Privacy Policy

The Upgrade Concierge LLC is the data controller for the personal data described in this policy. FlightCompensations is the trading brand under which the service is provided.

You can reach us about any privacy matter at support@flightcompensations.com.

We collect only what the service needs at each stage.

To assess eligibility and to prepare, submit and pursue your claim — this is necessary to perform the contract you enter with us when you authorise us to act.

To take payment for the fixed success fee and any optional purchase, and to keep the accounting records the law requires — contract, and our legal obligations.

To send you service messages about your claim, including sign-in links and status updates — contract.

To keep the service secure, prevent abuse, debug faults and maintain an audit trail of staff access to sensitive documents — our legitimate interest in operating the service safely.

To meet legal, tax and regulatory obligations, and to establish or defend legal claims.

We do not sell your personal data, and we do not use it for advertising profiling.

Airlines, and where necessary their agents or the relevant national enforcement body, receive the information needed to pursue your specific claim — this is the point of the service.

Service providers process data on our instructions under contract. They fall into a small number of categories: cloud hosting and database, transactional email delivery, payment processing, flight-data lookup, and document/text assistance used to draft correspondence.

Where an automated tool helps draft claim correspondence, its output is reviewed by a person before anything is sent. No legally significant document is sent to an airline without human approval.

We may disclose data where the law requires it, or to establish, exercise or defend legal claims.

Some of our providers process data outside the country where you live. Where that happens, the transfer is covered by an appropriate safeguard — an adequacy decision or standard contractual clauses — and we contract with providers on that basis.

We keep claim records for as long as your claim is active, and afterwards for the period needed to handle disputes, appeals and complaints, and to satisfy accounting and tax obligations.

Uploaded documents are kept for the life of the claim and its retention period, then deleted. Draft flight checks that are never converted into a claim expire automatically.

Sign-in tokens are short-lived and single-use; sessions expire. We store token hashes only, never the token itself.

Traffic to the site is encrypted in transit, and data is encrypted at rest by our database provider. Credentials held for integrations are encrypted with authenticated encryption before storage.

Access is checked on the server for every request, so you can only see your own claims. Staff access is role-restricted, and staff views of sensitive documents are recorded in the claim's audit log.

Uploaded documents are served only to you and the staff working your claim — never from public URLs.

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can also withdraw your authorisation for us to act on a claim at any time.

To exercise any of these, email support@flightcompensations.com. We will respond within the period the law allows. Some data must be retained despite a deletion request where accounting or legal-defence obligations apply; we will tell you when that is the case.

If you are unhappy with how we handle your data, you can complain to the data protection authority in your country.

We use a small number of strictly necessary cookies: one to keep you signed in, and ones required for security. These are needed for the service to work and are not used for advertising.

If we ever introduce analytics or marketing cookies, we will ask for your consent first and you will be able to decline without losing access to the service.

The service is not directed at children. An adult must submit a claim, including where the claim covers a child who travelled on the same booking.

We may update this policy. The current version is always published here with its last-updated date, and we will tell you directly if a change materially affects how we use your data.