Privacy Policy

[Legal name of the operating company] ([Legal form, e.g. private limited company]), [Registered office address], [Company register and registration number], is the controller of personal data processed through FlyHandled. Contact our privacy team at privacy@flyhandled.example or our Data Protection Officer at dpo@flyhandled.example.

Representatives: [EU representative under Art. 27 GDPR, if required]; [UK representative under Art. 27 UK GDPR, if required].

To check a flight you enter a flight number and a date. We look the flight up with our flight-data provider and show what the rules may say. You don't need an account, and we don't ask who you are.

• What we process: the flight number and date you enter, the flight's public schedule and status, and the result shown to you.
• Technical data: IP address, device and browser type and request logs, used to run and secure the Service and kept for up to 30 days.
• If you save the flight, it is stored on your device. It is linked to you only if you create an account or sign in.

Legal basis: taking the steps you ask for before any contract, and our legitimate interest in answering your request and keeping the Service secure (Art. 6(1)(b) and (f) GDPR).

• Account data: name, email address, how you sign in (email code or password), language, country and preferences. Passwords are stored only as one-way hashes.
• Trips: flight numbers, dates, routes, airlines and booking references you add, and the status we fetch for them.
• Alerts: if you turn on phone alerts, a push subscription for this device; if you turn on email alerts, your email address.
• Payment data for plans: our payment provider processes your card. We receive only a reference, the amount, the card brand and the last four digits.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

A claim needs much more than a check. We collect it only when you start a claim, and only what the airline or the rules require:

• Identity: full names of every passenger on the claim and, where an airline asks for it, a copy of an identity document.
• Booking: booking reference, e-ticket or booking confirmation, boarding passes, and what happened on the day.
• Payment details: the bank account (IBAN) where you want the money paid, and the account holder's name.
• Signature: your signature on the claim authorisation (mandate), with the date, time and the version you signed.
• Co-travellers: names and, where needed, contact details of the people on your booking you claim for. You confirm you're allowed to act for them; for a child, you must be their parent or legal guardian.
• Evidence and correspondence: receipts, photos, baggage reports and every message exchanged with the airline about the claim.
• Consent and audit records: which permissions you gave, when, the document versions, and a log of the letters prepared.

Legal basis: performance of our contract with you to handle the claim (Art. 6(1)(b)); for co-travellers, our legitimate interest in pursuing the claim you asked us to bring for them (Art. 6(1)(f)); and compliance with tax and accounting obligations (Art. 6(1)(c)).

When you make a claim, you sign the Claim Authorisation. It lets us use the data and documents you give us to prepare the letter, send it to the airline in your name and handle its replies, as the Claim Authorisation describes.

[For the lawyer: from 2026-10-09 FlyHandled handles every claim (no more letters the passenger sends). Please confirm this paragraph and whether receiving payment for the passenger needs wording here once that is decided (Launch blocker 1).]

If a claim goes further, we share what it needs with the national enforcement body and, only once you have agreed separately by assigning the claim to us, with the court and our partner lawyer. The exact wording is in the Claim Authorisation and the assignment, and you can withdraw as they describe.

[For the lawyer: please confirm the legal basis for sharing case data with enforcement bodies, courts and a partner lawyer, and whether the partner lawyer is a processor or a separate controller.]

• Service providers that process data for us under contract: hosting, databases, email delivery, flight data (which receives flight numbers and dates, not who you are) and payment processing.
• Authorities, where the law requires it, and professional advisers bound by confidentiality.
• Meta (Instagram, Facebook): only as described in section 7.

We do not sell your personal data.

We advertise on Instagram and Facebook. When you see or tap one of our ads there, Meta processes your data as its own controller under its own policy.

Today the FlyHandled app and website load no advertising pixels or advertising cookies. If we add ad measurement (for example the Meta Pixel or Conversions API), it will stay off until you allow marketing cookies in the cookie banner or Settings, and you can refuse or withdraw that at any time with the same switch. We would never send Meta your claim data, documents or bank details.

You can object to any use of your data for marketing at any time, free of charge, by writing to us or using the unsubscribe link in a marketing email.

• The free check and the Service you ask for: steps before a contract and performance of a contract (Art. 6(1)(b)).
• Preparing a claim you asked for: performance of a contract (Art. 6(1)(b)).
• Security, fraud prevention and establishing or defending legal claims: legitimate interests (Art. 6(1)(f)).
• Accounting and tax records: legal obligation (Art. 6(1)(c)).
• Analytics, marketing cookies and marketing messages: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Counting visits, guide views and checks as daily totals, by where the visit came from (the referring site or a campaign tag): legitimate interests (Art. 6(1)(f)). No cookie and nothing stored on your device; no IP address, device identifier or anything that identifies you is kept; Do Not Track and Global Privacy Control turn it off. When you sign a claim, the case keeps where that visit came from.

[For the lawyer: please confirm this counting needs no consent under the ePrivacy rules (nothing is stored on or read from the device beyond the page request), and the wording.]

Eligibility estimates are automated guidance. They do not produce legal effects about you, and you can always ask a person to review your case.

Your data is hosted in the European Union. The app's servers run in Frankfurt, Germany; your account, trips, claims, cases and documents are stored in Frankfurt; and the emails we send and receive go through Dublin, Ireland.

[To be confirmed with the lawyer: this wording, and the note that some of these providers are companies based outside the EEA, which could access data under the safeguards below.]

Some providers process data outside the European Economic Area or the United Kingdom. When they do, we rely on adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the EU-US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the safeguards.

• Free checks: the result isn't stored against you; server logs are kept for up to 30 days.
• Account and trips: while your account is open, and up to 30 days after you delete it.
• Claim files, the mandate and correspondence: up to 6 years after a claim closes, to cover legal limitation periods.
• Identity documents: deleted 90 days after a claim closes, unless needed for ongoing proceedings.
• Bank details: deleted once the payout is made and the claim is closed, except what accounting law requires us to keep.
• Payment and accounting records: as long as tax law requires, usually up to 10 years.
• Analytics data (with consent): up to 14 months.

[For the lawyer: passengers can now keep identity documents (passport or ID card photos) in Documents, not only for a claim. Please confirm and word: the purpose (having travel documents to hand when a flight goes wrong, and attaching them to a claim the passenger prepares); the legal basis (the passenger's request, Art. 6(1)(b), and whether ID images need more under national law, e.g. Romania's rules on copying ID cards and the CNP); retention (kept until the passenger deletes the document or the account, then gone within 30 days, and 90 days after a claim closes when attached to one); deletion (one tap per document, all of them with the account); and what we do to them (every photo is redrawn on our server without location or camera details; PDFs with scripts, attachments or forms are refused; files are private to the account and only downloaded by their owner).]

Under the GDPR and UK GDPR you can access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time without affecting what happened before. You can object at any time to marketing.

You can complain to the data protection authority where you live or work, in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP); in the UK, the Information Commissioner's Office.

To use your rights, open Settings to download your data or delete your account, or write to privacy@flyhandled.example. We answer within one month and may need to confirm your identity first.

We protect data with encryption in transit, access controls and the principle of least privilege. Identity documents and bank details are only accessible to what is needed to handle your claim. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

You must be at least 18 to use FlyHandled. We process children's data only when a parent or guardian includes them as passengers on a trip or claim.

FlyHandled gives general information about passenger rights and handles compensation claims for passengers who ask it to. It is not legal advice, not a law firm, and not insurance. Compensation is never guaranteed.

We only look for flight bookings you allow. We don't read the rest of the mailbox.

• Nothing happens until you tap Connect in the app and agree on Google's own screen. Signing in with an email address never lets us read that mailbox.
• We ask Google for read-only access to Gmail. We search only emails sent by airlines and booking sites on a fixed list, from the last 3 years, and take out flight numbers, dates and booking codes.
• It is one search, at the moment you connect. We give the access back to Google straight after and keep no access token. We don't store your emails or anything else from the mailbox.
• The flights found are shown to you for a few minutes. They are saved to your trips only if you choose to add them.
• We never sell mailbox data and never use it for advertising.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give on Google's screen and can withdraw at any time in your Google Account. Pasting a booking email instead works on your device and is not sent to us.

[For the lawyer: the app no longer reads Gmail. It now adds flights from booking emails the passenger forwards to their own private address (trips-…@reply.flyhandled.com). Please replace this section with wording you approve, then publish it as a new version. Draft: "Each account has its own forwarding address. When you forward a booking email to it, we read that email only to find flight numbers, dates, airports, the booking reference and the names of the travellers on your account; we discard the email and its attachments as soon as it is read and never store or log its content. We only read emails forwarded from your account's address or the addresses you add in Settings, and you can get a new address at any time. If no flight is found we reply once from our usual address. The emails are received through Resend in Dublin, Ireland; the flights found are kept with your trips in Frankfurt, Germany, in the EU." Legal basis to confirm: the passenger's request (Art. 6(1)(b)). Also confirm how to treat third parties' data in a forwarded email (names of fellow passengers who are not on the account are dropped).]

We will tell you about material changes to this policy. Each version is dated and numbered, and the version you acknowledged is recorded.

[Legal name of the operating company] · [Registered office address] · privacy@flyhandled.example