Privacy policy

Last updated: 2026-05-07

What we collect

When you use unbook, we collect: the photo of your traffic infringement notice; the structured fields we extract from it (state, offence code, fine amount, date, location, camera type); your answers to the wizard questions; and — if you pay for a dispute pack — your email address (so we can deliver the letter). We don't collect anything else.

What we do with it

We use the photo and structured fields to run the seven analyzer modules and generate your dispute letter. The photo is stored in Cloudflare R2, pinned to APAC region. Structured fields and analysis results are stored in Cloudflare D1 (SQLite, edge-replicated, AU region).

Photos are auto-deleted after 12 months via R2 lifecycle policy. The ticket row is kept indefinitely (it's small and useful for outcome analytics) but you can request deletion at any time.

Cross-border disclosure (APP 8)

Two overseas processors are involved in producing your dispute letter:

• Cloudflare (Workers Free, Pages, R2, D1) — workloads are pinned to AU/APAC infrastructure where supported. Limited cross-border movement may occur for caching and CDN purposes; this is unavoidable for any internet service.
• Anthropic (USA) — used only as the composer fallback when our primary models can't produce an acceptable letter. Most disputes never invoke this. When it does, the analyzer outputs (no photo bytes) are sent to Anthropic for processing.

By using unbook, you consent to disclosure of your information to these processors for the limited purpose of generating your dispute pack. This consent is revocable: ask us to delete your data and we will, except where retention is required for legal or financial obligations (e.g. Stripe transaction records).

What we never do

• We never sell your data to anyone.
• We never share your data for marketing.
• We never use your photos to train third-party models.
• We never share your data with insurers or law enforcement except on lawful order.

Cookies and tracking

We use Cloudflare Web Analytics — cookieless, no personal data collected, no third-party trackers. We track conversion events internally (page views, upload, paid, outcome reported) using a daily-rotating anonymous identifier derived from your IP and browser — no cookies set on your device.

Your rights

Under the Privacy Act 1988 (Cth) you can request a copy of any personal information we hold about you, and ask us to correct or delete it. Email [email protected].

Contact

Questions about this policy: [email protected].