Visa API
Privacy Policy
What we collect, why, and what we deliberately never touch.
Last updated 28 October 2026
1. The short version
What matters most to a travel business integrating this API: we never receive your travellers' identities.
No traveller dataThe API accepts ISO 3166 country codes and nothing else. There is no field for a traveller's name, passport number, date of birth, travel document image, or contact details. We could not store them if you sent them, because no endpoint reads them.
One caveat, stated plainlyWe do log the IP address of the calling system together with the passport country and destination country queried. If you call us in real time for an identified traveller, that association exists in our logs even though we never learn who the traveller is. Account for this in your own records of processing.
Who we areThe controller is Orizn SAS, a company registered in France (Rennes). Contact for any privacy matter: [email protected].
2. What we actually collect
This list was compiled by reading the database migrations and the request handlers, not from memory. Each entry names where the data lives.
Account dataYour name, email address, company name, a hashed password, your API key, and your plan. Created when you register and kept in the visa_api_users table.
API request logsFor every API call, the visa_api_logs table records: timestamp, your user id and API key, the endpoint called, the passport country code and destination country code queried, the language requested, the HTTP status code, the response time, the user agent string sent by the calling program, and the full IP address of the calling system.
Why the full IPIt is retained for security and abuse control. In June 2026 an anonymous key extracted a full passport row across 195 destinations; the per-IP and per-passport guards that now prevent this need the address to work. This is processing based on our legitimate interest in protecting the service.
Usage countersA monthly per-API request count per customer, in visa_api_usage, used to enforce quotas and to bill you.
Website analyticsVisits to our own pages are recorded in web_events with deliberately reduced data: an ephemeral session id held in sessionStorage that dies with the browser tab, the page path, the event type, the label of what was clicked, the referring domain, the device type, the country supplied by Cloudflare, and only the first three octets of the IP address. No cookie, no persistent identifier, no full IP, no full user agent.
Billing dataStripe handles payment. We store your subscription status, plan and Stripe customer reference. We never receive or store card numbers.
3. What we never collect
Traveller identityNo names, passport or document numbers, dates of birth, nationality of a named individual, biometrics, photographs, or scans. None of these are accepted by any endpoint.
ItinerariesWe do not receive booking references, ticket numbers, flight numbers, or dates of travel.
Special category dataWe do not process data revealing health, religion, political opinions, or any other special category under article 9 GDPR.
AdvertisingWe do not sell, rent or share personal data with advertisers, data brokers or marketing networks, and we run no advertising or cross-site tracking.
4. Why we process it, and on what basis
To provide the serviceAuthenticating your key, answering your requests, enforcing your quota and showing your usage. Basis: performance of our contract with you.
To protect the serviceRate limiting, abuse detection and bulk-extraction guards, which rely on the IP address. Basis: our legitimate interest in keeping the service available and our dataset from being copied wholesale.
To bill youProducing invoices and managing subscriptions through Stripe. Basis: performance of our contract, and our legal accounting obligations.
To improve the productAggregate statistics about which endpoints and pages are used. Basis: legitimate interest. You can object at any time by writing to us.
5. How long we keep it
This section states what we actually do today.
API request logsKept for 12 months, then deleted by a weekly automated job. You can ask us to delete your logs earlier at any time at [email protected].
Account dataRetained while your account exists, and deleted on request or when you close the account.
Website analyticsRetained in a reduced form that contains no full IP address and no persistent identifier from the outset.
Billing recordsRetained for as long as accounting and tax law requires, which is longer than the rest and cannot be shortened on request.
6. Who else processes it
These are the third parties that receive data in the course of running the service. Confirm this list and put a data processing agreement in place with each before publication.
StripePayment processing and subscription management. Receives your billing identity and payment details directly; we never hold your card data.
ResendTransactional email — API key delivery, sign-in links, quota alerts. Receives your email address and name.
PostHogProduct analytics on our own web pages, hosted in the European Union. Uses browser localStorage rather than cookies, and is configured not to set a cross-subdomain cookie. It does not run on API traffic.
CloudflareEdge network in front of the service. Sees the IP address of every request and supplies the country header we record. Provides DDoS protection and caching.
HostingOur servers and database are hosted in the European Union. The provider and region are to be stated explicitly before publication.
7. Cookies and local storage
orizn_tokenThe session cookie that keeps you signed in to your dashboard. Strictly necessary — without it you cannot stay authenticated. Not used for tracking.
sessionStorageHolds the ephemeral analytics session id described above. It is cleared when you close the tab and cannot follow you between visits.
localStorageUsed by PostHog to recognise a returning browser for product analytics. It is not a cookie and is not shared across our subdomains.
No advertising cookiesWe set no advertising, retargeting or cross-site tracking cookies of any kind.
8. Your rights
If the GDPR applies to you, you have the following rights, exercisable free of charge by writing to [email protected]. We answer within one month.
Access and portabilityObtain a copy of the personal data we hold about you, in a machine-readable format.
RectificationCorrect anything inaccurate in your account.
ErasureHave your account and its data deleted, subject to records we are legally required to keep, such as invoices.
Objection and restrictionObject to processing based on legitimate interest, including our analytics, or ask that processing be restricted while a dispute is resolved.
ComplaintLodge a complaint with your supervisory authority. In France this is the CNIL.
9. Security and changes
SecurityPasswords are stored hashed, never in clear text. Traffic is encrypted in transit. API keys can be rotated by you at any time from your dashboard, which is the right response if you suspect a key has leaked.
Breach notificationWhere a breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform you where the risk is high.
Changes to this noticeWe will notify material changes to the email address on your account before they take effect.
10. apaleo integration (Orizn Visa Check)
Orizn Visa Check is an app that hotels install from the apaleo Store. This section covers only what that app processes.
Data processedFor each new reservation: the nationality country code of the primary guest, the country of the property, and the reservation identifier.
Never requestedThe guest's name, email address and travel document number. The app is configured as "Omit linked" in apaleo, so these fields are not sent to us at all.
PurposeTo show the hotel the entry requirement that applies to the guest's nationality for the property's country.
RolesThe hotel is the controller of its guests' data. Orizn acts as its processor under article 28 GDPR and processes the data only to provide this check.
RetentionWe keep the OAuth tokens of the hotel's apaleo account for as long as the app is connected. To display the tab, we also store, per reservation identifier, the guest's nationality country code, the property's country and the entry requirement returned, never a name or document. All of it is deleted within 30 days after the app is disconnected, or sooner on request to [email protected]. A daily backup of this data is kept for 14 days, then deleted. Our logs keep only the reservation identifier and the outcome.
HostingThe app runs on Hetzner servers in the European Union.
Questions or requests
Privacy questions and requests to exercise your rights go to the same address.
[email protected]