Privacy policy

The controller of your personal data is the publisher of the Remboursai service.

Jordy MARGARETTA, sole trader (micro-entreprise), operating under the name KAIRO AI. SIREN: 930 849 690, SIRET (head office): 930 849 690 00027. Registered with the French National Business Register (RNE). APE code: 62.02A. Website: www.remboursai.com Contact: contact@remboursai.com

For any question about the processing of your personal data, you can write to us at contact@remboursai.com.

We only collect the data strictly necessary to handle your compensation claim. Depending on your situation, this may include:

Identity data: passenger surname and first name. Contact details: email address and phone number. Details of the flight(s) concerned: flight number, date, route (departure and arrival airport), length of the delay. Supporting documents: boarding pass, booking confirmation and any document useful to support the claim. Bank details: your IBAN, solely to pay you the compensation obtained. Exchanges with our support: the messages and communications you send us. Claim reference: a claim identifier (claim_ref) allowing us to track your request.

This information is collected directly from you when you entrust us with your claim.

Your personal data is used for the following purposes:

To assess your eligibility for compensation under Regulation (EC) No 261/2004. To handle your claim, draft and send the claim to the airline, and follow up on the procedure (including, where applicable, with a mediator, the DGAC or a court). To collect the compensation on your behalf, under the representation mandate and assignment of claim you have signed, then pay you the net share due to you. To keep you informed of progress on your claim and respond to your support requests. To comply with our legal obligations, in particular accounting obligations. To improve and secure our service.

Our model is based on a 30% commission taken only in the event of success: if no compensation is obtained, no fee is charged to you.

Each processing of your data is based on a legal basis provided for by the GDPR:

Performance of the contract and the mandate (article 6.1.b of the GDPR): handling your claim, the claim to the airline and paying your compensation are based on the representation mandate and assignment of claim (articles 1321 et seq. of the French Civil Code) that you have signed. Compliance with legal obligations (article 6.1.c of the GDPR): in particular the retention of accounting records. Our legitimate interest (article 6.1.f of the GDPR): the operational management, security and continuous improvement of our service.

To provide our service, we call on providers (processors) and pass certain data to recipients. We systematically apply the principle of minimisation: we only share what is strictly necessary.

Supabase: database hosting (within the European Union). Vercel: application hosting. OpenAI and Anthropic: assistance in drafting claim letters and support. The data sent to these models is minimised: your IBAN, email and phone number are never sent to them. Service Postal (api.servicepostal.com): sending claims by registered paper mail (provider based in France, within the European Union). Yousign: electronic signature of the representation mandate and the assignment of claim (provider based in France, within the European Union). Meta Platforms Ireland: support channel via WhatsApp. RapidAPI / AeroDataBox: flight data verification. The airlines concerned: recipients of the claim. Where applicable, mediators, the DGAC or the competent courts in the course of handling your claim. The financial institution handling the transfers of your compensation.

We do not sell or rent your personal data to third parties.

Some of our processors, notably OpenAI, Anthropic and Meta Platforms Ireland, may involve a transfer of data outside the European Union. These transfers are governed by appropriate safeguards within the meaning of the GDPR, in particular the Standard Contractual Clauses (SCCs) adopted by the European Commission, in order to ensure a level of protection of your data equivalent to that guaranteed within the European Union.

Your data is kept for the entire duration of the handling of your claim.

Once handling is complete, it is kept in an intermediate archive until the end of the applicable limitation periods, i.e. 5 years (article 2224 of the French Civil Code), so that we can respond to any dispute or obligation related to your claim.

Accounting records are kept for up to 10 years, in accordance with our legal obligations.

On expiry of these periods, your data is deleted or anonymised.

We implement appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure or alteration. This includes in particular hosting the database within the European Union, restricted access to sensitive information, and minimising the data sent to our providers (for example, your IBAN, email and phone are never shared with the artificial intelligence models used to draft the letters).

The Remboursai service only uses cookies strictly essential to its operation. This includes in particular the authentication session cookie managed by Supabase, which lets you stay securely logged in to your account.

We do not use advertising tracking cookies by default, and we do not place cookies for commercial profiling. Essential cookies do not require your prior consent because they are indispensable to providing the service you request.

In accordance with the GDPR, you have the following rights over your personal data:

Right of access: obtain a copy of the data we hold about you. Right to rectification: correct inaccurate or incomplete data. Right to erasure: request deletion of your data, subject to our legal retention obligations. Right to restriction of processing. Right to object to processing. Right to portability of your data. Right to withdraw your consent at any time, where processing is based on it. Right to set directives concerning what happens to your data after your death (post-mortem directives).

To exercise these rights, simply write to us at contact@remboursai.com. We may ask you for proof of identity in order to handle your request securely.

Given the nature and size of the structure, appointing a data protection officer (DPO) is not legally mandatory and no DPO has been appointed.

For any question about the protection of your personal data or to exercise your rights, you can reach us at: contact@remboursai.com.

If, after contacting us, you feel that your rights over your data are not respected, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) Website: www.cnil.fr

The Remboursai application and data are hosted by the following providers:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States: application hosting. Supabase, Inc.: database hosting, within the European Union (Europe region).

We may update this privacy policy to reflect changes in law, regulation or our service. Any change will be published on this page, with an updated last-updated date. We invite you to check it regularly.

Publication director: Jordy Margaretta.