LEGAL
THE COMPANY
FlightRepay is a trading name of Foxted Limited, registered in England and Wales, company no. 17381926. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
PRIVACY POLICY · VERSION 1.1 · 5 AUGUST 2026
Foxted Limited (trading as “FlightRepay”)
Foxted Limited, trading as “FlightRepay” (“FlightRepay”, “we”, “us”), is a company registered in England and Wales (company number 17381926) with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We help air passengers recover compensation from airlines for delayed, cancelled and overbooked flights.
We are the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office (registration number ZC214387).
For any privacy question, request or complaint, contact our Privacy Officer at privacy@flightrepay.com, or write to us at the address above.
This policy explains what personal data we collect when you use our website or ask us to pursue a flight compensation claim, why we use it, who we share it with, how long we keep it, and what rights you have. It also applies to passengers whose names are given to us by someone they travelled with — see section 4.
We do not ask for your telephone number, your date of birth, passport or identity document numbers, or your card details. We never receive or store your bank account details: where a claim succeeds, payment is arranged through our payment provider’s own secure onboarding process, and all we hold is an account reference and its status.
Our website sets only the cookies needed to keep you signed in to your account (see section 10). Our security and anti-abuse tools receive your IP address in order to check that requests come from a real person and to limit automated abuse.
If you claim for other passengers on the same booking, we collect only their first and last name, and confirmation of whether they are under 18. We do not collect email addresses, dates of birth or contact details for them, and they are not given accounts.
When you include another passenger, you confirm to us that you are authorised to act for them — and, for a passenger under 18, that you hold parental responsibility or the authority of someone who does. Because we hold no contact details for them, we rely on you to tell them that a claim has been made and to share this policy with them. Any passenger included in a claim can contact us at privacy@flightrepay.com to ask what we hold about them, to ask us to stop pursuing a claim in their name, or to exercise any of the rights in section 9.
| WHAT WE USE IT FOR | LAWFUL BASIS |
|---|---|
| Checking whether a flight disruption may qualify for compensation | Steps taken at your request before entering into a contract |
| Assessing, preparing and pursuing a claim against an airline, including corresponding with the airline, instructing lawyers, and bringing court or dispute resolution proceedings | Performance of our contract with you; and our legitimate interests in pursuing claims assigned to us and recovering our fees |
| Holding the names of passengers included in a claim by someone they travelled with | Our legitimate interests, and theirs, in pursuing the claim they are included in; and establishing, exercising or defending legal claims |
| Arranging payment of compensation to you and accounting for our fees | Performance of our contract with you; compliance with our legal obligations (tax and accounting) |
| Keeping records of claims, consents, decisions, complaints and payments | Compliance with legal obligations; and our legitimate interests in defending claims and demonstrating compliance |
| Verifying that requests come from real people, limiting automated abuse, and preventing fraud | Our legitimate interests in protecting our service, customers and airlines from fraud and abuse |
| Operating, securing and improving our website and service | Our legitimate interests in running a secure and effective service |
We do not ask for information about your health or other sensitive matters, and our claim form does not provide for it. If you volunteer such information — for example when explaining the impact of a disruption — we use it only where necessary for establishing, exercising or defending legal claims. Please do not send us sensitive information unless it is relevant to your claim.
We share personal data only where necessary. The recipients are:
We do not sell personal data, and we do not share it with advertising networks.
| PROVIDER | WHAT THEY DO FOR US | WHERE DATA IS PROCESSED |
|---|---|---|
| Supabase | Database, file storage and account sign-in | European Union (Frankfurt) |
| Vercel | Website and application hosting | European Union and United States |
| Brevo | Sending service emails (such as confirmations and claim updates) | European Union |
| Stripe | Arranging payment of compensation to you | European Union and United States |
| Cloudflare | Anti-abuse check confirming requests come from a real person (receives IP address) | Global network, including United States |
| Upstash | Rate limiting to prevent automated abuse (processes IP address) | European Union and United States |
We take appropriate technical and organisational measures to protect personal data. These include encryption of data in transit, private storage for uploaded documents, access controls limiting who can see claim files, removal of location data from uploaded photographs, protection of signature evidence by hashing, and written agreements requiring our providers to protect the data they handle for us. No system is completely secure, but we work to reduce risk and to detect and respond to problems. If a personal data breach is likely to result in a risk to your rights, we will notify the ICO and, where required, you.
| WHAT | HOW LONG WE KEEP IT |
|---|---|
| Claim files — including the signed assignment form, consent records, correspondence and case records, whether the claim succeeded or not | 6 years from closure of the claim, reflecting the limitation period for related legal claims |
| Financial and accounting records of amounts received and paid | 6 years from the end of the financial year to which they relate, as required by law |
| Documents you upload (boarding pass, booking confirmation) | With the claim file, deleted at the end of the 6-year period |
| Enquiries and eligibility checks that never become claims | 12 months from your last activity |
| Complaint records | 6 years from the conclusion of the complaint |
| Account sign-in cookies | Until you sign out or the session expires |
At the end of these periods we delete personal data, or anonymise it so that it can no longer identify anyone.
You have the right to ask for a copy of the personal data we hold about you; to have it corrected if it is wrong; to have it deleted; to have our use of it restricted; to object to our using it where we rely on legitimate interests; to receive it in a machine-readable format or have it sent to another provider; and to withdraw consent where we rely on it.
These rights are not absolute. For example, we may need to keep information in order to pursue or defend a legal claim, or to meet our legal obligations. If we cannot do what you have asked, we will explain why.
To exercise any right, email privacy@flightrepay.com. We respond within one month, we do not charge a fee, and we may ask for information to confirm your identity.
We use only the cookies necessary to keep you signed in to your account. We do not use analytics, advertising or tracking cookies, and we do not allow advertising networks to track visitors to our site.
We advertise our service online and on social media. Those advertisements are shown by the advertising platforms using their own targeting; we do not upload customer details to them, and this policy does not cover how those platforms process data — see their own privacy notices.
We use email only to service your claim, not to market to you.
Your personal data is stored in the European Union. Some of our providers are based in, or route traffic through, the United States. Where personal data is transferred outside the United Kingdom, we rely on the UK’s adequacy regulations for the European Economic Area, or, for other countries, on approved safeguards such as the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses. You can ask us for more detail about the safeguards that apply.
If you are unhappy with how we have handled your personal data, please tell us first at privacy@flightrepay.com so that we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, telephone 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
We may update this policy from time to time. The current version is always available on our website, and we will tell you about significant changes affecting how we use your personal data. This version was published on 5 August 2026.