Effective date: February 2026
Last updated: February 2026
This Privacy Policy explains how FareGuard collects, uses, stores, and protects personal data when you use our services.
FareGuard is committed to processing personal data lawfully, fairly, and transparently in accordance with:
FareGuard is the data controller responsible for the personal data described in this policy.
Controller legal name: FareGuard Ltd
Registered address: 64 Lincoln Street, Birmingham, B12 9EX
Company number: 16810407
Website: https://fareguard.co.uk
Email: hello@fareguard.co.uk
FareGuard has determined that it is not required to appoint a Data Protection Officer. Data protection enquiries may be directed to the contact details above.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk
FareGuard is a software service that helps identify potential UK rail delay compensation eligibility.
When you connect your Gmail account using Google OAuth, FareGuard performs automated processing to detect rail booking confirmation emails and extract relevant journey data.
Our data processing pipeline is designed around strict data minimisation:
Where you connect Gmail, we access booking confirmation emails issued by rail operators for the sole purpose of identifying journeys.
From relevant booking emails we extract structured data such as:
Full email content is not stored after processing.
Non-relevant emails are not retained.
This data is used to maintain and secure the service.
If you contact us, we may process:
FareGuard does not intentionally collect:
We process personal data to:
We rely on the following lawful bases under UK GDPR:
Performance of a contract (Article 6(1)(b))
To provide the FareGuard service you request, including scanning booking emails and identifying refund eligibility.
Consent (Article 6(1)(a))
To access your Gmail account via Google OAuth.
You may withdraw this consent at any time by disconnecting your account.
Legitimate interests (Article 6(1)(f))
To:
We balance these interests against your rights and freedoms.
Legal obligation (Article 6(1)(c))
Where required for regulatory, accounting, or legal compliance.
When you connect your Google account:
You may revoke access at any time through:
FareGuard’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
Gmail data is used solely to provide the FareGuard service requested by the user.
Gmail data is not used for:
FareGuard accesses Gmail data solely to provide the user-requested functionality of identifying rail booking confirmation emails and generating journey monitoring and compensation eligibility notifications.
FareGuard does not use Google user data for advertising, marketing, profiling unrelated to the requested service, or training machine learning or artificial intelligence models.
FareGuard does not sell, transfer, or disclose Gmail data to third parties except to service providers that are strictly necessary to operate the Service and who are contractually bound to process data only on FareGuard’s documented instructions and in accordance with applicable data protection law.
Access to Gmail-derived data by FareGuard personnel is strictly limited and controlled. Human access may occur only where necessary for technical troubleshooting, security investigation, or user-requested support. All such access is logged, access-restricted, and subject to confidentiality obligations.
FareGuard implements technical and organisational safeguards to protect Google user data, including encryption in transit and at rest, access controls, authentication mechanisms, monitoring, and secure infrastructure management.
FareGuard’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
FareGuard uses automated processing to assess whether journeys may be eligible for delay compensation schemes.
This assessment:
We do not sell personal data.
We share personal data only with:
All processors are contractually bound to protect personal data.
Where personal data is transferred outside the UK, we implement appropriate safeguards such as:
We retain personal data only as long as necessary for the purposes described.
Users may request deletion of their FareGuard account and associated data directly within the FareGuard dashboard under Account Settings, or by contacting support. Upon deletion, Gmail access is revoked and all associated personal data is permanently removed from FareGuard systems except where retention is required by law.
Typical retention periods:
| Data type | Retention |
|---|---|
| OAuth tokens | Until account disconnection |
| Structured journey and claim data | While account active and for 12 months after inactivity |
| Technical debugging data | 7 to 14 days |
| Support correspondence | Up to 12 months |
| Legal and financial records | As required by law |
When no longer required, data is securely deleted or anonymised.
If you disconnect Gmail or delete your FareGuard account:
Some data may be retained where required by law.
FareGuard uses cookies and similar technologies necessary to:
Access to production systems containing Gmail-derived data is restricted to authorised personnel on a least-privilege basis. Administrative access requires strong authentication and is monitored. Encryption keys are managed using secure key management processes. System access and data processing activities are logged and regularly reviewed.
We do not use advertising or tracking cookies.
Where non-essential cookies are introduced, we will obtain consent in accordance with PECR.
We implement appropriate technical and organisational security measures including:
No system can be guaranteed completely secure, but we continuously review our protections.
You have the right to:
We respond to requests within one month where required by law.
To exercise your rights, contact: hello@fareguard.co.uk
We may update this policy from time to time. Material changes will be published on our website.
End of Policy