Privacy notice version 1.0
How ImportBack uses your information
This notice explains the information used to prepare, charge for and fulfil your claim.
Who is responsible
SANTIAGO DESIGN LTD is responsible for the personal information used by ImportBack. Privacy enquiries can be sent to privacy@importback.co.uk.
Information we use
- account identifiers and contact details;
- customs, purchase, refund and return evidence;
- the values you review and confirm for the BOR286;
- bank details entered directly for Border Force repayment;
- your declaration, signature and versioned approval record;
- payment status and Stripe transaction identifiers; and
- security, audit and fulfilment records.
Why we use it
We use information to take steps you request, perform the ImportBack service contract, secure the service, comply with legal obligations and handle support, accounting and disputes. Before production, the business must document the precise lawful basis for every processing purpose and its retention schedule.
Document analysis and sharing
Supabase provides authentication, database and private file storage. ImportBack creates a temporary text copy of evidence inside its server environment and removes common bank, payment-card and signature information before OpenAI proposes document types and candidate claim values. Original evidence files and filenames are not sent to OpenAI. Stripe processes the separate service fee. Pingen receives the completed private claim pack for print-and-post fulfilment. Vercel hosts the application.
Bank details entered in the review form and signature images are not sent to OpenAI. Automated filtering is not a substitute for checking your uploads, so you should still cover or remove unrelated bank or payment-card information and signatures before uploading evidence.
Storage, retention and your rights
Evidence and generated packs remain private and are not given public download URLs. Access is restricted to the customer and authorised ImportBack operations where required.
Production must have a documented and implemented retention schedule before customer onboarding. You may ask for access, correction, deletion or restriction where the law provides those rights, and may complain to the Information Commissioner's Office.