Privacy policy
Short version: the checker runs in your browser, we use no cookies, we count page views with cookieless Cloudflare Web Analytics, and we only collect an email address if you choose to give one.
Who we are
The controller is Forge-co, operated by 1001590704 Ontario Inc., 3520 Ketelbey Crt., Burlington ON L7M 3B4, Canada. Privacy contact: support@forge-co.ca.
What we collect
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Your checker answers (airports, airline, times) | To show your result | Not collected: processed only in your browser | Until you close the page |
| Anonymous usage events: event name (checker started, completed, email submitted, dashboard page link clicked), page, time to the minute, and the result type | To measure whether the site is useful | Legitimate interests (Art 6(1)(f) GDPR / UK GDPR) | Up to 13 months, as totals |
| Page views, through Cloudflare Web Analytics: the page address, the referring page, and your browser, operating system, device type and country, plus page-load performance figures | To see which pages are used, as aggregate counts | Legitimate interests (Art 6(1)(f) GDPR / UK GDPR) | Shown to us only as totals, not per visitor |
| Email address, if you ask for a reminder | To send your result and one reminder | Consent (Art 6(1)(a)) | Until the reminder is sent, or until you unsubscribe |
| Claims you save in the claim dashboard: flight details, rules and amounts from the checker, status dates, evidence ticks, letters and notes, plus a flight number and booking reference if you add them | To run the dashboard for you | Not collected: stored only in your browser's local storage on your device | Until you delete them or clear your browser data |
| The Stripe checkout reference, when Stripe returns you to the dashboard after you pay | To ask Stripe whether that checkout was paid, so the paid letters can unlock | Contract (Art 6(1)(b) GDPR / UK GDPR): giving you what you bought | Not kept: our server function passes it to Stripe and keeps neither it nor Stripe's answer |
| A purchase marker, once Stripe has confirmed your payment: the date, the Stripe checkout reference and whether it was a test purchase | To unlock the paid letters in that browser | Not collected: stored only in your browser's local storage on your device | Until you clear your browser data |
| Email address, if you join the waitlist for the optional done-for-you service | To tell you when the service opens | Not collected yet: the waitlist form does not send or store anything | Not applicable |
| Purchase details if you buy the paid letters: name, email, country and order details. Card details go to Stripe and Link, never to us | To give you access to the paid letters, handle refunds and keep sales records | Contract and legal obligation | As required by tax and accounting law |
The checker does not ask for booking references, passport details or bank details. Anything you type into a letter template, or add to a claim in the dashboard, stays in your browser and is never sent to us. To delete dashboard claims, use "Delete all claims on this device" in the dashboard or clear this site's data in your browser.
Not switched on yet: the site's own usage events are not sent anywhere, and email addresses are not stored or sent.
No cookies; aggregate analytics only
We do not set cookies or use advertising or cross-site tracking. We use Cloudflare Web Analytics to count page views. Its script, from static.cloudflareinsights.com, uses no cookies and does not store or read anything on your device, and Cloudflare says it does not fingerprint visitors by IP address, browser details or any other data. Cloudflare receives your IP address as part of delivering the request and discards it without storing it, so we receive no personal data from it: only aggregate counts of page views. Cloudflare processes this for us as our hosting provider.
When you choose "Track this claim", the checker passes the flight details to the dashboard in the page address after a #, which is never sent to our server; the dashboard removes it from the address as soon as it opens. The claim dashboard uses your browser's local storage only to keep the claims you save there and, once Stripe has confirmed a purchase, the purchase marker. If your browser sends a Do Not Track or Global Privacy Control signal, the site's own usage events are not recorded at all.
Payments
The dashboard is sold through Stripe Managed Payments. Stripe, through Link, is the merchant of record: it takes your payment, calculates and collects any VAT, GST or sales tax, sends your receipt and handles payment support. Stripe and Link process your payment data under their own privacy policies and share order details with us so we can give you access.
After you pay, Stripe returns you to the dashboard with a checkout reference in the page address. The dashboard sends that reference to our server function, which asks Stripe whether that checkout was paid. The function answers only with that status and whether it was a test purchase, never your name, email or amount, and it does not store the reference or anything Stripe returns.
Hosting
The site is planned to be hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address to deliver pages and protect the service. We do not store IP addresses with usage events.
International transfers
We are based in Canada, so data you send us (an email address or order details) is processed in Canada. The European Commission has found that Canada's private-sector privacy law, PIPEDA, gives adequate protection (Decision 2002/2/EC), and the UK recognises that decision (Data Protection Act 2018, Sch 21 para 5), so no extra transfer safeguards are needed for transfers from the EU or UK to us. Our hosting and payment providers may process data in other countries under their own transfer safeguards.
UK and EU representative
We have not appointed a representative in the UK or EU. UK GDPR and GDPR Art 27(2) do not require one for processing that is occasional, does not involve special-category data at scale, and is unlikely to result in a risk to your rights. We will review this if the service grows. You can contact us directly at any time.
Your rights
You can ask to access, correct or delete your data, object to processing, or withdraw consent at any time by emailing support@forge-co.ca. Every email we send will include an unsubscribe link. You can complain to your data protection authority, such as the ICO in the UK or your national authority in the EU.
Canada: we handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask to see or correct the information we hold about you, and complain to the Office of the Privacy Commissioner of Canada.
Last updated: