Privacy notice
Last updated: 30 August 2026
1. Controller and contact
DarkForge Labs Ltd is the controller for QuickAppeal. It is registered in England and Wales as company 17033392, with registered office at 19 Beehive Way, Bawdeswell, Dereham, England, NR20 4WH. Verify this on the Companies House register.
Privacy requests and complaints: support@quickappeal.co.uk.
2. Information we process
- the name, postal address and email address you provide;
- vehicle registration, PCN reference, issuer, dates, location and circumstances;
- the grounds, free text and feedback you submit, and the generated draft;
- the in-progress form and generated draft kept in this browser tab for recovery;
- payment status, Stripe PaymentIntent and receipt information (not card details);
- opaque order, recovery, quota and webhook identifiers;
- IP address or network identifier used for security and rate limiting;
- device, page, referrer and interaction data described under analytics below; and
- messages you send to support or as a data-protection complaint.
3. Why we use it
| Purpose | UK GDPR basis |
|---|---|
| Take payment, draft and recover your purchased letter | Contract — Article 6(1)(b) |
| Prevent fraud, abuse and duplicate use | Legitimate interests — Article 6(1)(f) |
| Keep payment and accounting records | Legal obligation — Article 6(1)(c) |
| Measure aggregate site use with cookieless Vercel and Plausible analytics | Legitimate interests — Article 6(1)(f) |
| Run optional Google Analytics | Consent — Article 6(1)(a) |
We do not sell appeal information, use it for advertising, or use it to make an automated decision about whether your appeal should succeed.
4. Health and other sensitive information
An appeal can sometimes mention disability or a medical event. Do not upload medical records or include more sensitive detail than is necessary. If you select a medical, disability or Blue Badge ground, we ask for explicit consent before generation under Article 9(2)(a) UK GDPR. Do not put health information elsewhere in the form. You can withdraw consent before generation by removing that ground and information. After generation, withdrawal does not undo processing already needed to deliver the order.
5. Providers that receive information
Anthropic — AI drafting
Receives the appeal facts needed to draft the letter. We substitute placeholders for your name, postal address, vehicle registration and PCN reference, then merge those identifiers into the validated draft on our server. Do not repeat those identifiers, or unnecessary sensitive details, in free-text circumstances. Anthropic states that commercial API inputs and outputs are not used for model training unless the customer opts in. See its commercial-services privacy explanation.
Stripe — payment and fraud prevention
Receives payment, receipt and technical information. Card details are entered into Stripe Elements and do not pass through our application servers. See the Stripe privacy policy.
Vercel — hosting, logs and cookieless analytics
Hosts the site and may process request data and operational logs. Vercel Web Analytics provides aggregated page statistics without third-party cookies. See Vercel's privacy notice and analytics privacy information.
Upstash — short-lived order and security records
Stores payment-recovery status, hashed recovery and case identifiers, generation quotas, webhook deduplication records and rate-limit identifiers. It does not receive the raw appeal narrative or generated letter from our order store. See the Upstash privacy policy.
Plausible and Google Analytics
Plausible provides cookieless, aggregated traffic statistics. Google Analytics loads only after you choose “Allow analytics”; we do not put names, PCN details, free text or payment details in analytics events. See Plausible's data policy and Google's partner-sites notice.
6. Retention
- Raw appeal fields and the generated letter are processed for the request and are not intentionally written to our Redis order store or application database.
- The in-progress form and generated draft are kept in browser session storage for the life of the tab so a refresh or payment redirect can recover them. “Start again” clears this local copy.
- The opaque order-recovery record, generation entitlement and case hash expire after 24 hours.
- Incomplete generation reservations expire after 10 minutes.
- Stripe webhook event identifiers are retained for up to 30 days to prevent duplicate processing.
- Security and rate-limit identifiers are short-lived; provider-side operational and analytics retention can be longer under the provider policies linked above.
- Stripe retains transaction records under its legal and regulatory duties. We retain support, complaint, refund and accounting records only as long as needed for those purposes.
Infrastructure logs and backups may persist for provider-controlled periods. We prohibit application logs from recording names, addresses, registration numbers, PCN references, appeal narratives or generated letters.
7. Cookies and analytics choices
Stripe may use cookies or similar storage necessary for payment security and fraud prevention. QuickAppeal sets a signed, HttpOnly quickappeal_order cookie for up to 24 hours so the server can recover payment status without exposing the PaymentIntent in the URL. The cookie contains an opaque signed credential, not your appeal text. The form and letter use browser session storage as described above. QuickAppeal also stores your analytics choice locally. Plausible and Vercel analytics are configured as cookieless aggregated measurement.
Google Analytics is optional and is blocked until you consent. Use “Analytics settings” on the site to refuse or withdraw consent. Refusing analytics does not affect the service.
8. International transfers
Some providers process information outside the UK. Where UK data-protection law requires a transfer safeguard, we rely on the provider's applicable UK addendum, adequacy regulation or approved contractual safeguard. Contact us if you want more information about the safeguard relevant to your data. We do not claim that every provider or processing location is based in the USA.
9. Your rights
Depending on the processing and any legal exception, you may ask for access, correction, erasure, restriction, portability, or object to processing. Where we rely on consent, you may withdraw it. Rights are not automatic in every case. We normally respond within one month. Read the ICO's guide to data-protection rights.
10. Complaints
Email support@quickappeal.co.uk with “Data protection complaint” in the subject. We will acknowledge receipt within 30 days, investigate without undue delay and keep you informed, in line with the complaint-handling duties in force from 19 June 2026. The ICO explains the process in its organisation complaints guidance.
You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or call 0303 123 1113.
11. Security, children and changes
We use access controls, encrypted transport, signed recovery credentials, payment verification and data-minimisation measures. No online service can promise absolute security. QuickAppeal is for people aged 18 or over.
We will update this notice when processing changes and show the revision date above. Material changes will apply prospectively.