Privacy policy

The short version

• Free tools (bundler, compressor, checklist) run entirely in your browser. We never receive or see those documents.
• The paid Schengen review service does receive the documents you choose to upload (e.g. passport, bank statements). They go directly to encrypted storage, are used only to review your application, and are deleted 30 days after the decision on your application (and in any case within 180 days of upload).
• Payments are handled by Stripe. We never see or store your card details.
• Privacy-first analytics (Plausible and Vercel Web Analytics), aggregate, cookieless, no advertising trackers.

Who we are (data controller)

findmyvisa.co.uk is operated by WayaNerd Ltd, a company registered in the United Kingdom, which is the data controller for the purposes of UK GDPR and the Data Protection Act 2018. Contact: support@findmyvisa.co.uk.

The free tools, browser-only

When you use the bundler, compressor or checklist generator, your browser reads the file directly into memory (the Web File API) and processes it locally with pdf-lib / pdf.js. The result is built in your browser and saved to your device. At no point is that file content sent to our servers, a third-party API, or any cloud storage.You can verify this in your browser’s Network tab.

The paid Schengen review service

If you purchase a Schengen application review, we process the following so we can deliver the service you’ve paid for:

What we collect

• Intake details you provide: your name, email, phone number, nationality, destination country, travel dates, and the service purchased.
• Your answers to our application questionnaire, for each traveller: the details the visa form asks for, such as names, date and place of birth, sex, civil status, home address, passport number and dates, your UK residence permit number, occupation and employer, your parents’ and spouse’s names, previous visas and refusals, and the plan for your trip.
• Documents you choose to upload for review, which may include your passport, UK BRP/visa, bank statements, travel itinerary, insurance, and employment or study evidence. These may contain personal and financial data, and potentially data that reveals special-category information.
• Payment metadata from Stripe (a payment reference and your email), never your card number.

Why (lawful basis)

• Performance of a contract (UK GDPR Art. 6(1)(b)), to provide the review you requested.
• Your explicit consent for processing the contents of documents you upload, where those reveal sensitive information. You provide this by choosing to upload them for review, and you can withdraw it at any time by asking us to delete them.

How your documents are handled

• They are uploaded directly from your browser to encrypted storage (Amazon S3, in the UK / London region) using a one-time, payment-verified link. The files do not pass through, and are not logged by, our website.
• They are encrypted at rest (AWS KMS) and in transit (TLS), stored privately, and accessible only to our reviewer to carry out your review under strict, least-privilege access controls with audit logging.
• They are deleted 30 days after the consulate’s decision on your application (or 30 days after a cancellation or a refund, if your order ends that way), and in any case no later than 180 days after upload. You can ask us to delete them sooner. We keep your order record, including your questionnaire answers but not the documents, only as long as needed for accounting and dispute resolution.
• Documents we prepare for you are delivered through your tracking account (sign-in by a code sent to your email, never as an email attachment), and deleted with the rest of your file on the same schedule.

Payments

Payments are processed by Stripe. We never receive or store your card details. Stripe acts as an independent controller/processor for payment data under its own privacy policy. You pay us our service fee only; the consulate visa fee and the visa-centre service fee are paid by you at the visa centre, and never pass through us.

Lodging your application (sharing with third parties)

To run your application for you, we share the personal data and documents you provide with the parties needed to lodge it, the relevant consulate or embassy, the visa application centre (VFS Global, TLScontact, BLS or GVC). We do not arrange travel insurance, so we share nothing with an insurer. We share only what each needs for your application, on the basis of performing our contract with you and your explicit consent. We never sell your data or share it for advertising.

If you start a visa plan and do not buy

When you enter an email address in the Schengen or US visa planner, we save the plan you built (destination, travel window, the price you were shown) with that address, and your phone number and residence if you gave them. We use this to send you a copy of the plan and to check in a few times over the following two weeks, and if you gave a WhatsApp number, a person may message you there once about the plan you started. Every WhatsApp message is typed by a person; nothing is automated or sent in bulk.

The lawful basis is our legitimate interest in following up an enquiry you began with us, and the “soft opt-in” in the Privacy and Electronic Communications Regulations, which lets a business contact someone who gave their details while enquiring about its service, provided every message offers a simple way to stop. Every email carries a one-click unsubscribe; on WhatsApp, reply STOP and we will not message you there again. We keep the plan while your enquiry is open; ask at support@findmyvisa.co.uk and we delete it.

If you message us on WhatsApp

We keep a copy of your WhatsApp conversation with us, the messages both ways, in our order system in AWS London, so whoever on the desk answers can see what was already said. It is used only to deal with your enquiry or order. Ask us and we delete it.

Newsletter / rule-change alerts

If you opt in to rule-change alerts, we store your email address with Brevo (our email provider) on the basis of your consent, and use it only to send those alerts. Every email includes a one-click unsubscribe, and you can ask us to delete you at any time.

Analytics

We use Plausible and Vercel Web Analytics , both privacy-first and cookieless. They record aggregate page views and event counts (page, anonymised country, browser, device). They do not fingerprint you or build an advertising profile, and we don’t use Google Analytics, advertising pixels, or third-party ad networks.

Who processes data for us (sub-processors)

• Vercel, website hosting + analytics.
• Amazon Web Services (AWS), encrypted document storage and the orders database, in the UK (London) region.
• Stripe, payment processing.
• Brevo, newsletter email (if you opt in).
• Meta (WhatsApp Business Platform), if you message us on WhatsApp.

Each is contractually bound to protect your data. Documents for the paid review are stored in the UK. Some other providers (e.g. Stripe, Brevo, Vercel) may process limited data outside the UK under appropriate safeguards (UK adequacy regulations or Standard Contractual Clauses).

Your rights under UK GDPR

You have the right to:

• Access a copy of the personal data we hold about you
• Have inaccurate data corrected, or your data erased
• Restrict or object to our processing
• Data portability
• Withdraw consent at any time (e.g. ask us to delete your uploaded documents)
• Complain to the Information Commissioner’s Office (ICO)

Email support@findmyvisa.co.uk and we’ll respond within one month.

Cookies

We use no advertising or tracking cookies. Our analytics are cookieless. See our cookies page for the current list.

Changes to this policy

Substantive changes will be reflected by an updated “Last updated” date above. If we begin processing a category of data not covered here, we will say so prominently.