Privacy Policy

Who Is Responsible for Your Information

Find Passengers B.V. is currently in the process of incorporation. Until incorporation is completed, FindPassengers is operated by and its personal-data processing is controlled by HE Administraties, registered with the Dutch Chamber of Commerce under number 62414194.

HE Administraties
Boekerij 40
1695 JB Blokker
The Netherlands
Dutch Chamber of Commerce (KVK): 62414194
VAT ID: NL002101357B47
Telephone: +31 6 17437759
Email: support@findpassengers.com

Information We Process

Account and Authentication Information

When you create or use an account, we process your email address, Supabase account identifier, authentication status, session information, email-confirmation and recovery events, country of residence, account settings and notification preferences. Country of residence can be changed on the Account page and may be used to show external claim services relevant to your market. We do not infer your residence from flight details, language or IP address. Passwords are handled by Supabase Auth; FindPassengers does not receive or store your password in plain text.

Flight Searches and Flight Information

We process the flight number and date you search for and the flight candidate you select. Flight groups can contain airline and route information, airport codes, scheduled or actual times, operational status, delay information and provider identifiers. Results may come from existing FindPassengers records or from AeroDataBox through API.Market after you request an external lookup.

Membership and Passenger Activity

We record which flight groups you join and when you join. Your membership rows and email address are not displayed to other passengers. Public visitors can see aggregate passenger totals. Other current members can associate your Flight Chat activity with a flight-specific passenger alias.

Claim Information

We process the claim status you select and, if you report receiving compensation, the amount and currency you enter. Your individual claim record is available only to you. FindPassengers publishes group-level totals for submitted, compensated and rejected claims. These totals do not identify which account selected a status, although people may sometimes draw inferences in a very small group.

Messages, Files and Moderation Reports

We store Flight Chat messages, flight-specific sender aliases, timestamps and any finalized attachment metadata and files. Upload processing also creates temporary reservation, validation and cleanup records. If a member reports a message, we process the report reason, reporter identity, reported message and related flight context so the report can be reviewed. A report alert may include the complete reported message, but does not attach uploaded files.

Contact Requests

If you use the contact form, we process your name, email address and message to review and answer your enquiry. The submission is delivered by email through Resend and is not intended to be stored in the FindPassengers application database. Copies may still be retained by the recipient mailbox and email-delivery infrastructure.

Notifications

We process notification preferences and private delivery records for passenger milestones, aggregated claim milestones and Flight Chat digests. These records can include the recipient account, flight, notification type, scheduling and attempt timestamps, delivery status and the email provider's message identifier. We also send essential authentication and account-management emails through Supabase's configured email service.

Technical and Security Information

We process limited technical information needed to operate and protect the service. This includes timestamps, authentication claims, request and security logs, attachment validation data and one-way HMAC fingerprints derived from a trusted client IP for selected abuse-prevention limits. FindPassengers does not intentionally store raw IP addresses in its application rate-limit tables. For anonymous visitors using the English site, a coarse country signal supplied by Vercel from the request/IP context may be used transiently to choose a more relevant external provider. The raw IP address is not stored by FindPassengers solely for this routing. Vercel, Supabase, API.Market, AeroDataBox, Resend and network providers may process ordinary connection, delivery and security logs in operating their services.

Why We Use Information and Our Legal Bases

Depending on the feature and your relationship with us, we process information:

• to take steps at your request and provide the service, including accounts, flight groups, memberships, private claim records, chat, files and account controls;
• for legitimate interests in operating, securing, improving and preventing misuse of FindPassengers, producing privacy-limited group statistics and handling reports;
• to send requested, transactional or preference-controlled service communications;
• to answer contact requests and exercise or defend legal claims;
• to comply with legal obligations; and
• with consent where applicable law requires it, in which case you may withdraw consent without affecting earlier lawful processing.

Optional product-notification preferences can be changed on the Account page. Disabling them does not prevent essential authentication, security or account-service messages.

Who Can See Information

• Public visitors: flight details, aggregate passenger totals and aggregated claim counts.
• Current members of the same flight: Flight Chat messages, passenger aliases and finalized, message-linked attachments for that flight.
• Only you: your email-linked account, country of residence, membership list, notification preferences and individual claim status and compensation amount.
• Authorised service processing: private moderation reports, notification queues, upload reservations, rate-limit records and operational data are not directly available to ordinary browser roles.

Pending or rejected uploads are not shared with other flight members. Short-lived signed links for finalized attachments are issued only after a current-membership check. A link can remain usable until its brief expiry even if membership changes immediately after it was issued.

Service Providers and Disclosures

We use the following providers for the current service:

• Supabase for authentication, database, realtime and private file storage;
• Vercel for website hosting, server execution and related logs;
• Resend for contact, product-notification and moderation-alert email delivery, and as configured for authentication email delivery;
• AeroDataBox through API.Market for requested flight-data lookups; and
• professional advisers, authorities or other recipients where reasonably necessary to comply with law or protect legal rights.

Providers receive only the information reasonably needed for their function and process data under their own contractual and legal responsibilities. We do not sell your personal information.

External and Affiliate Links

FindPassengers does not currently operate active affiliate links, referral identifiers, affiliate tracking or affiliate cookies, and does not currently receive commission from the displayed provider links or the non-clickable demo partner. FindPassengers displays clearly identified links to independent third-party claim services and may in the future receive a commission if you use a clearly disclosed affiliate link. Provider selection takes place within FindPassengers. Merely showing a provider does not send your account, chat, claim or other FindPassengers user data to that provider. For signed-in users, country of residence may be used to select relevant providers. For anonymous visitors, the selected non-English site language may be used as a relevance signal. For a limited set of explicitly configured language-country combinations, a coarse request-country signal may refine that selection; it does not override the chosen language. On the English site, the coarse request-country signal may be used directly, with an explicitly configured broad provider as a fallback. These signals do not establish residence or legal eligibility. FindPassengers currently adds no affiliate tracking cookie, pixel or analytics for this selection. If affiliate links or tracking are enabled later, this Policy will be updated to describe the final implementation. Any future commercial relationship will not change the independence of passenger-reported claim information. When you choose to follow an external link, the destination provider may receive ordinary browser and request information and will process your visit under its own privacy policy.

International Data Transfers

Some providers may process information outside your country or the European Economic Area, including in the United States. Where personal data is transferred outside the European Economic Area, FindPassengers relies on appropriate safeguards where required, such as adequacy decisions, the European Commission's Standard Contractual Clauses, or other legally recognised transfer mechanisms used by the relevant service provider. Supabase and Vercel provide infrastructure, database, authentication, storage and hosting services and their processing is not represented as exclusively European. Resend may process email-related data outside the EEA where applicable. Only the flight lookup and request information needed to retrieve flight data is sent to AeroDataBox through API.Market; these services do not receive the complete FindPassengers user database for that purpose.

Data Retention

Our policy is to keep flight-related personal data for no longer than five years after the relevant flight date, unless earlier deletion is appropriate or required, or longer retention is reasonably necessary for legal obligations, security, fraud prevention, disputes or another lawful purpose. This is the maximum retention objective for the relevant flight-related data. The application does not currently run a complete automatic five-year deletion job, so this policy does not mean that every record is guaranteed to disappear automatically on the exact five-year date; the lifecycle also depends on operational review and deletion.

Account-linked data is generally kept while an account is active. Account deletion removes the authentication account, memberships, account-linked private claim record and user-specific notification data. A non-identifying flight-level count of a submitted, compensated or rejected claim outcome may remain within the same flight-data retention framework described above. It contains no user identity, account link, compensation amount or currency and cannot be reconnected to a later recreated account. Existing messages and finalized attachments remain in their flight conversation with the user link removed. Temporary rate-limit records are removed opportunistically after short operational periods (generally 24 or 48 hours), and old terminal chat-digest events have a 30-day cleanup. Pending upload reservations and orphan files are subject to dedicated cleanup logic.

Contact mailbox copies, moderation records, general notification history, infrastructure logs and backups are retained only for as long as reasonably necessary for the purpose for which they are processed, including service operation, security, legal obligations and disputes. Providers may retain their own logs and backups under their documented schedules.

Account Deletion

You can permanently delete your account from the Account page after recent password authentication. Deletion removes your authentication account, email-linked account data, flight memberships, account-linked private claim records and user-specific notification data through the configured deletion process. A non-identifying flight-level historical claim-outcome count may remain, without user identity, account linkage, compensation amount or currency, and remains subject to the flight-data retention framework above. It cannot be reconnected to a later recreated account. Existing chat messages and finalized shared attachments remain to preserve the group conversation. Their user link is removed and the sender is shown as “Passenger deleted.” Message content, timestamps, attachment metadata and stored files are therefore not automatically erased by account deletion.

Security

We use row-level access controls, private storage, server-side file validation, short-lived attachment links, session restrictions, signed flight candidates, request- origin checks and rate limits to reduce risk. No internet service can guarantee absolute security. Protect your credentials and remove unnecessary personal information from messages or files before sharing them.

Cookies and Browser Storage

Supabase Auth stores session information in browser storage so you can remain signed in. FindPassengers uses a signed first-party visitor cookie for anonymous flight-creation rate limiting and a functional language-preference cookie; each can remain for up to one year. Temporary session storage is also used to keep password-recovery sessions isolated from ordinary application access. These mechanisms are used for authentication, security and requested functionality.

FindPassengers uses Google Analytics only after you explicitly accept optional analytics cookies. It helps us understand general website usage and improve the service, including information such as pages viewed, approximate location derived from network information, device and browser characteristics, and interaction timing. We do not send claim or chat content, contact-form text, names or email addresses to Google Analytics through our implementation. You can reject analytics or later change or withdraw your choice using Cookie settings in the footer. Google processes analytics data under its applicable privacy and data-processing terms. We do not use this integration for advertising, remarketing or ad personalization.

Your Privacy Rights

Subject to applicable law, you may request access, correction, erasure, restriction or portability of your personal information, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. Rights can be limited by legal obligations and the rights of other passengers. Use the Contact page to make a request; we may need to verify your identity. You may also complain to the Dutch Data Protection Authority or the competent supervisory authority where you live or work.

Automated Decisions

FindPassengers applies automated eligibility, security and rate-limit rules to operate the platform, but does not use your personal information to make solely automated decisions that produce legal or similarly significant effects. In particular, the platform does not decide whether compensation is legally due.

Children

FindPassengers is intended for independent use by people aged 16 or older. People under 16 must not use FindPassengers independently. Where appropriate, a parent or legal representative may act on behalf of a minor. FindPassengers does not collect dates of birth and does not actively verify age. This rule does not determine or limit any right a minor may have as an airline passenger, including a possible right to compensation or another remedy.

Changes to this Privacy Policy

We may update this policy when the service, providers or legal requirements change. The date above shows the latest revision. Material changes will be communicated in an appropriate way where required.

Contact

For privacy questions or requests, use the Contact page. You can also contact HE Administraties at support@findpassengers.com, by telephone at +31 6 17437759, or by post at Boekerij 40, 1695 JB Blokker, The Netherlands.