Privacy notice

Version: 2026-10-27 · Last updated 27 October 2026.

This notice explains what personal information latemate collects, why, who we share it with, how long we keep it and your rights.

Who is responsible

Oliver Mather, trading as latemate, of 10 Providence Avenue, Rochester, Kent ME1 1NF, is the controller of your personal information. Contact: info@latemate.app. ICO registration number: 00016055828.

What we collect

Account and contact details: your name, title, email address, and, if you connect them, your Telegram or WhatsApp account and phone number, or your Google account.
Claim details: your postal address and how you want to be paid compensation (for example your PayPal email address, a chosen charity, or vouchers). We don't collect bank details.
Your trains and journeys: the stations, times and days of the trains you follow, changes you tell us about, which journeys you were on, and your claims and their outcomes.
Tickets: the type, dates, route, price and reference of your ticket, your Key smartcard number if you give it, and photos, screenshots or PDFs of tickets you send us.
Messages: what you write to us in chat or by email, and, if you choose claim-email tracking, the emails train operators send to your claims address.
Payment records: your subscription and payments. Card details are handled by Stripe; we never see your full card number.
Security and fraud-prevention information: sign-in records, one-way fingerprints used to stop repeat free months (below), and checks on claims.
The latemate app: if you use it, a code that lets us send notifications to your phone (from Apple or Google, through Expo), which kind of phone it is, and when the app was last used. When you send a claim in the app to a train company whose form needs your own account with them, you sign in to their site on your phone: we never see or keep that password. The app fills in the form from your claim and records the reference their site shows. For a form the app can't fill in yet, it notes the layout of each page you go through (headings, field names and buttons, never what you type), so we can teach it that form.
Website cookies: the ones the site needs, and an analytics cookie only if you accept it (see Cookies below).
News and offers: whether you want emails about new things latemate does and offers, and when and how you told us.
"Tell me when" list: if latemate can't claim for your trains yet and you ask to be told when it can, your email address, the train company and the journey you looked up. We use it for that one email, then delete it.
Website visits: the pages you view, the website or link that brought you here (for example a search engine, or a tagged link in an email), the type of device, and whether your visits led to signing up. If you accept our analytics cookie, your visits are counted under a random code kept in that cookie, so we can see how you came back and what finally led you to sign up. Until you choose, each visit is counted under a code made from the day, your IP address and your browser with a secret key, with nothing stored on your device: it changes every day and can't be turned back into your address. If you accept, that day's visits move to your cookie's code; if you reject, they're deleted and your visits aren't counted. If you sign up, how you first arrived (that website or link, and the first page you saw) is kept with your account. While we try out a new version of the homepage, which version you see is chosen from your IP address and browser with a secret key (nothing is stored on your device), and is noted with your visits to the homepage so we can compare the two. If your browser sends Global Privacy Control or Do Not Track, your visits aren't counted.

Why we use it, and our lawful basis

To provide latemate (follow your trains, ask you about late ones, prepare and submit your claims, track their outcome, and send you messages about them): necessary for our contract with you.
To take payment and keep accounts: contract, and our legal obligation to keep financial records.
To prevent fraud and misuse (repeat free months, dishonest or duplicate claims, keeping the service secure): our legitimate interests, and those of train operators, in preventing fraud.
To improve the service and fix problems: our legitimate interests. We use records without names where we can.
To email you latemate news and offers (for example a new feature, or a lower price for your first months): only if you didn't tick "Don't send me latemate news and offers" when you signed up, or said yes in the app. This is our legitimate interests in telling customers about our own service, as the law allows when you were given the choice to say no when you signed up and in every email. You can stop them at any time with the unsubscribe link in any of them, or in Settings, and we'll stop straight away. If you signed up with Google, or before we asked, we don't send any until you say yes. Messages about your claims, trains, free month and account aren't marketing and come whatever you choose.
To tell you when latemate can claim for your trains (the "Tell me when" list): your consent, given by joining it. You can withdraw it at any time by leaving the list.
To measure our Reddit ads (the Reddit pixel above): your consent, given by accepting all cookies. You can withdraw it at any time with "Cookie settings".
To credit our partners (creators and publishers who recommend latemate, and earn a share of what the people they refer pay us): which partner's link or code you signed up with, and what you've paid us for latemate, so we can work out and pay their commission. Remembering their link in your browser needs your consent (accepting all cookies); recording the partner against your account when you sign up, and working out what they're owed, is our legitimate interests in paying the partners who bring us customers, and our legal obligation to keep financial records. Partners only ever see totals (how many sign-ups and payments, and their commission), never who you are.
To understand how people find latemate and where they give up signing up (the website visit counts above): with the analytics cookie, your consent, which you can withdraw at any time with "Cookie settings" at the foot of every page; before you choose, our legitimate interests in running and growing the service. You can also opt out with Global Privacy Control or Do Not Track.

We don't sell your information. The only advertising use is measuring our own Reddit ads, and only if you agree.

Cookies

A cookie is a small file a website keeps in your browser. latemate sets only its own cookies, never advertising ones, and shares none with anyone else.

Needed for the site to work, so always on:

Signed in (sid): keeps you signed in. 30 days.
Your answers (draft): remembers what you entered while you look up your trains before signing up. 7 days.
Getting set up (lm_trial): remembers that you started your free trial before adding your trains, to show the right steps. Until you've finished setting up, at most 7 days.
Invitation and route (referral, route): remember a friend's invitation link, or the route page you came from, until you sign up. 30 days each.
Google sign-in: finishes signing you in with Google. 10 minutes.
Your cookie choice (lm_consent): remembers whether you accepted or rejected analytics, so we don't ask on every page. 12 months.

Only if you accept analytics:

Analytics (lm_vid): a random code, so your visits on different days are counted as one visitor's and we can see which link or page led to signing up. 12 months.

Only if you accept all cookies (advertising):

Partner link (lm_aff): if a latemate partner's link brought you here, which partner, and when, so they're credited if you sign up within 30 days. Nothing else about you, and it's never shared. 30 days. (Without it, you can type the partner's code when you sign up instead.)
Reddit pixel (Reddit's _rdt_uuid cookie, and our lm_rdt_conv for an hour): tells Reddit that someone who saw or clicked one of our Reddit ads visited latemate, signed up or subscribed, so we can see which ads work. Reddit receives the pages you visit here, your IP address and browser, and a code for the sign-up or subscription (never your name or email address). Reddit uses this as its own controller, under its privacy policy (reddit.com/policies/privacy-policy). Reddit's cookie lasts up to 90 days.

We ask before setting any of these, and accepting and rejecting are equally easy. To change your mind, use "Cookie settings" at the foot of any page: rejecting deletes our analytics cookie and the visits counted under it, the partner link, and Reddit's cookie.

Automated checks

Ticket photos and PDFs are read by an AI model (Anthropic's Claude), which reports what is printed on them. latemate's own rules then check that against your journey. Nothing about a claim is decided by the AI.
When our rules can't understand a chat message, it may be sent to Claude to work out which of latemate's own commands you meant. Only that message, today's date and a description of your saved trains are sent.
Some checks flag a claim or a free month for review (for example, details matching another account). A person always reviews these before anything is refused, and you can ask us to explain or reconsider.

Train operators (for example Southeastern or Govia Thameslink Railway): the details needed for each claim you confirm. They use them as their own controllers to handle your claim.
Service providers working for us, who may only use your information to provide their service to us:
- Hetzner Online GmbH (servers in Germany or Finland): hosts the site, the database and the browser that fills in claim forms.
- Stripe: payments and subscriptions.
- inbound.new: sends our emails and receives emails to claims addresses (it runs on Amazon Web Services).
- Anthropic: reading ticket photos and understanding some chat messages, as described above.
- Telegram and WhatsApp (Meta), if you message us there; Google, if you sign in with Google.
- Expo (650 Industries, in the US), Apple and Google, if you turn on notifications in the latemate app: the notification's title and text, and your phone's notification code, to deliver it.
- Reddit, only if you accept advertising cookies: which of our Reddit ads led to a visit, sign-up or subscription (see Cookies).
- latemate partners who referred you: only totals (how many people signed up with their link or code, how many pay, and their commission), never your name, email, trains or claims.
- 2Captcha: sometimes solves the security check ("I'm not a robot" puzzle) on a train company's claim form. It's sent the puzzle and the form's web address only, never your details.
Others when required: where the law requires it, or to protect against fraud (for example, if an operator investigates a claim).

Train running information (from Realtime Trains and National Rail) doesn't contain your personal information.

International transfers

Some providers (Stripe, Anthropic, inbound.new and Amazon Web Services, Meta, Telegram, Google, 2Captcha, Reddit) may process information outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK-US data bridge where the provider is certified) or the ICO's approved international data transfer agreement or addendum.

How long we keep it

Your account and its trains, claims and messages: while your account is open. When you delete your account, they are deleted.
Ticket photos and files: deleted 90 days after the claim they support is closed.
Emails to your claims address: the email itself for 90 days; what it told us (such as the amount paid) stays with the claim.
Payment and claim records needed for accounting: 6 years, kept under a reference that doesn't name you once your account is deleted.
Free-month fingerprints: 2 years, including after your account is deleted, to prevent repeat free months. They are one-way scrambles of details such as your email, chat account, PayPal address, name with postcode, Key smartcard and ticket numbers; they can't be turned back into the details.
"Tell me when" list: until we've sent that one email, or for 18 months at most. You can take yourself off at any time from the link shown when you join.
Partner link clicks: counted without anything that identifies you, kept 13 months. Which partner you signed up with stays with your account, and with the commission records (6 years, as payment records).
Website visit counts: 13 months, or until you reject the analytics cookie. How you arrived stays with your account and is deleted with it.
Security logs: up to 30 days.

Your rights

You have the right to access your information (you can download it in Settings), to correct it, to have it deleted (delete your account in Settings), to restrict or object to how we use it, and to receive it in a portable format. Contact info@latemate.app to use any of these; we will reply within one month.

If you're unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Changes

We will update this notice when what we do changes, and tell you about important changes before they take effect.