Privacy Policy

AppealIQ (“AppealIQ”, “we”, “us”, “our”) is an online service that helps you draft formal letters to appeal UK parking charges. The service is operated by Kane Rigby, a sole trader based in the United Kingdom, who is the data controller responsible for your personal data.

We do not operate from a public business address. For any privacy question or to exercise your rights, contact us at support@appealiq.app. This policy applies to appealiq.app and the AppealIQ web app.

We collect only what we need to provide the service:

• Account data: your email address and a securely hashed version of your password. We never store your password in readable form.
• Profile details you choose to save (all optional): your name, postal address, postcode, a contact email, telephone number, vehicle registration, and the name you sign letters with. These are saved only to pre-fill your appeals.
• Appeal data: the Penalty/Parking Charge Notice (PCN) number, the issuing council or parking operator, the date and location of the alleged contravention, the ground you are appealing on, any additional details you type, the deadline you optionally set, the appeal status, and the letter generated for you.
• Payment data: if you buy an extra letter, our payment provider (Stripe) processes your card details — we never see or store your card number. We keep a record of the transaction (Stripe reference, amount, currency, status, date).
• Technical & security data: limited data needed to run the service safely, such as short-lived rate-limiting records and aggregate, non-identifying usage metrics (see Cookies & analytics below).

Please don’t enter more personal information than necessary in the free-text “additional details” field — only include what is relevant to your appeal.

Under the UK GDPR we must have a lawful basis for using your data. We rely on the following:

• To perform our contract with you — creating and managing your account, generating and storing your appeal letters, applying your free monthly allowance, and processing payments for extra letters.
• Our legitimate interests — keeping the service secure, preventing abuse and fraud, enforcing usage limits, fixing problems, and understanding aggregate usage to improve the service. We balance these against your rights.
• Your consent — sending optional appeal-deadline reminder emails, which you can turn off at any time.
• Legal obligations — keeping records (such as payment records) where the law requires it.

We do not sell your personal data, and we do not use it for third-party advertising. AppealIQ does not make any automated decision that produces a legal or similarly significant effect about you — the AI drafts a letter that you review, edit and choose to send yourself.

To draft your letter we send the relevant facts of your appeal — the PCN number, the council or operator, the vehicle registration, the date and location, the ground of appeal, and any additional details you provide — to our AI provider, Anthropic (the maker of Claude), which returns the drafted text.

We do not send your login email, your password, or your saved home address and phone number to the AI provider (unless you choose to type such details into the free-text field). Anthropic processes this data on our behalf under its business/API terms to generate your letter.

We share data only with the service providers that help us run AppealIQ, and only the minimum needed:

• Anthropic — AI generation of your appeal letter (see above).
• Stripe — secure payment processing for paid letters. Stripe is the controller of your card data and is PCI-DSS compliant.
• Resend — sending transactional emails (account verification, password resets, account-change notices, and any reminders you opt into).
• Our hosting provider — the secure server that runs the website and database.

We may also disclose data if required by law, to protect our legal rights, or to prevent harm or abuse. We never share your appeal contents with the parking operator or council on your behalf — you send your letter yourself.

Some of our providers (including Anthropic, Stripe and Resend) may process data outside the UK, including in the United States. Where data is transferred outside the UK, we rely on appropriate safeguards — such as UK adequacy decisions or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses — so that your data continues to be protected.

• Account & profile data is kept for as long as your account is open.
• Appeals are kept until you delete them or delete your account. You can delete an individual appeal at any time from your dashboard.
• If you delete your account, your profile, your appeals and your payment records are deleted along with it.
• Email verification and password-reset links are short-lived (24 hours and 1 hour respectively) and are invalidated once used.
• Aggregate analytics and security logs contain no information that identifies you and may be retained to keep the service safe and to measure usage.

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (you can delete your account yourself at any time);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent (e.g. to reminder emails) at any time.

To exercise any of these rights, email support@appealiq.app. We will respond within one month. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk — though we’d appreciate the chance to resolve your concern first.

We take security seriously. Connections are encrypted with HTTPS, passwords are stored using strong one-way hashing, sessions use secure cookies, and we apply input validation, rate limiting, and other industry-standard safeguards to protect against unauthorised access. No online service can be guaranteed 100% secure, but we work hard to keep your data safe and to limit the data we collect in the first place.

We use only strictly necessary cookies that are essential for the service to work:

• a session cookie to keep you signed in;
• a csrf_token cookie to protect forms against cross-site request forgery.

We do not use advertising or third-party tracking cookies. Our usage analytics are cookieless and privacy-friendly: we record only the page path and the referring site’s domain, with no IP address, no cookie, and nothing that identifies you. Because we use no non-essential cookies, no cookie-consent banner is required.

AppealIQ is intended for adults (18 and over) and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we’ll change the “Last updated” date at the top of this page, and for significant changes we’ll take reasonable steps to let you know. Please check back occasionally.

For any question about this policy or your personal data, contact the data controller, Kane Rigby, at support@appealiq.app.