Privacy Policy

Who is responsible

RefundPilot ("we", "us") operates refundpilot.org. For any privacy question or request, write to support@refundpilot.org.

What we collect

• Guides and public pages: you can read them without an account. Our servers log standard technical data such as IP address, requested page, and browser type when pages are delivered.
• Account details: if you sign in with Google or email and password, we receive your email address, name, and a sign-in identifier through Firebase Authentication. If you fill in the optional profile fields (such as country, usual dispute type, how you found us), we store those too.
• Case content: the description of your problem, merchant name, amounts, dates, and any notes you type into the workspace, plus the claim materials generated from them. Signed-in users' cases are stored in our database so you can come back to them. Drafts made while signed out are not saved to an account.
• Attachments: files you add as proof stay in your browser. We receive only the file name, size, and type, and, for text-like files, a short excerpt of up to about 1,000 characters that can be used in drafting.
• Messages you send us: if you email support@refundpilot.org, we keep the message and our reply.

Do not enter sensitive data

Please do not type full card numbers, bank account numbers, passwords, government ID numbers, or health information into the workspace. They are not needed to build a refund request, and text you enter is sent to an AI provider for drafting. Mask card numbers to the last four digits.

Why we use it

In the EU and UK, our legal bases are performing the service you asked for, our legitimate interest in running and securing the service, and, where required, your consent. We do not sell your personal information and we do not use it for advertising.

• To provide the workspace: generate, save, and show your claim materials.
• To run sign-in and keep your account secure.
• To keep the service working, prevent abuse, and fix problems.
• To answer your emails and corrections.

Who processes your data

These providers act on our behalf under their own terms and privacy commitments. Some of them may process data outside your country, including outside the EU or UK, using the transfer safeguards they offer.

• Google (Firebase Authentication, Google Cloud hosting and database services): runs sign-in and stores account and case data. Our database is hosted on Google Cloud in Europe (Belgium region).
• OpenAI: the text of your case that is needed to draft claim materials is sent to the OpenAI API when you generate a draft. We use it only to produce your drafts.

Cookies and tracking

We do not use advertising or analytics cookies. Firebase Authentication stores a sign-in session in your browser storage so you stay signed in. You can clear it at any time by signing out or clearing site data.

How long we keep it

Case content and account details are kept until you delete the case or ask us to delete your data. Server logs are kept for a limited period for security and troubleshooting.

Your choices and rights

You can delete individual cases yourself in the workspace. To delete your account data, or to ask for access to a copy, correction, portability, or restriction, or to object to processing, email us from the address you signed up with. Depending on where you live (for example in the EU, the UK, or California) you have legal rights over your personal information, and you can complain to your local data protection authority.

Email support@refundpilot.org and we will respond within a reasonable time, and in any case within the period required by law.

Children

RefundPilot is not intended for children under 16, and we do not knowingly collect their information.

Changes to this policy

We may update this policy as the product changes. The date at the top shows the latest version. If a change is significant, we will say so on this page. Last updated: 2026-10-18.