Version 2026-07-21.1

Privacy notice

Controller

CODIFY AI SRL, 681 CAM 2, 307102 Sat Checea, Timis, Romania ("we"), registered in Romania (CUI 51174729, Trade Register no. J2025004646003), is the data controller for this service. Contact for privacy matters: privacy@itsowed.com.

Data we process

Identity and contact details (name, email); case facts you provide (e.g. flight, booking reference, delivery or purchase details); correspondence sent and received about your case, including messages exchanged with the counterparty through your dedicated case address; documents you upload as evidence; consent and authorization records (terms version, timestamps); technical and security logs (IP address, request metadata); and — when payments are enabled — payment-provider identifiers. Card data is handled by Stripe and is never stored by this service.

Purposes and legal bases (Art. 6 GDPR)

Performing the service you request — assessing eligibility, preparing and sending claims, managing deadlines and escalation, paying out and charging the agreed fee: Art. 6(1)(b) (contract). Legal obligations — accounting and tax record-keeping under Romanian law: Art. 6(1)(c). Security, abuse prevention, and service improvement — rate limiting, security logs, malware scanning of uploads: Art. 6(1)(f) (legitimate interest). Establishing, exercising, or defending legal claims — retaining case records after closure: Art. 6(1)(f).

Recipients and processors

Your data is shared only as needed for your case: the named counterparty (e.g. the airline or merchant) and, where escalation requires it, the competent enforcement body, ADR entity, or legal partner. Infrastructure processors: Hetzner Online GmbH (hosting, Germany/EU), Cloudflare, Inc. (DNS), Stripe (payments, under its EU data-protection commitments), and our self-hosted mail system (EU). We do not sell data and do not use it for advertising.

Retention

Case records are kept for the life of the case and for 3 years after closure, to handle follow-up questions and to establish or defend legal claims within typical limitation periods. Invoicing and accounting records are kept as long as Romanian accounting law requires. Security logs are kept for up to 12 months. Data no longer needed is deleted.

Your rights

You may request access, rectification, erasure, restriction, or portability of your data, and object to processing based on legitimate interest, by writing to privacy@itsowed.com. You may lodge a complaint with the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro) or the supervisory authority of your habitual residence.

International transfers

Processing takes place in the EU. Where a processor (e.g. Stripe or Cloudflare) transfers data outside the EEA, it does so under the European Commission's Standard Contractual Clauses or an adequacy decision.