Two different relationships
Claim Core sits in two roles at once, and your rights differ depending on which one applies to you.
- We are the controller for the accounts of the logistics businesses who buy Claim Core, and for the people who work there. That covers names, work email addresses, sign-in records and billing details.
- We are a processor for the claims data our customers put into the platform. That includes order records drawn from a warehouse system, and the shopper details attached to a claim. Our customer decides what goes in and why. We act on their instructions.
If you are a shopper who raised a claim through a brand's claims page, the brand and its logistics provider are the controllers. Contact them first. We will always help them answer you.
What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Name, work email, role, organisation | To give you access and apply permissions |
| Sign-in and security | Timestamps, session activity, audit events | To keep accounts secure and give customers an audit trail |
| Claims data | Claim details, line items, comments, uploaded evidence | To run the claims process our customer bought the product for |
| Order data | Order and despatch records mirrored from a connected warehouse system | To attach operational evidence to a claim |
| Shopper data | Name, contact details and delivery postcode on a consumer claim | To identify the order and to send the outcome back |
| Billing | Plan, subscription status, invoices | To operate the subscription |
| Demo enquiries | Name, work email, company, role, and anything you write in the message | To reply to you about a demo. We do not add you to a mailing list and we do not share it |
| Marketing page visits | The page, the site you arrived from (its address only), any campaign tag in the link, a broad device type and your browser's name | To count how our own public pages are used. There is no identifier of any kind, so a visit cannot be traced to a person or linked to another visit |
We do not sell personal data, we do not share it for advertising, and we do not build profiles for any purpose beyond running the service.
How long we keep it
These periods are enforced by scheduled jobs in the product, not by intention alone.
- Mirrored order records are deleted 180 days after they arrive, unless a claim is attached to them.
- Pack-station video is deleted 90 days after the claim it belongs to is decided.
- Claims and their audit trail are kept for as long as the customer's account is open, because a claim is a commercial record and the audit trail is deliberately immutable.
- Account data is deleted when an account closes, except where we must keep records for tax or accounting.
- Demo enquiries are deleted 365 days after they reach us, once somebody has dealt with them, or sooner on request. An enquiry nobody has dealt with is never deleted automatically, because that is a person still waiting for a reply.
- Marketing page visit counts are deleted after 400 days. They contain no identifier, so there is nothing in them to trace back to you.
Who else processes data
We use a small number of sub-processors. UK data protection law requires us to name them, so we do.
| Provider | Purpose |
|---|---|
| Railway | Application hosting and database |
| Amazon Web Services | Storage of uploaded evidence files |
| Stripe | Subscription payments. Card details go to Stripe and never reach our servers |
| Resend | Transactional email delivery |
| Sentry | Error monitoring |
| Anthropic, OpenAI, Google | Optional AI-assisted claim review, only for customers who switch it on |
AI-assisted review is off by default. When a customer enables it, claim text is sent to their chosen provider to generate a recommendation. It is never used to train third-party models.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict processing. Write to privacy@claimcore.co.uk and we will respond within one month.
If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
Where data is held
Application data is held in the United Kingdom or the European Economic Area. Where a sub-processor transfers data outside that area, the transfer relies on UK approved safeguards, in most cases the International Data Transfer Addendum to the European Commission's standard contractual clauses.
Cookies
We set a session cookie so you stay signed in, and a security token cookie that protects forms against cross-site request forgery. Both are strictly necessary, so neither requires consent. We run no advertising or third-party analytics cookies.
On our public marketing pages we count page views ourselves, on our own servers, without cookies. We record the page, the site you arrived from (its address only, never the full link), any campaign tag in the link, a broad device type and your browser's name. We never record your IP address, we set no visitor identifier, and nothing we keep could single you out or follow you between visits. Nothing is sent to anyone else.
We also count three moments on the same basis, with the same fields and no identifier: reaching the sign-up page, submitting a demo enquiry, and completing a registration. These tell us whether the public pages lead anywhere, nothing more. The sign-up page is the one page outside our marketing site that is counted this way, because it is where our own "Start free" links land. A campaign tag is kept exactly as it appeared in the link you followed, so please treat a link you did not expect with the same caution you would anywhere else.
Changes
If we change this policy in a way that materially affects you, we will tell account holders by email before it takes effect.