Privacy

ByeFine is an online service. Contact: support@byefine.com.

What we collect

• The photo or PDF of your notice. It usually shows your name, address, vehicle registration, where and when the vehicle was, and the notice reference.
• If your notice is a police ticket (speeding, a red light, a phone, insurance and the like): what it says about the alleged offence, such as the speed recorded and the limit. That is information about an alleged criminal offence. We use it only to check the notice and to write your letter, which you send yourself, and we pass it to nobody.
• Your email address.
• Your name, if Google or Apple gave it to us when you signed in with them and you have not typed one yourself.
• If you pay: your name and address, your phone number, and anything you tell us about what happened. We give your phone number only to the issuer of your notice, where its appeal form asks for one.
• The issuer’s reply, which comes to our support address, or which you pass on to us.
• If you create an account: your password, kept only as a scrambled form (a hash) that cannot be turned back into it.
• If you sign in and choose to: the name, address, phone number and vehicles you save to your account, so your next appeal is filled in for you.
• For each car in your garage: what the DVLA holds about its registration (make, colour, year, fuel, and when its tax and MOT run out), so you can see those dates in one place.
• A record that you paid. Stripe handles the payment; we never see or store your card details.
• A record of what happened on your case, kept with it: when you ticked the boxes before paying (that you wanted us to start now, and that you understood what that means for your right to cancel) and the wording you saw, when you gave us authority to act for you, what we sent and when, the checks made on your letter, and the emails we sent you.
• A scrambled form (a hash) of your network (IP) address, saved with each notice you upload and used to limit abuse. The address itself is not kept.
• If you leave a review: the name you choose to show and what you write. We publish both.
• If you use a fleet account: the fleet’s name and billing email, and the email address of each driver the owner adds.
• If you take the monthly plan: Stripe’s reference for the subscription and the dates of the month it covers.
• If you refer a friend: your referral code, and the email address of each friend who pays through your link, so that we can give you the free appeal you earned.
• If you make an API key: its name, when it was last used, and a scrambled form (a hash) of the key. The key itself is shown to you once and never stored.

What we use it for

Only to do what you asked: read your notice, tell you how strong a challenge looks, write and file your appeal, and keep you updated. If you give us your email and do not go ahead, we may send up to two reminders before your notice’s discount or deadline runs out; each has a link to stop them. We do not sell your data, share it for marketing, or use it for advertising.

Who helps us process it

• Supabase stores the case and the files, in private storage that only our servers can read, in its Paris data centre.
• Anthropic (Claude) reads the notice, drafts the appeal, checks it against the notice and your account, reads the issuer’s reply, and, when a form asks for a title such as Mr or Ms, guesses one from your name. What it is sent is your notice, what you tell us, your name and address, and the letter. The data is sent through its business API, under terms that do not let it train its models on it. Anthropic is a United States company.
• Stripe takes the payment, and the monthly plan. It receives your email address and what you pay for. Stripe is a United States company.
• Resend sends our emails to you. It receives your email address and the text of each email.
• Intelliprint prints and posts a letter when our team posts your appeal for you. It receives your name and address, the issuer’s address and the letter.
• Migadu hosts our support mailbox, support@byefine.com. An appeal that is filed by email goes out from it under your name, and the issuer’s reply comes back to it.
• If you choose to sign in with Google or Apple, that company confirms your email address to us and we keep nothing else from it except your name (above). We never post to, or read anything from, those accounts.
• The DVLA’s vehicle enquiry service tells us about a car you add to your garage, where this is switched on. It receives only the registration.
• If you connect an AI assistant to your account, with an API key or through the Claude connector, that assistant sees what you ask it to fetch, and its own terms apply to what it does with it.
• Trustpilot. Once your appeal has gone in, we send Trustpilot your name, email address and case reference, and nothing else, so that it can invite you once to review us there. Its invitation says how to decline. We cannot edit or remove what you write on Trustpilot.
• Hetzner hosts the website, on a server in Germany.

The appeal itself goes to whoever issued the notice. That is the point of it. It carries your name and address. Where we file through the issuer’s online form we also enter the notice reference and your vehicle registration, our support address for their reply, your phone number if the form asks for one, and, if the form takes one, the photo of your notice. Where we file by email, it is sent from our email system under your name, to an address the issuer publishes for appeals. If you appeal onwards, the statement of appeal goes to the independent adjudicator or appeals service.

We never send anything to a court for you.

Some of these companies are based in, or process data in, the United States: Anthropic, Stripe and Resend, and Google and Apple if you use them to sign in. The law only lets us send personal data abroad with a safeguard it accepts. If you would like to know which one a particular company relies on, ask us at the address above.

Why we are allowed to use it

To do what you asked and paid for (our contract with you), and for our legitimate interest in running the service safely: checking that an appeal says nothing untrue, stopping the same notice being filed twice, and keeping a record of what we did. Our team can see your case when they need to file it or answer you.

How long we keep it

• If you send a notice and do not go ahead, we delete the photo and the check 30 days after you uploaded it.
• If you pay, we keep the case, its history and its files while we need them to deal with your case and for the time the law requires, then delete them.
• Sign-in codes and the records we use to limit abuse are deleted after two days.
• Saved account details stay until you change or delete them. You can delete your account, with every case and photo under it, from the account page once no appeal is in progress, or ask us to delete it at any time. We may have to keep some records where the law requires it.
• We keep backups for up to 30 days, so anything deleted is gone from them within 30 days too.

Cookies and what we store in your browser

None of this is for advertising or tracking across other sites, and we use no analytics.

• bf_session, a cookie, set when you sign in and kept for 30 days, so you stay signed in. bf_oauth, set for 10 minutes while you sign in with Google or Apple, and bf_mcp_request, set for 15 minutes while you connect an AI assistant. These make the service you asked for work.
• bf_ref, a cookie kept for 30 days, set only if you open a friend’s referral link. It holds that friend’s code so the referral price applies when you pay.
• bf_offer and bf_offer_seen_at, in your browser’s local storage, and bf_went_to_pay, in its session storage. On the page with your verdict, your browser notices when you hold back from paying, for example by leaving the tab, moving the mouse out of the window, pausing on the pay form or scrolling back up. That stays in your browser and is not sent to us. If it decides you are holding back, it asks us for a discount on that case; the discount ends two hours after it is first offered, and is offered once for that case. bf_offer keeps the signed offer so the lower price is on the pay button, bf_offer_seen_at keeps the time it was last shown so it is not shown again for a week, and bf_went_to_pay keeps the case’s link code until you come back from Stripe.
• Our own team has a sign-in cookie (bf_team, 7 days) on its own devices only.

Business marketing email

ByeFine sometimes emails businesses, for example to offer a fleet account. We write only to company email addresses that the business publishes itself, such as on its own website. That website is where we got the address. If the address names a person, we hold that person’s name and business email address, and nothing else about them.

We rely on our legitimate interests in telling businesses about a service that may be useful to them. The law lets us email a company in this way as long as each email says who we are and gives a working way to opt out. Every one of these emails comes from marketing@byefine.com, and you can stop them by using the unsubscribe link in the email, by going to byefine.com/unsubscribe, or by replying STOP. We keep the addresses that opt out on a suppression list so that we do not write to them again, for as long as we need to in order to honour that. Opting out an address stops our email to that address only. You can also ask us what we hold about you, or to delete it, as under “Your rights” below.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Reply to any email from us. Parts of the service are automated: our AI works out the verdict and reads replies from issuers, and the outcome of an appeal is recorded from them. If you disagree with any of it, reply to any email from us. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.