Data Retention

1. Document storage

Uploaded documents - passport scans, photographs, travel confirmations, and supplementary materials - are stored for the duration of your application process plus a 30-day post-resolution retention period. After this period, documents are permanently deleted from Cloudflare R2 and our database.

The post-resolution window exists so we can address any follow-up questions, provide a government authority with previously submitted materials at your request, or resolve post-submission issues.

Applications you started but never submitted. If you begin an application, upload documents, and do not submit it, we keep those documents for 90 days from your last activity so you can return and finish. After 90 days the documents are permanently deleted from Cloudflare R2 and our database, because no application was submitted to any government authority and no service was purchased. The draft record itself is deleted on request, or with your account.

2. Account data

Your Haavisa account information (name, email address, nationality, and application history) is retained while your account is active. You can delete the account yourself at any time from Settings → Delete my account, which erases it immediately; if you ask us by email instead, we complete the deletion within 30 calendar days. Either way this is subject to any legal obligations that require us to retain certain records (e.g., tax or financial reporting requirements) and to any application that is still in progress with a government authority - see section 4.

3. Payment records

Payment transaction records (amounts, dates, payment method references) are retained as required by our payment processors and applicable financial regulations. Haavisa does not store your full credit-card number, CVC, or banking credentials - these are handled entirely by Stripe and PayPal.

4. Requesting deletion

There are two ways to have your account and your personal data erased.

Delete it yourself. Sign in and open Settings → Delete my account. Before you confirm, the page shows exactly what will be deleted and exactly what we are required to keep; the deletion then runs straight away. It cannot be undone. This is the fastest route and needs no email.

Ask us. Email support@haavisa.com from the email address associated with your Haavisa account, including your transaction ID if applicable. Use this route if you can no longer sign in, or if you would like us to try to withdraw an application that is already with a government authority before it is erased. We will confirm receipt within one business day and complete the deletion within 30 calendar days, or notify you of any legal basis that requires us to retain specific data beyond that window.

What is kept. An application that is still in progress with a government authority - paid for, queued or filed, and not yet approved, rejected or withdrawn - is kept and unlinked from your account. It cannot be erased yet: the authority still holds the file, and withdrawing it mid-process would leave your application stranded. Its uploaded documents are deleted on the 30-day post-resolution schedule described in section 1 once the application reaches a final status, and the application record itself is held, unlinked from you, until the authority has finished with it. Records of payments we have taken are kept for accounting and tax law, and our security audit log is kept; both are detached from your name and contact details.

5. Data subject rights

Depending on your jurisdiction, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate information
• Request deletion of your data
• Restrict or object to processing
• Request a copy of your data in a portable format

To exercise any of these rights, contact support@haavisa.com.