Privacy policy
Draft, published while still under review. It may change before launch, and a solicitor has not yet settled it. Written against what the code actually does (docs/legal/data-inventory.md). Placeholders in [brackets] need your decision.
Last updated: [date] · Controller: [legal name and address] · Contact: [email] · ICO registration: [number]
Who we are
Refund My Journey is operated by [legal name], [sole trader / limited company] of [address]. We check your Transport for London journeys for delays and, when you tell us to, ask TfL for the refund you are owed.
What we collect, and why
Your email address. To identify your account, send you a sign-in link, and tell you what we found. There is no password.
Your Oyster or contactless card number. TfL requires it on a refund claim, and it tells your journeys apart from anyone else's.
Your journey history from TfL: the date, time, start and end station, and fare of each journey. This is the whole basis of the service. We read at most eight weeks of it, which is as much as TfL itself keeps, so nothing older ever reaches us. Journeys we have already stored are deleted once they pass eight weeks old, together with what we worked out from them. That happens automatically, without anyone having to remember, so an account open for a year holds eight weeks of journeys and not a year of them.
Our estimate of whether a journey was delayed, and the evidence behind it: how long the journey took against your usual time for that route, and what TfL's live status said about that line at that moment.
Your refunds, including TfL's own record of how long each delay was. We use this to avoid claiming twice for the same journey, and to check our estimates against TfL's.
A record of every decision. Every delay we show you, every approval you give, every claim we submit with its TfL reference, and everything we refuse to do and why. This is how we can always answer the question "who authorised this claim?".
The email address on your TfL account. After you sign in, we read the email address shown on your TfL account page. It identifies your account with us and is where we send results. We look only for the email address on that page and store nothing else from it.
What we never see
Your TfL password. When a check runs, you sign in on TfL's own website, in a browser you control. Our code watches only the web address to know when you have finished. We never see, store, or transmit your password or the code TfL texts you.
Your payment details. [When billing is added, Stripe handles these and they never reach us.]
Our lawful basis
Performing our contract with you: you ask us to find your delays and claim your refunds, and we cannot do that without your journey history.
We act as your agent when we submit a claim. Each claim is made on your authority, either because you approved that specific claim, or under a standing authority you gave us in advance and can withdraw at any time. We keep a record of which.
Who else sees your data
- Neon stores our database, in London, encrypted.
- Fly.io runs our software, in London.
- Kernel provides the browser you sign in to TfL through. It holds that session's cookies so we can read your journeys during a check.
- Resend sends our emails.
- Transport for London receives the claims themselves. That is the point of the service.
- [Stripe will handle payments when billing is added.]
We do not sell your data, and we do not use it for advertising.
One transfer outside the United Kingdom. Resend processes your email address and the contents of the emails we send you in the European Union. Everything else stays in the UK: our database is in London, our software runs in London, and the browser that signs in to TfL leaves from the UK. The safeguard for the transfer to Resend is [safeguard].
How long we keep it
Journey history for eight weeks. We read at most eight weeks from TfL, which is all TfL keeps, and we delete stored journeys once they pass eight weeks old, along with our delay estimate for each one. Closing your account deletes them all without waiting. Copies of the TfL pages we read during a check, which we keep only to diagnose changes to TfL's website, for thirty days. Your refunds and the record of what you authorised for [six years] after your account closes, because that is how long a dispute about a claim could arise. Everything else for as long as you have an account.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to what we do with it. Write to [email] and we will answer within one month.
Closing your account deletes your journey history and the browser profile holding your TfL cookies. We keep the record of claims we made on your behalf, because you and TfL may both need it later.
You can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change how we use your data we will email you before it takes effect.