
• We never sell mailbox data and never use it for advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give on Google's screen and can withdraw at any time in your Google Account. Pasting a booking email instead works on your device and is not sent to us.

We will tell you about material changes to this policy. Each version is dated and numbered, and the version you acknowledged is recorded.

FlyHandled Ltd. · [Registered office address] · privacy@flyhandled.example