Privacy policy

Last updated 13 October 2026 · terms version 2026-10-13

In short: we use your information only to check your case and build your pack. We don't sell it or use it for advertising. Case data and uploads are deleted 90 days after delivery.

1. Who is responsible

Appeal My Flight is an auxiliary business name of Elbek, a Finnish sole trader. Business ID 3570992-5 (Finnish Trade Register). Address: Myllyväenkatu 10 D 3, 00920 Helsinki, Finland. Phone +358 40 757 0116. Email hello@appealmyflight.com. We have not appointed a data protection officer and are not required to.

2. What we collect

Contact details: name, email, country of residence.
Case details: flight, date, route, booking reference, what happened, your description, the names of the other passengers on your booking.
Documents you upload (the airline's rejection, booking confirmation, receipts).
Payment information from Stripe: that you paid, the amount, your email. We never see your full card details.
Your consents and choices on the order page and any withdrawal, with date, time and IP address, as proof of what was agreed.
Emails you send us.
Technical data: IP address and request logs, used for security.

Please only include health information if it matters for your case. If you include it, we ask for your explicit consent on the form. Only give us health information about another adult passenger if that person has agreed to it. If you give us health information without the consent, we don't use it and we ask you what to do.

3. Why we use it and on what legal basis

Checking your case before you pay: steps you ask for before a contract (GDPR art. 6(1)(b)).
Building and delivering your pack, answering you, handling refunds and withdrawals: performance of our contract (art. 6(1)(b)).
Health information you choose to give us: your explicit consent (art. 9(2)(a)). You can withdraw it at any time. Withdrawing does not affect what we did before.
Keeping accounting and tax records: legal obligation (art. 6(1)(c)), under the Finnish Accounting Act and VAT rules.
Keeping proof of the contract and of the information we gave you: legal obligation to be able to prove it (consumer protection law) and our legitimate interest in handling disputes (art. 6(1)(c) and (f)).
Keeping the website secure and preventing abuse: our legitimate interest in running a safe service (art. 6(1)(f)).

We need the details marked as required to check your case and build your pack. Without them we can't provide the service.

Our eligibility rules run automatically, but a person checks every case before we accept or decline it. We make no decisions based solely on automated processing.

4. Other passengers on your booking

If you give us other passengers' names, we use them only to prepare the documents for your booking. Please tell them you are using our service and point them to this policy.

5. Who processes it for us

Our own server in Finland: case data and uploads.
Cloudflare (website delivery and security). Traffic passes through Cloudflare's network, including outside the EU.
Google Workspace (our email inbox).
Resend (sending our emails; servers in the United States).
Stripe (payments; Stripe is also an independent controller for fraud prevention and legal compliance).

Where these providers process data outside the EU/EEA, they rely on the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards. Each provider works for us under a data processing agreement. We never sell your data or use it for advertising.

6. How long we keep it

Case data, uploads and any health information: 90 days after we deliver your pack. If you don't buy, or we decline your case, 90 days after you sent it.
Emails with us: 12 months, then deleted.
Proof of the contract (case reference, name, email, your consents and choices with date, time and IP address, the terms version, any withdrawal): 3 years after the end of the year of your order.
Accounting record of your payment (reference, date, amount, currency, country, payment ID; no case details): 6 years after the end of the financial year, as Finnish accounting law requires.
Backups of our server are kept for at most 14 days.

7. Your rights

You can ask for a copy of your data, and to correct, delete, restrict or object to its use, or receive it in a portable format. Email hello@appealmyflight.com. You can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live (in Sweden IMY, in Denmark and Norway Datatilsynet).

8. Cookies

We use one cookie, lang, and only if you choose a language with the language switcher. It remembers your choice for 12 months. Our security provider Cloudflare may set a strictly necessary security cookie. We use no analytics, advertising or tracking cookies. Our fonts are served from our own server.