Privacy policy

The controller of your personal data is the publisher of the Remboursai service.

Jordy MARGARETTA, sole trader (micro-entreprise), operating under the name KAIRO AI. SIREN: 930 849 690, SIRET (head office): 930 849 690 00027. Registered with the French National Business Register (RNE). APE code: 62.02A. Website: www.remboursai.com Contact: contact@remboursai.com

For any question about the processing of your personal data, you can write to us at contact@remboursai.com.

We only collect the data strictly necessary to handle your compensation claim. Depending on your situation, this may include:

Identity data: passenger surname and first name. Contact details: email address and phone number. Postal address: only where the airline requires it on its third party authorisation form (Air France and KLM in particular). It is kept on your customer record and offered back to you, for confirmation, if you entrust us with a new claim. Details of the flight(s) concerned: flight number, date, route (departure and arrival airport), length of the delay. Supporting documents: boarding pass, booking confirmation and any document useful to support the claim. Bank details: your IBAN, solely to pay you the compensation obtained. Exchanges with our support: the messages and communications you send us. Claim reference: a claim identifier (claim_ref) allowing us to track your request.

Technical connection data: your IP address, used only for the security of the service (limiting abuse). It is not kept in clear beyond what is strictly necessary for that protection.

This information is collected directly from you when you entrust us with your claim.

Your personal data is used for the following purposes:

To assess your eligibility for compensation under Regulation (EC) No 261/2004. To handle your claim, draft and send the claim to the airline, and follow up on the procedure (including, where applicable, with a mediator, the DGAC or a court). To collect the compensation on your behalf, under the representation mandate and assignment of claim you have signed, then pay you the net share due to you. To keep you informed of progress on your claim and respond to your support requests. To comply with our legal obligations, in particular accounting obligations. To improve and secure our service.

Our model is based on a 30% commission taken only in the event of success: if no compensation is obtained, no fee is charged to you.

Each processing of your data is based on a legal basis provided for by the GDPR:

Performance of the contract and the mandate (article 6.1.b of the GDPR): handling your claim, the claim to the airline and paying your compensation are based on the representation mandate and assignment of claim (articles 1321 et seq. of the French Civil Code) that you have signed. Reading the documents you upload before any signature, to prepare your file, falls under pre-contractual measures taken at your request, also provided for by article 6.1.b. Compliance with legal obligations (article 6.1.c of the GDPR): in particular the retention of accounting records. Our legitimate interest (article 6.1.f of the GDPR): the operational management, security and continuous improvement of our service.

To provide our service, we call on providers (processors) and pass certain data to recipients. We systematically apply the principle of minimisation: we only share what is strictly necessary.

Supabase: database hosting (within the European Union). Vercel: application hosting. OpenAI and Anthropic: assistance in drafting claim letters, support, and reading the documents you upload (booking confirmation, boarding pass) to extract the references your file needs. These documents are sent to them to be read; they may contain your name, email or phone number. We limit what we send to what the task requires, and your IBAN is never sent to them. Service Postal (api.servicepostal.com): sending claims by registered paper mail (provider based in France, within the European Union). Yousign: electronic signature of the representation mandate and the assignment of claim (provider based in France, within the European Union). Meta Platforms Ireland: support channel via WhatsApp. RapidAPI / AeroDataBox: flight data verification. The airlines concerned: recipients of the claim. Where applicable, mediators, the DGAC or the competent courts in the course of handling your claim. The financial institution handling the transfers of your compensation.

Meta Platforms Ireland Limited: measurement of our advertising on Facebook and Instagram, ONLY if you have accepted advertising measurement. In that case we send, from our servers, technical identifiers together with your contact details in irreversibly hashed form (SHA-256 fingerprint of your email address and phone number), so that an advert can be matched to a request, along with the relevant event and its value. Meta never receives the content of your file: no flight number, no identity document, no bank details, no compensation amount. You may withdraw this authorisation at any time via the “Advertising choice” link at the bottom of the page.

We do not sell or rent your personal data to third parties.

Some of our processors, notably OpenAI, Anthropic and Meta Platforms Ireland, may involve a transfer of data outside the European Union. These transfers are governed by appropriate safeguards within the meaning of the GDPR, in particular the Standard Contractual Clauses (SCCs) adopted by the European Commission, in order to ensure a level of protection of your data equivalent to that guaranteed within the European Union.

Your data is kept for the entire duration of the handling of your claim.

Once handling is complete, it is kept in an intermediate archive until the end of the applicable limitation periods, i.e. 5 years (article 2224 of the French Civil Code), so that we can respond to any dispute or obligation related to your claim.

Accounting records are kept for up to 10 years, in accordance with our legal obligations.

On expiry of these periods, your data is deleted or anonymised.

We implement appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure or alteration. This includes in particular hosting the database within the European Union, restricted access to sensitive information, and minimising the data sent to our providers (for example, your IBAN is never shared with the artificial intelligence models used to draft the letters or read your documents).

The Remboursai service uses two categories of cookies, and they are not equivalent.

Strictly necessary cookies first: the authentication session cookie managed by Supabase, which keeps you securely signed in to your account, and the cookie that stores your choice regarding advertising measurement. These do not require your prior consent, because they are essential to delivering the service you requested, or because they specifically record your refusal.

Advertising measurement cookies next: the Meta cookie (Facebook and Instagram pixel). It is only placed AFTER your explicit acceptance. Until you accept, no advertising script is loaded and no information is sent to Meta. Refusing is as simple as accepting, and the service works exactly the same either way.

You may change your mind at any time, in either direction, using the “Advertising choice” link at the bottom of every page. A withdrawal applies going forward: it stops any new transmission, and we ask Meta to delete the data already sent about you.

In accordance with the GDPR, you have the following rights over your personal data:

Right of access: obtain a copy of the data we hold about you. Right to rectification: correct inaccurate or incomplete data. Right to erasure: request deletion of your data, subject to our legal retention obligations. Right to restriction of processing. Right to object to processing. Right to portability of your data. Right to withdraw your consent at any time, where processing is based on it. Right to set directives concerning what happens to your data after your death (post-mortem directives).

To exercise these rights, simply write to us at contact@remboursai.com. We may ask you for proof of identity in order to handle your request securely.

Given the nature and size of the structure, appointing a data protection officer (DPO) is not legally mandatory and no DPO has been appointed.

For any question about the protection of your personal data or to exercise your rights, you can reach us at: contact@remboursai.com.

If, after contacting us, you feel that your rights over your data are not respected, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) Website: www.cnil.fr

The Remboursai application and data are hosted by the following providers:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States: application hosting. Supabase, Inc.: database hosting, within the European Union (Europe region).

We may update this privacy policy to reflect changes in law, regulation or our service. Any change will be published on this page, with an updated last-updated date. We invite you to check it regularly.

Publication director: Jordy Margaretta.