Privacy Policy
Last updated: July 2026
1. Introduction
Mind the Delay ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our TfL refund automation service.
2. Information We Collect
Account Information
- Email address (for account creation and communication)
- Name (if provided via OAuth)
TfL Account Connection
- A per-user Kernel managed authentication connection and encrypted browser profile
- New TfL usernames and passwords are entered into Kernel's managed sign-in component and are not returned to Mind the Delay
- The connection is used solely for journey history and refund submission
Journey Data
- Journey history downloaded from your TfL account
- Journey dates, times, stations, and fares
- Delay analysis results
Payment Information
Payment processing is handled by Stripe. We do not store your full payment card details. We retain only the information necessary to manage your subscription.
3. How We Use Your Information
We use your information to:
- Provide and maintain the Service
- Access your TfL account to download journey history
- Analyze journeys for delay refund eligibility
- Submit refund claims to TfL on your behalf
- Process subscription payments
- Send service-related communications
- Improve and optimize the Service
4. Data Security
We implement robust security measures to protect your data:
- Managed Authentication: Kernel encrypts TfL credentials and authenticated browser profiles at rest
- Data Minimisation: After managed authentication succeeds, we store connection and profile references rather than your TfL password
- Secure Storage: Data is stored in secure, access-controlled databases
- HTTPS: All data transmission is encrypted using TLS
- Access Controls: Strict internal access controls limit who can access user data
5. Data Sharing
We do not sell your personal information. We may share data with:
- Kernel: Kernel processes your TfL sign-in and maintains the encrypted browser profile used for automation
- TfL: Your sign-in and refund claims are submitted to TfL to provide the Service
- Payment Processors: Stripe processes subscription payments
- Service Providers: Cloud hosting and infrastructure providers who help us operate the Service
- Legal Requirements: When required by law or to protect our rights
6. Data Retention
While your account is active, we keep the information needed to provide journey analysis, claim submission, billing, and support. Expired authentication records are removed after 30 days; completed callback metadata after 7 days (with raw and parsed payloads cleared as soon as processing completes); failed callback records after 30 days; managed-authentication diagnostics after 90 days; completed scheduling records after 180 days; journey and workflow records after 24 months; and finance snapshots after 25 months. Deletion runs daily in bounded batches.
When you delete your account, we first cancel its subscription and scheduled work, remove the Kernel connection and browser profile, and then delete the local account and associated customer data. Limited audit, tax, accounting, dispute, backup, or fraud-prevention records may be retained where the law or a legitimate operational need requires it.
7. Your Rights
Under UK GDPR, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate personal data
- Erasure: Request deletion of your personal data
- Portability: Receive your data in a portable format
- Object: Object to processing of your personal data
- Withdraw Consent: Withdraw consent at any time
To exercise these rights, contact us at privacy@mindthedelay.com
9. International Transfers
Some of our service providers process personal data outside the UK, including in the United States. Where a restricted transfer occurs, we use an applicable UK adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer risk assessment. We limit each provider to the information needed to deliver its part of the Service.
10. Third-Party Services
Our Service integrates with:
- TfL: To access journey history and submit refunds
- Vercel: For application hosting and delivery
- Neon and Upstash: For database, cache, queue, and scheduling infrastructure
- Kernel: For managed TfL authentication and browser automation
- Laminar: For private automation diagnostics when tracing is enabled
- PostHog: For consent-based, pseudonymous product analytics hosted in the EU
- Google Ads: For consent-based, privacy-limited campaign conversion measurement
- Resend: For transactional email
- Stripe: For payment processing
- Google/Microsoft: For OAuth authentication (optional)
- OpenAI: When you choose to connect the read-only ChatGPT companion, to answer your questions using the account summaries you request
Each of these services has their own privacy policy governing their use of your data.
11. Optional ChatGPT Companion
If you choose to connect Mind the Delay to ChatGPT, the companion provides read-only, customer-safe account information in response to your requests. This can include subscription and setup status, TfL connection status, automation timing, recent check results, and journey or claim summaries such as dates, stations, duration, delay, status, and estimated value.
The companion does not return TfL credentials, payment-card information, SMS verification codes, browser sessions, internal traces, raw diagnostic payloads, or internal account identifiers. OpenAI receives only the information returned for the tool request you make and handles it under OpenAI's applicable terms and privacy policy.
OAuth access tokens expire after one hour and renewable access expires after 90 days. We store only hashes of OAuth tokens. You can disconnect ChatGPT from Mind the Delay settings at any time, which immediately revokes current and renewable access. Associated authorization records remain subject to the account-retention and deletion periods described above.
12. Children's Privacy
Our Service is not intended for children under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.
14. Contact Us
For privacy-related questions or to exercise your rights, contact us at:
Email: privacy@mindthedelay.com