Refundly
← Back to home

Privacy Policy

How Refundly collects, uses, and protects your information across the marketing website, web app, and Android app.

Last updated: 21 July 2026

1. Who we are

This Privacy Policy explains how Refundly ("we", "us", "our") handles personal data when you use:

For privacy questions, contact us at hello@refundly.uk.

Refundly is a UK consumer self-help product. We are not a law firm and do not provide regulated legal services.

2. Plain-English summary

  • Browsing the marketing site alone does not require an account and we do not sell your data to advertisers.
  • Rights guidance (categories, issues, plain-English law extracts) can be used without signing in.
  • Claims, timelines, evidence, and Premium require a Refundly account (email and password). The same account works on web and Android.
  • We do not connect to your bank or read your transactions. We do not use advertising trackers or sell personal data to data brokers.
  • Claim content and evidence files you add are stored in your account so they can sync and so you can export an evidence pack.

3. What this policy covers

We describe:

  • What data we collect and why
  • Our legal bases under UK GDPR
  • Who processes data for us (service providers)
  • How long we keep data
  • Your rights and how to contact us

This policy should be read with our Terms of Use.

4. Data we collect

4.1 Marketing website (browsing only)

If you only visit marketing pages (home, blog, FAQ, legal pages) and do not create an account or open the product app, we do not ask for your name, email, address, or payment details.

We may process limited technical and usage data, for example:

  • Vercel Analytics — aggregate page views and traffic patterns
  • Vercel Speed Insights — performance metrics (how quickly pages load)
  • Standard server/hosting logs needed to operate and secure the site (e.g. IP address in temporary logs, browser type)

These tools are used to understand and improve the site. They are not used to build advertising profiles or track you across third-party websites for ads. See Vercel's Analytics privacy documentation.

4.2 Product — free rights guidance (no account)

You can browse categories, issues, and rights content in the web app without signing in. In that mode we do not store claim content against an identity. Technical analytics or hosting logs may still apply as above when the product is served from our website infrastructure.

4.3 Product account (web app and Android)

When you create or sign in to a Refundly account, we process:

  • Account credentials — email address and password (authentication via Google Firebase Authentication). We do not store your password in plain text; Firebase handles secure credential storage.
  • Account identifiers — a unique user ID used to associate your claims, Premium status, and files with your login.

One account is intended for both the website product and the Android app so Premium and claims can stay in sync.

4.4 Claims, plans, and timelines

If you use Premium claim features, you may enter information such as:

  • Your name, email, address, and other details you type into claim forms (for letters and records)
  • Merchant, order, payment-method labels, remedy preferences, and problem descriptions
  • Plan progress (steps completed, claim status such as active, resolved, or abandoned)
  • Timeline entries (event type, date, notes) recording what happened in your dispute

This content is stored in Google Cloud Firestore under your user account so it can be shown on web and Android and included when you export an evidence pack.

4.5 Evidence files (attachments)

You may upload screenshots, photos, PDFs, or other files to a timeline entry. Those files are stored in Google Cloud Storage (Firebase Storage) and linked to your claim. Only your signed-in account is intended to access them (subject to our technical access controls and the providers below).

When you export an evidence pack, a copy of your timeline summary and files may be assembled on your device (Android) or in your browser / our website infrastructure (web) so you can download a zip for your own use (e.g. ombudsman, chargeback, records).

4.6 Premium and promo codes

  • Google Play Billing (Android) — if you buy Premium on Android, Google processes the payment. We receive entitlement information needed to unlock Premium on your account. We do not receive your full card number.
  • Account Premium status — stored with your user profile (e.g. whether Premium is active, source such as purchase or promo, and any promo expiry if applicable) so web and Android stay aligned.
  • Promo codes — if you redeem a code, we record that your account redeemed that code (to enforce one-use-per-account and code limits) and apply the corresponding Premium grant.

Card payments on the web (e.g. Stripe) may be added later; if they are, this policy will be updated before or when that feature launches.

4.7 Communications you send us

If you email support or feedback (e.g. hello@refundly.uk), we process the content of your message and your email address to respond.

4.8 Device and app technical data (Android)

The Android app may process device-related technical information needed to run the app, deliver notifications (e.g. deadline reminders you enable), store data locally on the device, and complete Play purchases — consistent with normal mobile app operation and Google Play policies.

5. How we use your data

We use personal data to:

  • Provide, secure, and maintain the website and product
  • Authenticate you and keep your claims, timeline, and evidence available across web and Android
  • Deliver Premium features and honour promo or purchase entitlements
  • Generate templates and exports from information you supply
  • Respond to support and feedback
  • Understand aggregate usage and performance of the marketing site (Vercel analytics)
  • Comply with law, prevent abuse, and protect our rights and users

We do not use your claim content or evidence files for advertising. We do not sell personal data.

6. Legal bases (UK GDPR)

Depending on the activity, we rely on:

  • Contract — providing the account, claims, sync, Premium, and related features you request
  • Legitimate interests — securing the service, improving the product, understanding site performance, preventing fraud and abuse (balanced against your rights)
  • Legal obligation — where we must keep or disclose information to comply with law
  • Consent — where we ask for it (for example certain optional notifications or cookies, if introduced later)

7. Who we share data with

We use service providers who process data on our instructions ("processors"), including:

  • Vercel — hosting the website and web app; Analytics and Speed Insights
  • Google (Firebase / Google Cloud) — Authentication, Firestore, Cloud Storage, and related infrastructure for accounts, claims, and evidence files
  • Google Play — distribution of the Android app and Premium billing on Android

These providers may process data in the UK, EEA, United States, or other locations where they operate. Google and Vercel offer contractual and technical measures for international transfers (including standard contractual clauses where applicable). You can review their privacy documentation for details.

We may also disclose information if required by law, court order, or to protect rights, safety, or security — or in connection with a business transfer (e.g. merger), with appropriate safeguards.

We do not share your claim evidence with other companies for their marketing.

8. Cookies and similar technologies

The marketing site and web app may use essential cookies or similar storage needed for security, session, and core functionality (including Firebase Authentication session state in the browser).

Vercel Analytics / Speed Insights may use privacy-oriented measurement technologies as described in Vercel's documentation. We do not use third-party advertising cookies or social media tracking pixels for ad targeting.

9. Retention

  • Account and claim data — kept while your account remains open and as needed to provide the service
  • Evidence files — kept while associated with your account / claims, unless you remove them or we delete them on account closure
  • Promo redemptions — retained as needed to enforce code rules and entitlement history
  • Support emails — retained as long as reasonably needed to handle your request and keep business records
  • Analytics and logs — retained according to our providers' defaults and our operational needs, typically for short periods for logs

If you ask us to delete your account, we will delete or anonymise personal data we control unless we must retain some information by law (e.g. fraud prevention, legal claims).

10. Security

We use industry-standard providers (Firebase / Google Cloud, Vercel) and access controls so that claim and file data is associated with your authenticated user ID. No method of transmission or storage is 100% secure; please use a strong unique password and keep your credentials confidential.

11. Your rights (UK GDPR)

You may have the right to:

  • Access personal data we hold about you
  • Correct inaccurate data
  • Request deletion ("erasure")
  • Restrict or object to certain processing
  • Data portability (where applicable)
  • Withdraw consent where processing is based on consent

To exercise these rights, email hello@refundly.uk. We may need to verify your identity (for example by confirming control of the account email).

You can also sign out of the product at any time. To close an account and request deletion of cloud claim data, contact us at the email above (self-serve account deletion may be added in the product later).

You may complain to the UK Information Commissioner's Office (ICO): ico.org.uk. We would appreciate the chance to resolve concerns first.

12. Children

Refundly is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact hello@refundly.uk and we will take appropriate steps.

13. International users

Refundly is designed for UK consumers and UK consumer law guidance. If you access the service from outside the UK, your information may still be processed in the UK/EEA and in countries where our providers operate, as described above.

14. Changes to this policy

We may update this Privacy Policy from time to time (for example when we add web payments or new features). The "Last updated" date at the top will change. Material changes may also be highlighted on the website or in the app. Continued use after an update means you accept the revised policy where permitted by law.

15. Contact

Privacy requests and questions: hello@refundly.uk

Website: https://refundly.uk