This English version is part of the information and contractual terms given to English-speaking customers. If the Hebrew and English versions differ on fees, payments, cancellation rights or other customer rights, the English version prevails for a customer who entered into the service in English.
Data Security and Trust
Correct as of 6 Nov 2026 · This page describes what is actually implemented, not general statements
Where your documents are kept
Every document you upload (boarding pass, ID, receipt, a reply from an airline) is kept in private cloud storage (Supabase Storage, servers in the European Union) and is not publicly accessible. No file has a public address: access requires authorised server-side access or a time-limited signed link that the system issues for 1 hour only.
Who can access it
Access to the database and the documents is through server keys only. A customer sees their own case through a long, unique token sent to them personally, or after verifying the phone number in the case. The only operator of the system is the business owner, through a separate admin sign-in. No unauthorised third party has access to customer cases. The service providers described in our privacy policy may process limited case information where necessary to provide their services.
Integrity of the evidence
Every flight record captured from the Ben Gurion flight board is stored with a SHA-256 fingerprint of its content, and every document produced in a case (power of attorney, demand letter) is fingerprinted the same way at the moment it is created. The case event log is append-only: the database itself blocks any change to or deletion of past events. The full methodology: our method page.
How long we keep things, and what is deleted
Customer case records and documents are generally kept for 7 years after the case is closed, where required or reasonably necessary for legal, tax, accounting or dispute-related purposes. Leads that did not become a case are deleted after 24 months, bot conversations after 12 months, and the payment method token is deleted after the fee is collected. Encrypted backups are kept for 90 days and deleted on rotation. You may ask us to delete information earlier. We will do so where we can, subject to legal, accounting, fraud-prevention and dispute-related retention obligations. Ask by email or WhatsApp.
Use of artificial intelligence
The system uses a language model (Anthropic Claude) for three tasks only: reading documents you uploaded (for example, finding a date on a ticket), classifying replies from airlines, and drafting texts that may be reviewed before they are used, according to the workflow applicable to that task (the WhatsApp bot's answers to questions about a case are sent automatically, from the case data only). Each such request is limited to the data of that single case. Under the service terms and data settings applicable to FlyBack's account, the provider is not permitted to use the information to train its models, and every legal calculation (amounts, deadlines, eligibility) is done by fixed code, not by the model.
What we do not do
- We do not sell information or pass it to mailing lists. If you have consented to measurement and marketing cookies, then to measure advertising, hashed identifiers (SHA-256) of email, phone and first name are sent to Meta, as described in section 3 of the privacy policy. Without that consent, they are not sent.
- We do not normally ask for a copy of your ID when a case is opened. Identity details may be requested later where required for a court self-filing process, or where the airline or another relevant body requires them.
- We do not store credit card numbers: payment is processed only through the payment processor's token.
- We do not run advertising tracking on personal case pages.
Questions about privacy and security: Itamar Avisris, Israeli VAT-registered sole proprietor, VAT ID 35994557 · Full privacy policy · our method page