Privacy Policy

1. The data we collect

We collect the following, depending on how you use the Service:

• Identity and contact data: your name, postal address, email address and phone number. We use these to prepare and submit your appeal in your name, to contact you, and to collect them at payment where you have not already given them.
• Vehicle and notice data: your vehicle registration, the PCN or charge reference, the issuing council or operator, the location, the dates and times, and the contravention or alleged breach.
• Uploaded images: the photo of your notice and any supporting evidence images you choose to upload.
• Appeal content and correspondence: any background, grounds or free text you give us to strengthen your appeal, and the correspondence between you, us and the issuer about your case.
• E-signature data: when you sign a form that authorises us to act for you (for example our Customer Authority & Consent form), we collect your electronic signature together with the details on the form, the date and time you signed, and signing audit data (such as the email address the request was sent to and the IP address used to sign). This is processed through our e-signature service, described in section 4.
• Account data: your email address and authentication details when you create an account.
• Payment data: payment is handled by Stripe. We receive confirmation and limited metadata (such as amount, currency, and a transaction reference); we do not receive or store your full card number.
• Usage and device data: basic technical information and cookies needed to run the Service, keep you signed in, attribute referrals, and note how you found us.

We do not deliberately seek special category data (such as health or disability information). If you choose to include it in your own account of events to support an appeal, we process it on the basis set out in section 3 so that we can act on your instructions.

2. How we use your data

• To read your notice and prepare an appeal in your name.
• To take and record your authority to act for you, including through an electronic signature.
• To submit your appeal to the relevant council or parking operator, and to correspond about it on your behalf.
• To take payment and apply any discount or referral code.
• To provide your account, dashboard, and appeal history.
• To provide customer support.
• To operate, secure, and improve the Service, prevent fraud and abuse, and enforce limits such as discount-code usage.
• To comply with our legal obligations.

3. Our legal bases

• Performance of a contract: to deliver the appeal service you ask for, including taking your authority to act, preparing your appeal and submitting it to the issuer.
• Consent: where we ask for it, for example for non-essential cookies, and where you choose to give us sensitive details to use in your appeal. You can withdraw consent at any time.
• Legitimate interests: to run, secure, and improve the Service, and to prevent fraud, in a way that does not override your rights.
• Legal obligation: where we must keep or disclose data to comply with the law.

4. Who we share data with

We share personal data only as needed to run the Service, with providers acting under contract on our instructions. Our main processors are:

• Stripe — to process payments.
• Supabase — our database and the secure file storage that holds your account, your cases and your uploaded images.
• Vercel — hosting and content delivery for the website and its application.
• Our e-signature service (Documenso) — self-hosted by us on our own server located in Germany (EU), reached at sign.appealgo.com. When you sign a form that authorises us to act, the details on the form, your electronic signature and the signing audit data are processed on this server. It is run by us, not by a third-party signing company.
• Email providers (Migadu and Purelymail) — to send and receive appeal and support correspondence.
• AI providers — to read the text on your notice and help draft your appeal. We send the relevant image and details for this purpose. The appeal is prepared from your own facts and the grounds that apply; it is reviewed before it is filed.
• Councils and parking operators — we submit your appeal, which contains your details, to the body that issued the notice. This is the core purpose of the Service.

We may also disclose data if required by law, to protect our rights, or in connection with a business sale or reorganisation. We do not sell your personal data.

5. International transfers

We keep your core case data and your e-signatures within the UK and the EU. Some of our providers may process limited data (for example payment or support metadata) outside the UK. Where they do, we rely on appropriate safeguards, such as UK adequacy regulations or standard contractual clauses, to protect your data.

6. How long we keep it

We keep your data for as long as you have an account and your appeals are active, and afterwards only as long as needed for the purposes above, including to handle queries, resolve disputes, and meet legal and accounting requirements. We keep signed authority forms and their signing records for as long as we may need to show that we were authorised to act for you. We then delete or anonymise your data. To analyse usage and avoid re-processing identical uploads, we may retain a hashed fingerprint of an uploaded image and the analysis derived from it.

7. Security

We use technical and organisational measures to protect your data, including encryption in transit, access controls, and restricting access to those who need it. No system is completely secure, but we work to keep your data safe.

8. Cookies

We use cookies and similar technologies that are necessary to run the Service, for example to keep you signed in and to attribute a referral when you arrive via a referral link. Two first-party cookies note how you first and most recently found us (the website or campaign link you came from, and the page you landed on) so we know which channels bring people to AppealGo. They last 90 days, are not shared with anyone, and we do not use any cookie to build advertising profiles.

9. Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability; and
• withdraw consent where we rely on it.

To exercise any of these, email support@appealgo.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to help first.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. We will change the date at the top of this page when we do.

12. Contact

For any privacy question or request, email support@appealgo.com.