Privacy Policy

This section is a plain-language overview. It does not replace the full text below.

• You connect your email account to DelayMoney. We use read-only access. We cannot send, delete or alter anything in your mailbox.
• We scan your mailbox to find flight bookings, delay, cancellation and denied-boarding notices that may give you a right to compensation or a refund.
• Email that is not flight-related is processed only momentarily in order to classify it, and is then discarded. It is not stored, not indexed, not used for advertising and never sold.
• We use automated analysis, including AI/machine-learning models, to identify flights and assess claims. Detailed processing is described in section 4.
• You decide which claims we pursue. We do nothing against an airline until you approve that specific claim.
• If a claim succeeds we deduct a 20% commission including VAT and pay the remainder to you.
• You can disconnect your mailbox at any time, which immediately revokes our access.
• We are the controller for this processing. Our supervisory authority is the Swedish Authority for Privacy Protection (IMY).

Herakles Analytics AB is a Swedish limited liability company, registered in Stockholm under company registration number 559448-3629. We are the controller for the personal data described in this policy.

This section is the core of this policy. Read it carefully before connecting your mailbox.

Withdrawal of consent. Where we rely on consent (purposes 2 and 12) you may withdraw it at any time, without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not affect claims you have already approved, which we continue to process under purposes 3–7.

Alternative to mailbox scanning. Connecting a mailbox is optional. If you prefer not to, you can send us your flight details directly at support@delaymoney.com and we will assess the claim from those details instead. This is why we can treat your consent to mailbox scanning as freely given.

Balancing tests. Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interest is not overridden by your interests or fundamental rights. You may request a summary of that assessment at support@delaymoney.com.

Our systems automatically classify messages and produce an initial assessment of whether a flight may qualify for compensation, and of the likely amount. This assessment is a proposal to you, not a decision about you. No claim is submitted, withdrawn or settled without your specific approval, and every case that proceeds is reviewed by a human case handler before substantive steps are taken against an airline.

We therefore do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. If we introduce such a decision in future, we will inform you in advance and provide the safeguards required by Article 22(3), including the right to obtain human intervention, to express your point of view and to contest the decision.

The automated assessment may be incomplete or wrong. It is not legal advice and does not guarantee any outcome.

We do not seek to process special categories of personal data (Article 9 GDPR) such as health data, religious or philosophical beliefs, trade union membership or data concerning your sex life or sexual orientation.

However, such data may incidentally appear in a mailbox or in a claim file, for example, a medical certificate submitted to justify a missed flight, a request for special assistance, or a meal preference that reveals a religious belief. Where such data is encountered:

• during scanning, in a message that is not relevant to a claim: it is discarded with the rest of the message under section 4.3 and never stored;
• where it is necessary in order to establish, exercise or defend a legal claim: we may process it on the basis of Article 9(2)(f) GDPR;
• where it is necessary for the claim and Article 9(2)(f) does not apply: we will ask for your explicit consent under Article 9(2)(a) before processing it.

We apply technical filtering intended to reduce the likelihood that irrelevant special-category data is retained, but we cannot guarantee that such data will never be captured in a retained message.

Your mailbox and your claim file contain personal data about individuals other than you, most obviously co-passengers on the same booking, but also travel agents, employers and the senders of the messages we scan.

• Data about senders of non-relevant messages is discarded under section 4.3 and is never stored.
• Data about co-passengers is processed on the basis of Article 6(1)(f) (establishing and exercising legal claims) and, where you pursue a claim on their behalf, on the basis of the authority you confirm you hold from them.
• You are responsible for ensuring that you are entitled to submit a claim on behalf of any other passenger and, where required, that they are informed. DelayMoney may ask you to provide a signed authorisation from each additional passenger before pursuing their claim.
• We rely on Article 14(5)(b) GDPR (disproportionate effort) in respect of individuals whose data we obtain from your mailbox and whom we cannot practicably contact; this policy, publicly available at delaymoney.com/en/privacy, serves as the information required by Article 14.

We disclose personal data only as set out below. We do not sell personal data, and we do not share it for advertising purposes.

Our primary infrastructure is located within the EU/EEA and we design the service so that personal data is stored in the EU/EEA.

Some processing may nonetheless involve a transfer to a country outside the EU/EEA, for example where a claim is directed against a non-EU airline, where a support provider offers follow-the-sun coverage, or where a subcontractor of one of our processors is established outside the EU/EEA.

Where such a transfer takes place we rely on one of the following:

• an adequacy decision of the European Commission for the country concerned;
• the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional technical and organisational measures identified in a transfer impact assessment; or
• for transfers to an airline or authority outside the EU/EEA that are necessary in order to pursue your claim, the derogation in Article 49(1)(e) GDPR (establishment, exercise or defence of legal claims), or Article 49(1)(b) where the transfer is necessary for the performance of our contract with you.

You may request a copy of the relevant safeguards at support@delaymoney.com.

We keep personal data only as long as necessary for the purpose for which it was collected, and thereafter only where a legal obligation requires it.

Where deletion is not immediately possible for technical reasons (for example in encrypted backups), we isolate the data from active processing and delete it when the backup cycle expires, normally within 30 days.

We apply technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS 1.2 or higher) and at rest;
• encryption of OAuth tokens and other secrets using a dedicated key-management service, with keys separated from the application database;
• least-privilege access control, individual named accounts, multi-factor authentication for administrative access, and logging of access to case files;
• a documented deletion and retention routine, including deletion on account closure;
• segregation of production and development environments, with no use of real mailbox content in development or testing;
• vulnerability management, patching and periodic penetration testing;
• written confidentiality undertakings and training for all personnel and contractors;
• Article 28 data processing agreements with all processors, with sub-processor controls; and
• a documented incident response procedure.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we notify IMY within 72 hours of becoming aware of it, and we notify you without undue delay where the breach is likely to result in a high risk to you.

No system is completely secure. Connecting a mailbox to any third-party service increases your exposure, and you should weigh that before connecting.

Under the GDPR you have the right to:

• Access - obtain confirmation of whether we process your personal data and a copy of it;
• Rectification - have inaccurate data corrected and incomplete data completed;
• Erasure - have your data deleted where one of the grounds in Article 17 applies;
• Restriction - have processing restricted in the circumstances set out in Article 18;
• Data portability - receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• Object - object at any time, on grounds relating to your particular situation, to processing based on legitimate interests; and to object at any time and without reason to processing for direct marketing;
• Withdraw consent - at any time, with effect for the future;
• Not be subject to a decision based solely on automated processing producing legal or similarly significant effects (see section 6); and
• Lodge a complaint with a supervisory authority.

These rights are not absolute. In particular, we may refuse erasure or restriction where the data is necessary for the establishment, exercise or defence of legal claims (Articles 17(3)(e) and 18(2)), for example, while a claim you approved is pending, or during the limitation period afterwards, or where we are legally required to retain it.

How to exercise your rights. Contact support@delaymoney.com or use the tools in your account. We respond within one month; where a request is complex or you have made several requests, we may extend this by two further months and will tell you if we do. Requests are free of charge, unless manifestly unfounded or excessive. We may need to verify your identity before acting.

Complaints. Our supervisory authority is Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden - imy@imy.se, www.imy.se. If you live or work in another EU/EEA state, or the alleged infringement occurred there, you may instead complain to your local supervisory authority. You also have the right to an effective judicial remedy.

We use cookies and similar technologies on delaymoney.com and in the app. Strictly necessary cookies are set on the basis of chapter 6, section 18 of the Swedish Electronic Communications Act (lag 2022:482). All other cookies, including analytics and marketing cookies, are set only with your consent, which you can withdraw at any time through the "Cookie settings" link in the footer.

We use three categories:

No analytics or marketing cookies are set unless you accept them in the cookie banner. You can change or withdraw your choice at any time via "Cookie settings" in the footer, or by clearing cookies in your browser.

DelayMoney is not directed at children. You must be at least 18 years old and legally capable of entering into a binding contract to create an account and to instruct us to pursue a claim. We do not knowingly process personal data of persons under 18 as users. Personal data of a minor may appear in a claim file where the minor is a co-passenger; in that case it is processed under section 8, on the authority of the parent or guardian.

We have assessed our processing under Article 37 GDPR and have not appointed a Data Protection Officer. Privacy questions and data subject requests are handled by our privacy team and should be sent to support@delaymoney.com. We will appoint a DPO and update this policy if the scale or nature of our processing makes one mandatory.

We have carried out a data protection impact assessment under Article 35 GDPR in respect of mailbox scanning and AI-assisted analysis, and we review it whenever the processing changes materially. A summary is available on request.

We may update this policy. The current version, its version number and its effective date are always published at delaymoney.com/en/privacy. Where a change materially affects you, in particular a change to the purposes of processing, to the categories of recipients, or to the scope of mailbox access, we will notify you by email at least 30 days before it takes effect and, where the change requires it, ask for your renewed consent. Continuing to use the service after the effective date constitutes acceptance of the updated policy, except where consent is legally required.

This policy and any dispute arising from it are governed by Swedish law and by directly applicable EU law, without prejudice to any mandatory consumer protection rules of the country in which you are habitually resident.

Herakles Analytics AB, reg. no. 559448-3629, Stockholm, Sweden.