Privacy policy

What we process

Your email and name; passenger names and booking reference; flight number and date; airline emails you forward; payment details (handled by Stripe; we never see your card).

If you paste booking emails, we use them only to extract flights and dates and do not keep the text.

If you ask us to file with AESA for you, we keep the signed authorisation and a copy of each passenger’s ID, only for that complaint; we delete them 30 days after it closes.

Bank connection (optional): if you choose to connect your bank to a claim, a licensed open-banking provider (Enable Banking Oy, Finland) reads your account’s transactions, read-only and once a day, only to spot the airline’s payment. You log in on your bank’s own page; we never see your password and nobody can move money. We keep only the matching payment (date, amount, currency and a short description) and never the rest of your transactions. Access ends when the payment is found or the claim closes, after 90 days at most, or when you disconnect it. Legal basis: your consent, which you can withdraw at any time.

Why, and on what basis

To provide the service you buy (contract). To watch flights and send the alerts you ask for (consent). To publish your review (consent). To prevent fraud and measure the service (legitimate interest). To meet tax obligations (legal obligation).

Who we share them with

Processors acting for us: Render (hosting and database, Frankfurt), Cloudflare (network and security), Stripe (payments), Postmark (email), FlightAware (flight numbers and dates only) and Anthropic (writing letters and reading replies); Google or Microsoft only if you connect your inbox to find flights, and Meta (WhatsApp) or Telegram only if you message our bot. Some are outside the EEA; where so, we use the European Commission’s standard contractual clauses.

We do not sell your data. The airline receives your claim because you send it.

If you connect your email

If you connect Gmail or Outlook, you give us read-only access once. We search only for flight booking emails (by sender and subject), take out flight numbers and dates, and discard everything else on the spot. To read unusual formats we may pass those booking emails to Anthropic, which processes them for us and does not use them to train models. We store neither your emails nor access to your account: with Gmail we hand the permission back when we finish; with Outlook the access expires by itself within an hour. The same applies to bookings you forward to our address. We keep the list of flights found and your email for 90 days to send you the results, then delete them.

Flyback’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Record of your approvals

We keep each approval you give (the exact wording, date, IP address and browser) so we can show what you agreed to, for the life of your claim and the legal limitation periods. You can see and withdraw them under “My approvals”.

How long

For the life of your claim and then as long as the law requires (tax records: 6 years). Flight watches are deleted 3 months after the flight.

Your rights

You can ask for access, correction, deletion, objection, restriction and portability by writing to hello@flybackclaims.com. You can complain to the Spanish Data Protection Agency (aepd.es).