Privacy Policy

1. Who we are

Klaimly is a flight delay compensation service operated by Klaimly Ltd ("we", "us", "our"), a company registered in England and Wales under company number 17321388, with its registered office at 66 Paul Street, London, England, EC2A 4NA. We are the data controller responsible for your personal data.

We are registered with the Information Commissioner's Office (ICO), registration reference ZC189775.

Contact: support@klaimly.co.uk

2. What data we collect

We collect the following categories of personal data:

• Identity data: full name as it appears on your booking
• Contact data: email address, phone number (optional)
• Flight data: flight number, airline, departure and arrival airports, date of travel, booking reference
• Disruption data: type of disruption, delay duration, description of events. For denied boarding claims, this also includes whether you had valid travel documentation, how late you arrived at your destination, and whether you volunteered to give up your seat
• Verification data: a one-time code sent to your email to confirm it belongs to you. It expires after 10 minutes and cannot be used after that, and it is deleted once used or replaced when a new code is requested for that email
• E-signature: your electronic signature on the Letter of Authority authorising us to act on your behalf. If an airline requires a signature that matches your identity document, we may ask you to sign the Letter of Authority again
• Supporting documents: where the airline or a national enforcement body requires them to verify your identity or eligibility, or to support your claim, we may ask you to upload documents such as your passport or photo ID, boarding pass, booking confirmation, receipts for expenses, or a bank statement. We only ask for these when they are needed for your specific claim, you upload them yourself through a secure private link, and they are shared only with the airline or enforcement body handling your claim. If you email documents to us instead, we may save them to your claim in the same private storage, where they are treated in exactly the same way
• Payment data: if your claim is won, we may ask for your bank account holder name and either a UK sort code and account number, a US routing number, account number and account type (checking or savings), or an international IBAN and SWIFT/BIC, together with the billing address registered to that account. This is used solely to pass on to the airline so it can pay your compensation directly to you. We never use these details to move money ourselves
• Bank detail check: when you enter a UK sort code and account number on our payment details page, we check them with a bank verification service (eSortcode) to confirm they are a valid combination and to show you which bank the account belongs to, so mistakes are caught before your details go to the airline. Only the sort code and account number are sent for this check, never your name or address. We do not keep the check result; it is shown to you on the page and then discarded
• Account login data: when you log in to My Claims or the Klaimly Plus dashboard, we email you a one-time code, which expires after 10 minutes and is deleted once used or replaced when a new code is requested. After you log in, we place a secure login cookie on your device that holds your email address and an expiry time, digitally signed so it cannot be altered. It keeps you logged in for up to 14 days (My Claims) or 30 days (Klaimly Plus) until you log out. We also keep a short-lived count of how many login codes have been requested for each email address and from each IP address, to stop codes being used to flood someone's inbox
• Technical data: IP address, browser type, device information, cookies (see our Cookie Policy)
• Anonymous usage statistics: we use Vercel Web Analytics to count page views and see which pages, referrers, countries, and device types are most common. It does not use cookies or identify you personally. Before a page view is recorded, we remove everything after the "?" in the page address (apart from advertising campaign tags), so details such as a claim reference or email address in a link are never sent
• In-progress claim data: if you start a claim but don't finish it, your name, email, phone, and flight details may be temporarily stored in your browser's local storage so you can resume where you left off. This is cleared automatically once you submit your claim, or you can clear it yourself by clearing your browser data
• Klaimly Plus membership data: if you join Klaimly Plus, we additionally hold your membership status, price paid, join and renewal dates, and cancellation/refund status. For each flight you add to be tracked, we store the flight number, date, route, and booking reference you provide, plus the flight status data we check against it (scheduled and actual departure/arrival times, delay length, cancellation status). We also store a one-time login code sent to your email each time you sign in, which expires after 10 minutes and is deleted once used or replaced, the same way as the claim verification code above
• Referral data: if you join Klaimly Plus, we generate a personal referral code for you and record how many times your referral link is clicked. If someone joins using your code, we record that they were referred by you and whether their membership has been activated, so we can apply your free-month reward once it is. We show you only their first initial when you view your referrals, never their full name or any contact detail
• Issue reports: if you use our "Report an issue" page, we collect what you tell us (the type of issue, how much it affected you, your description and the page it happened on), any screenshots or files you choose to attach, and your browser and device type so we can reproduce the problem. Your name and email address are optional; we only use them to follow up on your report or to contact you about a thank-you reward
• Email preferences: if you unsubscribe from our announcement emails, we keep your email address on a list of people not to send them to, so your choice is respected in future
• Klaimly Plus card payments: if you pay for Klaimly Plus by card, you enter your card details on Stripe's own secure checkout page, not on our website. Stripe tells us whether the payment succeeded, the amount, and the email address used, so we can activate your membership. We never see or store your card number

3. Why we collect it and our legal basis

4. Who we share your data with

We only share your data where necessary to process your claim or operate our service:

• Airlines: to file and pursue your compensation claim, including any supporting documents the airline requests to verify your identity or progress your claim, and, once your claim is won, your bank account details and billing address so the airline can pay your compensation directly to you
• National enforcement bodies: if your claim is escalated, including any supporting documents they require to determine it
• Supabase: database and document storage hosting (EU region, encrypted at rest, restricted to our servers only)
• Resend: email delivery (verification codes, claim updates and service announcements)
• eSortcode: a UK bank verification service. When you enter UK bank details on our payment details page, we send it your sort code and account number only, to confirm they are valid and identify your bank. No name, address or other details are shared
• Stripe: processes Klaimly Plus card payments on its own secure checkout page. Your card details go to Stripe directly and are never seen or stored by us
• FlightLabs: your flight number, departure and arrival airports, and travel date may be sent to verify flight status and delay times, including automatic checks of any flight you ask us to track under Klaimly Plus. No other personal data is shared with this provider.
• Vercel: website hosting, and anonymous, cookieless page view statistics (Vercel Web Analytics)
• Airline logo images: the airline logos shown in our eligibility checker are loaded from an external image service (pics.avs.io). As with any image on the web, your browser sends that service your IP address and basic browser information when it loads a logo. No claim or contact details are shared with it

Klaimly Plus partner perks: we do not share your personal data with the travel brands that offer Klaimly Plus perks (such as Airalo). If you choose to follow a partner link, you leave our website, and anything you then give the partner is handled under its own privacy policy.

We never collect or store payment card details. Compensation is paid to you directly by the airline, and our 5% fee is settled by bank transfer or payment link from an emailed invoice. Your Klaimly Plus membership fee can be paid by card through Stripe's secure checkout page or by bank transfer; card details are entered with Stripe, never on our website. The only bank details we ever collect are your own, and only so we can pass them to the airline for your compensation payout, never to move money on your behalf.

We do not sell your personal data to any third party. Ever.

5. International transfers

Some of our service providers are based outside the UK/EEA. Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or the provider is certified under an adequate framework.

6. How long we keep your data

We retain your personal data for the following periods:

• Active claims: for the duration of the claim plus 12 months
• Completed claims: 6 years from the date of the flight (matching the EU261 limitation period)
• Uploaded documents: supporting documents you upload (identity documents, boarding passes, receipts, bank statements) are kept only for as long as needed to progress and settle your claim, and are deleted once the claim is closed, or sooner on request
• Marketing preferences: until you withdraw consent
• Unsubscribe list: for as long as we send announcement emails, so we can keep respecting your choice. Ask us and we will remove you from it
• Issue reports and attached screenshots: up to 12 months after we have dealt with the report, then deleted. If we gave you a thank-you reward, a record of it is kept for 6 years for our accounting and tax records
• Technical logs: 90 days
• Login codes: expire after 10 minutes. A code is deleted once used, or replaced when a new code is requested for the same email; an expired, unused code holds no other information and cannot be used to log in. Login request counts used to prevent abuse are kept for no more than an hour
• Login cookies: stored on your own device for up to 14 days (My Claims) or 30 days (Klaimly Plus), and removed as soon as you log out
• Klaimly Plus membership and tracked flight data: for as long as your membership is active, plus 6 years after cancellation to match the limitation period for any claim filed under it, and for our own accounting and tax records

After these periods, your data is securely deleted or anonymised.

7. Your rights

Under UK GDPR and EU GDPR, you have the following rights:

To exercise any of these rights, email us at support@klaimly.co.uk. We will respond within 30 days.

8. Security

We take the security of your data seriously. We use encryption in transit (TLS/SSL), encryption at rest, access controls, and regular security reviews. Your claim data is stored in a database that only our own servers can access directly; it is never exposed to the public internet. Documents you upload are held in a private storage area that is not publicly accessible and can only be opened by us through short-lived, single-use links.

Logging in to your account uses one-time codes sent to your email rather than passwords, so there is no password of yours for us to store or for anyone to steal. Your login is kept in a secure cookie that the website's own scripts cannot read, is only accepted for requests that come from our own pages, and is signed with a secret key held only on our servers.

9. Children

Our service is not directed at anyone under 18. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. The "last updated" date at the top of this page indicates when the policy was last revised.