1. Controller and contact
The controller is NOVOGROUP SYSTEMS S.R.L., Municipiul Zalău, Strada Gheorghe Șincai nr. 38A, județ Sălaj, 450077, România, CUI 39736070, J31/66/2023.
Privacy questions and rights requests go to contact@recouplane.com. No formal data protection officer (DPO) is designated for the current beta. The same monitored address is the privacy contact.
2. Current scope
The public information and browser-only checklist are available globally. Private free-beta activation is limited to adults declaring residence in the European Union, the European Economic Area or the United States. The United Kingdom, Switzerland and other markets are excluded from private activation.
Private intake is currently unavailable while email delivery, Cloudflare Turnstile, production storage, provider contract evidence and international-transfer evidence are completed. The malware scanner has passed synthetic technical validation, but it has not processed private user documents. Do not send case documents by email.
3. Data we process
Public site and checklist
- Technical request and security data, such as IP address, date, route, user agent and response status.
- A checklist draft stored in your browser session when you choose to use the public checklist. It stays on your device unless you ask the browser to carry it to a later product step; no private case is created while intake is unavailable.
- Messages and contact details you choose to send to our support or privacy address.
Private workspace, when activated
Account email, authentication and security events; journey and delayed-baggage facts; traveller details; uploaded evidence; expense and prior-reimbursement records; generated packs; user confirmations; support correspondence; and policy-acceptance and audit records. We ask users not to upload unnecessary government identifiers, health data, bank credentials or information about other people.
4. Why and on what basis
- Contract or steps requested before entering it: provide the checklist and, once activated, the account, private workspace, pack generation and support requested by you (GDPR Article 6(1)(b)).
- Legitimate interests: keep the public site reliable, secure the service, prevent abuse, investigate failures and defend legal claims, balanced against individual rights (GDPR Article 6(1)(f)).
- Legal obligation: retain and disclose records where applicable law requires it (GDPR Article 6(1)(c)).
- Consent: only for a genuinely optional use where refusal and withdrawal are available; no optional analytics processing is active now.
5. Providers and disclosures
| Provider | Current status | Confirmed purpose |
|---|---|---|
| Hetzner | Active | Processor for hosting the current public site and its network, request and security metadata. Account-level contract and transfer evidence is being verified. |
| Cloudflare proxy and CDN | Active | Processor for routing and protecting public-site traffic, terminating HTTPS and handling request metadata such as IP address, user agent, requested route and security signals. Account-level contract and transfer evidence is being verified. |
| Cloudflare Email Routing | Active | Routes messages sent to contact@recouplane.com to the controller's destination mailbox. Routing events can include sender, recipient, subject, message identifier and delivery decisions and are available in Cloudflare's dashboard for up to 31 days. Do not email claim documents or sensitive case evidence. |
| Google Gmail | Active remediation | Destination mailbox used by the controller for support and privacy correspondence. The current account is not an approved Google Workspace processor deployment, so private intake remains closed and the mailbox must not be used for claim documents or sensitive case evidence. |
| Oracle Cloud | Pre-activation | Effective 27 August 2026, an isolated malware scanner configured in Milan, Italy has been validated with synthetic clean and test-malware files only. It has not processed private user documents. Before the first real document scan, its Article 28 and Chapter V evidence must be verified, this notice must identify it as active, and the changed notice must receive a new Privacy digest and ratification. |
| Resend | Configured, not activated | Proposed transactional email from notifications@recouplane.com. The sending domain is verified in Resend's Ireland region and four synthetic acceptance messages were delivered, but no real user email is sent. Bounce, complaint and suppression webhooks and transfer evidence must pass before activation; open and click tracking remain disabled. |
| Cloudflare Turnstile | Not activated | Proposed sign-in abuse prevention; production behavior must first be validated. |
| AWS S3 | Not activated | Proposed private object storage in Frankfurt; no case intake uses it now. |
Private account, case and document data is not sent to a pre-activation provider until its GDPR Article 28 processor terms and GDPR Chapter V transfer evidence are complete. Hetzner and Cloudflare already process public-site or email-routing metadata. Cloudflare's self-service terms incorporate its current customer DPA; the exact service-location and transfer record remains incomplete and is being documented internally. The Google destination mailbox remains an immediate remediation item. We do not sell personal data or claim an unverified transfer safeguard.
No optional website, product or marketing analytics service is active. There is no advertising, profiling, session replay or heatmap tracking. Necessary security and email-routing metrics remain as disclosed above.
6. Retention and deletion
- Authentication sessions expire after 12 hours.
- An inactive account or case receives a warning after 12 months; absent renewed activity, deletion begins 30 days later.
- Confirmed deletion blocks normal access immediately and uses a 14-day recoverable-deletion period before active records and files are purged, unless a documented legal hold applies.
- Copies in backup or object-version storage must expire or become inaccessible no later than 35 days after active-system purge.
- Identifiable security and access logs are kept for no more than 90 days.
- Minimal policy acceptance, rights-request and complaint evidence may be kept for three years after account closure or the last relevant event.
Document contents are not part of the three-year legal-record category. Recovery has not been exercised and recoverability remains unverified; this notice makes no disaster-recovery assurance.
7. Your GDPR rights
Where the GDPR applies, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. You may also ask about a decision based solely on automated processing; RecoupLane does not make automated airline-eligibility or reimbursement decisions.
Contact us first at contact@recouplane.com. You may lodge a complaint with Romania's ANSPDCP or another supervisory authority competent for your location.
We respond without undue delay and normally within one month after receiving a valid request. Where necessary because of complexity or the number of requests, that period may be extended by two further months. We will tell you about the extension and its reasons within the first month.
8. Applicable US privacy rights
Where an applicable US state privacy law covers RecoupLane and grants the relevant right, you may request access to or knowledge of personal information, correction, deletion or a portable copy, and may opt out of sale, sharing or targeted advertising or request limits on sensitive-data use. RecoupLane does not sell personal information or use it for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable right. Statutory exceptions may apply.
9. Security and age
The service is designed around private storage, least privilege, short-lived access, audit records and malware quarantine. Scanner behavior has been validated with synthetic files, but the complete safeguards remain unavailable for real intake until the other operational and provider-evidence requirements are complete. The private beta is for adults aged 18 and over; we do not knowingly offer it to children.
10. Changes
We will publish a new effective date and policy version for material changes and request renewed agreement where required.