Legal
Privacy notice
How Skyfare Ltd ("Skyfare", "we") uses personal data when you visit skyfare.co, check a flight, make a claim, or contact us. We are the data controller. Last updated 24 September 2026.
Contact for data matters: privacy@skyfare.co, or by post to 42 Dorset Road, London E7 8PS. ICO registration ZC284492.
1. What we collect, and where it comes from
| Data | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone, postal address, date of birth where the airline requires it | You |
| Other passengers on the booking | Names, whether under 18, relationship to you | You (you confirm you may give it) |
| Flight and booking | Flight number, date, route, booking reference, ticket and boarding pass, what happened | You; flight-data providers; the airline |
| Identity documents | Passport or driving-licence image, for each passenger, because airlines require proof of identity before paying | You |
| Signature | Your drawn signature on the Authority to Act, with time and IP address | You |
| Bank details | Account holder, sort code and account number or IBAN, to pay you | You (given on your claim page after the airline agrees to pay) |
| Correspondence | Emails and letters between you, us and the airline, dispute schemes and courts; messages in the support widget; airline case references | You; the airline; schemes; courts |
| Website use | Pages viewed, clicks, funnel steps, approximate country, device type, referrer | Your browser (see cookies below) |
We do not ask for special-category data. Identity documents may incidentally reveal nationality; we use them only to prove identity to the airline.
2. Why we use it and the lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Assessing, preparing, sending and pursuing your claim; paying you | Performance of our contract with you (6(1)(b)) |
| Establishing, exercising and defending legal claims, including dispute schemes and court | Legitimate interests (6(1)(f)) and, for identity documents, Art. 9(2)(f) where they reveal special-category data |
| Telling you where your claim is (emails, your claim page, the support widget) | Contract (6(1)(b)) |
| Reminders to finish a claim you started | Legitimate interests (6(1)(f)); you can stop them with one click |
| Marketing emails about new rights or services | Consent (6(1)(a)), only if you ticked the box; withdraw any time |
| Measuring how the site is used, preventing fraud and abuse, keeping the service secure | Legitimate interests (6(1)(f)) |
| Knowing which of our adverts brought you to us, and telling Meta (Facebook, Instagram) when someone from its adverts makes, wins or is paid a claim, so it can show our adverts to people likely to need us | Consent (6(1)(a)), given on the cookie banner; withdraw any time with Cookie settings at the bottom of any page |
| Keeping records we must keep (tax, accounting, complaints) | Legal obligation (6(1)(c)) |
3. Automated processing
When you enter a flight we check it automatically against flight data (scheduled and actual times, cancellation, weather at the airports) to tell you whether it appears to qualify and for how much. That is an indication, not a decision: a person reviews every claim before it is sent, and every outcome (accepted, rejected, paid) is set by a person. We also use an AI service to summarise the airline's replies and to answer questions in the support widget from our published FAQ and, if you are signed in, from the status of your own claim. The AI never decides your claim and is never given your bank or identity documents.
4. Who we share it with
- The airline that operated your flight: your claim, the Authority to Act with your signature, your booking and boarding documents, and your photo ID (we ask every passenger for it, so the airline can confirm who is claiming).
- Dispute-resolution schemes, national enforcement bodies and courts (for example CEDR, AviationADR, the CAA, or their equivalents in the country the flight departed from) when a claim is escalated, and lawyers we instruct, including a law firm we appoint to act for you or for us on your claim.
- Meta Platforms Ireland Ltd (Facebook, Instagram), only if you accepted cookies: its Pixel on our pages, and from our server the fact that you submitted a claim, and later whether it was accepted or paid, with our fee as the value. Your email, phone, name, town, postcode and country go only as one-way scrambled codes (SHA-256 hashes) that Meta matches against its own accounts; with them go your IP address, browser, Meta's cookie ids and our claim reference. Meta and we are joint controllers for this; Meta's own use is set out in its privacy policy. It may transfer data to the USA under its Data Privacy Framework certification.
- Service providers acting on our instructions (processors): hosting and database (Railway, USA/EU); email sending and receiving (Resend, USA); printed post to airlines (Stannp, UK) where a claim goes by post; flight and weather data (AeroDataBox, FlightAware, aviationweather.gov: flight number and date only); AI summarisation and support answers (Anthropic, USA: correspondence text and claim status only); approximate location from your IP address (a local database, nothing sent).
- Banks and payment providers to pay you.
- Anyone we are required to share with by law, or a buyer of our business, who would be bound by this notice.
We never sell personal data and never share it for anyone else's marketing.
5. International transfers
Some providers above are in the United States. Transfers rely on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or on the UK–US Data Bridge where the provider is certified. Airlines and bodies outside the UK and EU receive data only as necessary for your claim (UK GDPR Art. 49(1)(e)).
6. How long we keep it
| Data | Kept for |
|---|---|
| Claim file (claim, correspondence, outcome, payments) | 6 years after the claim closes (the limitation period for claims in England and Wales), then deleted |
| Identity documents | Deleted 12 months after the claim closes, or sooner if the airline no longer needs them |
| Bank details | Deleted 90 days after your final payout |
| A claim you started but did not submit | Deleted after 6 months |
| Support messages without a claim | 12 months |
| Where you came from (which advert or link) | Kept with your claim for as long as the claim file; the cookies on your device last up to 6 months (ours) or 90 days (Meta's) |
| Website analytics | Aggregated; visitor identifiers rotate daily and cannot be linked back to you |
| Accounting records | 6 years, as the law requires |
7. Security
Data is held in an access-controlled database; bank details are encrypted with a separate key; staff access is by individual account and role; every action on a claim is logged. Your claim page is protected by your reference and email and locks after repeated wrong attempts. We never ask for bank details, passwords or card numbers by email or chat.
8. Your rights
You can ask us to: give you a copy of your data (access); correct it; delete it (where we no longer need it for the claim or a legal obligation); restrict or object to processing based on legitimate interests; receive the data you gave us in a portable form; and withdraw consent to marketing at any time. Email privacy@skyfare.co; we answer within one month. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113. If you live in the EU you may complain to your local supervisory authority.
9. Children
We handle claims for passengers under 18 only through their parent or guardian, who signs for them. We do not knowingly collect data from a child directly.
10. Cookies and tracking
See our cookie policy. In short: we measure visits without cookies, and the only cookies we set are the ones that keep you signed in to your claim page or, before launch, past the site password.
11. Changes
We will post changes here with a new date at the top, and tell you by email if a change affects a claim in progress.