Privacy Policy

What We Collect

We collect information you provide directly to us, including:

• Account information from Google (name, email address) when you sign in
• Bank transaction data you upload (CSV or PDF files)
• Emails you forward to your unique mailbox address
• Information about claims you track through our service

We do not access your bank accounts directly. We only process data that you explicitly provide to us through file uploads or email forwarding.

How We Process

We process your data to identify potential refunds and compensation opportunities. This involves:

• Parsing and categorising your transactions
• Extracting relevant information from forwarded emails
• Matching transactions and emails to known refund schemes
• Generating personalised claim instructions

Processing is automated. Nobody at Untap reads your documents as part of the service. We look at a document, or what was read from it, only to fix a reading error or when you ask us for help.

Where We Store

Your account data is stored in Supabase’s London region. We use industry-standard encryption for data in transit and at rest. Reading a document sends its contents to OpenAI, which may process it outside the UK; see below.

We use Supabase for our database and storage infrastructure. Supabase maintains SOC 2 Type II compliance.

AI Processing (OpenAI)

To read the booking confirmations, statements, and documents you submit, Untap sends the contents of those documents to OpenAI's API for extraction and, in some categories, for drafting claim letters or appeal text. This is the only way the structured data on your dashboard gets created.

We use OpenAI under their commercial API terms. Under those terms:

• OpenAI does not use API inputs or outputs to train their models.
• OpenAI retains API data for a short period (currently 30 days) solely to investigate abuse, after which it is deleted.
• Processing happens on OpenAI's infrastructure, which may include data centres outside the EEA. OpenAI is certified under the EU-US Data Privacy Framework.

We send OpenAI the document content you provide, which can include passenger names, booking references and other details printed on it. We do not attach your account login tokens or internal account identifiers. For full details, see OpenAI's API data-usage policies.

AI output can be wrong or incomplete. Anything Untap surfaces is a suggestion, not verified legal or financial advice. Please double-check before acting on it.

Using an AI assistant

When you connect Claude, ChatGPT or another MCP-compatible assistant, Untap receives the inputs that assistant sends to a tool. We do not receive your whole conversation or access other chats. Your assistant provider handles the conversation under its own policy.

Public checks process your inputs without saving your booking, document, journey rows or result to an account. To verify a journey, we send the necessary station, airport, flight number and date information to National Rail or our flight-data provider. We keep technical usage records such as the tool name, outcome and duration. Rate counters use a salted digest of the caller’s IP address.

So we can check that public answers are right, we keep a record of each public check for one year. For a train or flight check it holds what was checked (stations or airports, date, train time or flight number, operator, ticket type and price if given) and the answer we gave. For TfL journeys, emails and free-text questions it holds counts only, never the journeys, the email text or your words. To help us fix problems, each record also notes the name the calling app gives itself, the country the request came from and, if the check failed, the error. These records carry no name, email address, account or IP address, and are deleted after a year.

If you ask an assistant to save a claim, journey or commute, we store the supplied details in your account until you delete them. A saved commute is checked only when you ask; it does not start background monitoring or submit claims. Account tool calls also leave usage records linked to your account for security and connected-app management.

Supabase manages account authentication and OAuth tokens. You grant an assistant access through the Untap sign-in and consent screens. You can revoke it on the connected assistants page. Revoking access does not delete saved claims. Delete saved data through Your Data or the assistant’s two-step delete tool. Untap never asks your assistant to file a claim or transfer money.

Who We Share With

We do not sell your personal data. We share only what is needed to run the service, with:

• Supabase · our database and authentication provider (UK region).
• OpenAI · for AI extraction and drafting (see above).
• Vercel · for hosting the web application.
• Law enforcement only if required by law or to protect our legal rights.

We do not share your financial data or transaction information with third parties for marketing purposes.

How Long We Keep

We retain your data for as long as your account is active. You can delete your data at any time through the Your Data page. When you delete your account, we remove all your personal data within 30 days.

We may retain anonymised, aggregated data for analytical purposes, but this cannot be used to identify you.

Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Erase your personal data
• Restrict processing of your personal data
• Data portability (receive your data in a structured format)
• Object to processing of your personal data

You can exercise most of these rights directly through the Your Data page. For other requests, contact us at contact@untap.money.

Contact

For any questions about this privacy policy or our data practices, please contact:

Data Protection Officer
Untap
Email: contact@untap.money

ICO Complaint Right

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk