Legal
Privacy Policy
Last updated 9 October 2026
- We only collect what's needed to run ClaimCam: your account details, and the photos and capture details a customer sends through a claim link.
- Claim photos are deleted automatically 90 days after they're sent, along with the customer's IP address and device details.
- We don't sell data or show ads. Our public website uses Google Analytics cookies only if you accept them.
- Got a ClaimCam link from a shop? Read the part for customers.
1. Who we are
ClaimCam (claimcam.link) is run by RJ Macarthy, a sole trader based in the United Kingdom ("we", "us"). For questions about this policy or your data, use the "Need help?" form in your dashboard or the contact form at rjmacarthy.xyz.
We are the controller of the data about store owners who use ClaimCam. For the photos and details customers send through a claim link, the store that sent the link is the controller and we process that data on its behalf, as its processor (see section 4).
2. Store owners: what we collect and why
| Data | Why | Legal basis (UK GDPR) |
|---|---|---|
| Email address, and your password stored only as a one-way scrypt hash | Your account, signing in, sign-in links, service emails (e.g. "photos received") | Contract |
| Store name, store web address and logo | Shown to your customers on the claim page | Contract |
| Claims you create (order number, item, your notes) | Running the service | Contract |
| Plan, and the Stripe customer and subscription IDs | Billing. Card details go straight to Stripe and never reach us. | Contract; legal obligation (tax records) |
| Support messages | Answering you | Legitimate interests |
| IP address and browser in server logs | Security, abuse prevention and rate limiting | Legitimate interests |
| Website usage via Google Analytics (pages viewed, referrer, rough location, device), public site only | Seeing how people find and use our website | Consent (see section 7) |
If you sign in with Google, we receive only your email address and whether Google has verified it.
3. Customers who were sent a ClaimCam link
A shop has sent you a ClaimCam link so you can show them damage to an item. When you use it, we collect:
- The photos you take (3 angles, a few frames each) and a SHA-256 fingerprint of each one.
- The one-time code shown to you, and when it was issued and used.
- Capture details: your IP address, the country it maps to, your browser's user-agent, and basic device facts (whether it's a phone, the camera's name and resolution, your time zone, screen size, whether it has a motion sensor). These help the shop see that the photos were taken live, just now, on a real phone.
This is shared only with the shop that sent you the link, to handle your claim. The shop decides how it uses the evidence, so for questions or requests about your claim, contact the shop first. You can also contact us and we'll pass your request on or help directly.
If the shop has turned on AI review, the photos are also checked automatically (see section 5). Nothing about you is used for marketing, and we don't create profiles of customers.
4. When we act for a store (processor terms)
For customer data in claims, we act on the store's instructions under our Terms (Data processing). We keep it confidential, secure it, use only the providers listed below, help with data-subject requests, and delete it at the end of the retention period or when the store's account is closed.
5. Who we share data with
We use these providers to run ClaimCam. Each only gets what it needs for its job:
| Provider | What for | Location |
|---|---|---|
| OVHcloud | Server hosting: database and photo storage | EU |
| Resend | Sending emails (sign-in links, "photos received") | USA |
| Stripe | Payments and the billing portal | USA / EU |
| Anthropic | Optional AI review of claim photos. Under its commercial terms, Anthropic doesn't use this data to train its models. | USA |
| "Continue with Google" sign-in (optional), web fonts, and Google Analytics on our public website. Loading a page sends your IP address to Google's font servers. | USA |
Where data goes outside the UK, it is protected by the UK International Data Transfer Addendum or Standard Contractual Clauses, or the UK–US Data Bridge. We may also disclose data if the law requires it, or to protect ClaimCam and its users from fraud or abuse.
6. How long we keep it
- Claim photos: deleted 90 days after they're sent. The customer's IP address, browser and device details are deleted at the same time; only the country stays on the claim record.
- Photos from an unfinished claim: deleted after 30 days.
- Sign-in links: expire after 15 minutes and work once. Sessions: 30 days.
- Server logs (IP addresses): kept for up to 14 days.
- Your account: kept while it's open. Ask us to close it and we'll delete it and its claims within 30 days, apart from billing records we must keep for tax (6 years in the UK).
7. Cookies
We use these strictly necessary cookies, which don't need your consent:
cc_session: keeps you signed in (30 days, store owners only).cc_oauth_state: protects Google sign-in from forgery (10 minutes).
Analytics (optional). On our public website (the homepage, these legal pages and blog.claimcam.link) we use Google Analytics to see how visitors find and use the site, but only if you click "Accept" on the cookie bar. If you do, Google sets _ga and _ga_* cookies (up to 2 years) and receives your IP address and browsing details from those pages; Google LLC may process this in the United States. We've switched off Google's advertising features. Until you accept, Google Analytics sets no cookies and Google receives only basic cookieless signals that can't recognise you across visits. Your choice is stored in your browser (cc_analytics, in local storage).
No advertising cookies. The dashboard sets no analytics cookies, and customers using a claim link get no cookies at all.
8. Security
Everything is sent over HTTPS. Passwords are stored as scrypt hashes, and sign-in links and sessions only as SHA-256 hashes. Photo files can only be read by the ClaimCam server. Evidence pages and photos are reachable only through a long, unguessable link. The service is rate-limited against abuse. No system is perfectly secure; if a breach puts your data at risk, we'll tell you and, where required, the ICO.
9. Your rights
Under UK GDPR you can ask to see a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Contact us as described in section 1 and we'll reply within one month. Customers: for claim data, the shop is usually the right first contact (section 3). If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office.
10. Children
ClaimCam is a business tool and isn't meant for anyone under 18.
11. Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll email account holders before it takes effect.
12. Credits
Country lookup uses IP Geolocation by DB-IP (licensed under CC BY 4.0), which runs on our own server: no IP addresses are sent to DB-IP.