Visa API
Privacy Policy
What we collect, why, and what we deliberately never touch.
Draft of 12 August 2026 — not in force
Draft — not in force
This notice was drafted without legal counsel by someone who is not a lawyer, and must be reviewed and approved by a qualified professional before publication. It describes the system as it actually behaves today, including one retention gap that must be fixed in code rather than in prose. The list of what to settle first is at the foot of this page.
1. The short version
What matters most to a travel business integrating this API: we never receive your travellers' identities.
No traveller dataThe API accepts ISO 3166 country codes and nothing else. There is no field for a traveller's name, passport number, date of birth, travel document image, or contact details. We could not store them if you sent them, because no endpoint reads them.
One caveat, stated plainlyWe do log the IP address of the calling system together with the passport country and destination country queried. If you call us in real time for an identified traveller, that association exists in our logs even though we never learn who the traveller is. Account for this in your own records of processing.
Who we areThe controller is the legal entity operating Orizn. Its identification is to be completed before this notice is published — see the drafting note at the top of this page.
2. What we actually collect
This list was compiled by reading the database migrations and the request handlers, not from memory. Each entry names where the data lives.
Account dataYour name, email address, company name, a hashed password, your API key, and your plan. Created when you register and kept in the visa_api_users table.
API request logsFor every API call, the visa_api_logs table records: timestamp, your user id and API key, the endpoint called, the passport country code and destination country code queried, the language requested, the HTTP status code, the response time, and the full IP address of the calling system.
Why the full IPIt is retained for security and abuse control. In June 2026 an anonymous key extracted a full passport row across 195 destinations; the per-IP and per-passport guards that now prevent this need the address to work. This is processing based on our legitimate interest in protecting the service.
Usage countersA monthly per-API request count per customer, in visa_api_usage, used to enforce quotas and to bill you.
Website analyticsVisits to our own pages are recorded in web_events with deliberately reduced data: an ephemeral session id held in sessionStorage that dies with the browser tab, the page path, the event type, the label of what was clicked, the referring domain, the device type, the country supplied by Cloudflare, and only the first three octets of the IP address. No cookie, no persistent identifier, no full IP, no full user agent.
Billing dataStripe handles payment. We store your subscription status, plan and Stripe customer reference. We never receive or store card numbers.
3. What we never collect
Traveller identityNo names, passport or document numbers, dates of birth, nationality of a named individual, biometrics, photographs, or scans. None of these are accepted by any endpoint.
ItinerariesWe do not receive booking references, ticket numbers, flight numbers, or dates of travel.
Special category dataWe do not process data revealing health, religion, political opinions, or any other special category under article 9 GDPR.
AdvertisingWe do not sell, rent or share personal data with advertisers, data brokers or marketing networks, and we run no advertising or cross-site tracking.
4. Why we process it, and on what basis
To provide the serviceAuthenticating your key, answering your requests, enforcing your quota and showing your usage. Basis: performance of our contract with you.
To protect the serviceRate limiting, abuse detection and bulk-extraction guards, which rely on the IP address. Basis: our legitimate interest in keeping the service available and our dataset from being copied wholesale.
To bill youProducing invoices and managing subscriptions through Stripe. Basis: performance of our contract, and our legal accounting obligations.
To improve the productAggregate statistics about which endpoints and pages are used. Basis: legitimate interest. You can object at any time by writing to us.
5. How long we keep it
This section describes the position as it actually is today, including where it falls short of what it should be. Do not read it as a description of an implemented policy.
API request logsCurrently retained indefinitely. No automated deletion is implemented at the date of this draft. This is a known gap: a purge job and a defined retention period must be in place before this notice is published, and the intended period is 12 months. Until then we will not claim a shorter one.
Account dataRetained while your account exists, and deleted on request or when you close the account.
Website analyticsRetained in a reduced form that contains no full IP address and no persistent identifier from the outset.
Billing recordsRetained for as long as accounting and tax law requires, which is longer than the rest and cannot be shortened on request.
6. Who else processes it
These are the third parties that receive data in the course of running the service. Confirm this list and put a data processing agreement in place with each before publication.
StripePayment processing and subscription management. Receives your billing identity and payment details directly; we never hold your card data.
ResendTransactional email — API key delivery, sign-in links, quota alerts. Receives your email address and name.
PostHogProduct analytics on our own web pages, hosted in the European Union. Uses browser localStorage rather than cookies, and is configured not to set a cross-subdomain cookie. It does not run on API traffic.
CloudflareEdge network in front of the service. Sees the IP address of every request and supplies the country header we record. Provides DDoS protection and caching.
HostingOur servers and database are hosted in the European Union. The provider and region are to be stated explicitly before publication.
7. Cookies and local storage
orizn_tokenThe session cookie that keeps you signed in to your dashboard. Strictly necessary — without it you cannot stay authenticated. Not used for tracking.
sessionStorageHolds the ephemeral analytics session id described above. It is cleared when you close the tab and cannot follow you between visits.
localStorageUsed by PostHog to recognise a returning browser for product analytics. It is not a cookie and is not shared across our subdomains.
No advertising cookiesWe set no advertising, retargeting or cross-site tracking cookies of any kind.
8. Your rights
If the GDPR applies to you, you have the following rights, exercisable free of charge by writing to [email protected]. We answer within one month.
Access and portabilityObtain a copy of the personal data we hold about you, in a machine-readable format.
RectificationCorrect anything inaccurate in your account.
ErasureHave your account and its data deleted, subject to records we are legally required to keep, such as invoices.
Objection and restrictionObject to processing based on legitimate interest, including our analytics, or ask that processing be restricted while a dispute is resolved.
ComplaintLodge a complaint with your supervisory authority. In France this is the CNIL.
9. Security and changes
SecurityPasswords are stored hashed, never in clear text. Traffic is encrypted in transit. API keys can be rotated by you at any time from your dashboard, which is the right response if you suspect a key has leaked.
Breach notificationWhere a breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform you where the risk is high.
Changes to this noticeWe will notify material changes to the email address on your account before they take effect.
To settle before publishing
- Implement the log purge and confirm the retention period. Section 5 currently admits that logs are kept indefinitely, because they are. The previous version of this page claimed a 90-day automatic purge that does not exist anywhere in the codebase — that claim must not come back until the job does.
- Decide whether the full client IP in visa_api_logs is necessary, or whether the abuse guards would work on a truncated /24 as the analytics table already does. Truncating would remove most of the personal data from the table outright.
- Identify the controller: legal entity, registration number, registered address, and whether a data protection officer is required.
- Sign data processing agreements with Stripe, Resend, PostHog, Cloudflare and the hosting provider, and confirm the transfer mechanism for any processing outside the EU.
- Confirm with counsel whether logging a caller IP alongside a queried nationality warrants a data protection impact assessment.
Questions or requests
Privacy questions and requests to exercise your rights go to the same address.
[email protected]