Privacy Policy

Last updated: July 20, 2026

1. Who We Are

FlightsComp (“we”, “us”, “our”) operates flightscomp.com, an airline compensation claim assistance service. We are the data controller for personal information collected through this website. For privacy inquiries, contact contact@flightscomp.com.

This policy applies to all visitors and users worldwide. Where local laws grant you additional rights, those rights apply as described in Section 10.

2. Information We Collect

Information you provide

When you submit a claim or contact us, we may collect:

• Your name and contact details (email, phone, WhatsApp, or Messenger)
• Flight details (airline, route, date, number of passengers)
• Nature of the flight issue (delay, cancellation, denied boarding, baggage, etc.)
• Documents you share related to your claim (tickets, receipts, booking confirmations)

Account and login information

If you create an account to track your claim, we also process:

• The email address you use to sign in. We use passwordless “magic link” login, so we never ask for or store a password.
• Additional contact methods you choose to save to your profile (such as phone, WhatsApp, or Messenger).
• Documents you upload through your account in connection with a claim.
• If you were referred by another user or share a referral link, the referral code that links your account to that referral.
• If you earn a referral reward and request payout, the payment details you provide and, where we are legally required to report the payment, the tax information reasonably needed to do so.

Information collected automatically

When you visit our website or submit a form, we and our service providers may collect:

• IP address and approximate location (country/city level)
• Browser type, device type, and operating system
• Pages visited, time spent, and referral source
• Technical signals used for bot detection and abuse prevention

3. How We Use Your Information

We use personal information to:

• Assess and process your airline compensation claim
• Communicate with you about your case
• Submit claims and correspondence to airlines on your behalf
• Create, secure, and operate your online account and claim-tracking portal
• Send you a secure login link when you sign in (passwordless authentication)
• Operate our referral program, including linking referred claims to a referrer, determining whether a referral qualifies, and paying referral rewards
• Process payments related to successful claims and referral rewards
• Protect our website from spam, fraud, and automated abuse
• Understand how visitors use our site and improve our service

Legal bases (EEA, UK, and similar jurisdictions)

• Contract / pre-contractual steps: processing claim information you submit so we can evaluate and handle your case
• Legitimate interests: securing our website (bot protection, rate limiting), improving our service, and limited analytics
• Consent: where required for analytics cookies; you may withdraw consent via Cookie settings in the footer
• Legal obligation: where we must retain or disclose information to comply with applicable law

4. Form Submissions

When you submit a claim through our website, your information is transmitted securely over HTTPS to our server and delivered to our team by email via Zoho Mail. We use technical measures to protect the form from abuse, including Cloudflare Turnstile (see Section 5) and rate limiting that temporarily stores your IP address to prevent spam (up to 1 hour). The same Turnstile and rate-limiting measures apply when you request a login link on /login.

5. Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile on our claim form and login page to verify that submissions come from humans and to protect against spam and automated abuse. Turnstile operates invisibly for most users. When you submit a claim, Cloudflare may process technical signals such as your IP address, browser characteristics, device information, and interaction data solely for bot detection and security.

We rely on our legitimate interest in securing our website when using Turnstile. Cloudflare acts as our service provider for this purpose. For details on how Cloudflare processes this data, see the Cloudflare Turnstile Privacy Addendum.

6. Cookies & Analytics

We use Google Analytics 4 to understand how visitors interact with our website. Google Analytics may place cookies on your device to collect usage data including:

• Pages visited and time spent
• Device type, browser, and operating system
• Approximate geographic location (country/city level)
• How you arrived at our site (referral source)

The cookies used include _ga and _ga_* (typically expiring after 2 years). Google Analytics is configured to run only on our production domain. We do not use analytics for advertising or retargeting, and we do not install advertising or retargeting pixels. See Google’s Privacy Policy for more information.

How we set analytics cookies depends on where you are:

• Consent-required regions (EU, EEA, UK, Switzerland, and where we cannot determine your location): we show a cookie banner. Analytics cookies are loaded only if you click Accept. Choose Essential only to use the site without analytics.
• Other regions (such as the United States): analytics may load by default without showing the banner. You can opt out anytime via Cookie settings in the site footer.

You can change your choice anytime via Cookie settings in the site footer (refresh the page after switching to Essential only to fully stop analytics).

You can also opt out by clearing site data in your browser or installing the Google Analytics Opt-out Browser Add-on.

7. Service Providers & Data Sharing

We do not sell your personal information. We share data only as described below:

• Airlines: claim details necessary to pursue your compensation
• Zoho Mail: email delivery for claim notifications
• Supabase: account authentication (passwordless login), database, and secure, access-controlled storage for documents you upload through the portal
• Cloudflare: bot protection (Turnstile) and website security
• Upstash: temporary IP-based rate limiting to prevent form abuse
• Google: website analytics (Google Analytics 4)
• Vercel: website hosting and serverless form processing

Each provider processes data only as needed to deliver their service to us and is bound by their own privacy terms and, where applicable, data processing agreements.

8. International Data Transfers

FlightsComp serves clients worldwide. Your information may be processed in countries other than your own, including the United States, where some of our service providers are located. Where required by law, we rely on appropriate safeguards for cross-border transfers, such as standard contractual clauses adopted by the European Commission or equivalent mechanisms recognized in your jurisdiction.

9. Data Security & Retention

We take reasonable technical and organizational measures to protect your information, including HTTPS encryption, bot protection, and secure email handling. No method of transmission over the internet is 100% secure, but we work to protect your data using industry-standard practices.

We retain claim-related information for up to 3 years after case closure for record-keeping and legal compliance. Account details, saved contact methods, and documents you upload through the portal are held in access-controlled storage and retained on the same basis. Rate-limiting data (IP addresses) is retained for up to 1 hour. Analytics data retention is governed by Google Analytics settings.

10. Your Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (where applicable)
• Withdraw consent for analytics (use Cookie settings in the footer, or email us)
• Lodge a complaint with your local data protection authority

European Economic Area & United Kingdom (GDPR / UK GDPR)

You may exercise the rights above by emailing us. We will respond within the timeframe required by applicable law (generally within 30 days). You may also contact your supervisory authority if you believe our processing violates applicable data protection law.

California (CCPA / CPRA)

We do not sell or share personal information for cross-context behavioral advertising. California residents may request disclosure of categories of personal information collected, request deletion, and request correction of inaccurate information. We will not discriminate against you for exercising these rights.

Canada (PIPEDA) and other regions

We apply the same core privacy principles globally. If your local law grants you additional rights not listed above, contact us and we will honor them where applicable.

To exercise any rights, email contact@flightscomp.com with the subject line “Privacy Request” and enough information for us to verify your identity.

11. Children

Our services are not directed at individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be posted on this page.

13. Contact

For privacy-related inquiries or to exercise your rights, contact us at contact@flightscomp.com.