Privacy policy

The company operating ETAs.one, identified on the imprint page, is the data controller for the processing described here. For anything about your personal data, email support@etas.one.

When you book, we collect each traveller's passport country and name, one email address for the booking, and the option you choose. Card details go to Stripe, not to us.

After payment, for each traveller, we collect:

• Passport details: the passport number and its expiry date, the type of passport, date of birth, sex, place and country of birth, and any other nationalities, including past ones. For a Taiwan-issued passport, the identification card number the UK rules require.
• A photo of the passport and a photo of your face.
• Contact details: an email address, whether you have a phone number and the number if you do, and your home address.
• Whether you plan to be mostly in the United Kingdom, Jersey, Guernsey or the Isle of Man.
• Your employment and job title, or all your jobs if you have more than one.
• Answers to the questions the UK application asks about criminal convictions, involvement in war crimes, terrorism, extremism, espionage or sabotage, immigration history, previous refusals and similar matters, with any details you add.
• For a child, the name, email address, phone number and relationship of a parent or guardian.
• Your authorisation to submit, and a record of what our team did with the application.

We process these details because they are necessary to perform the contract with you: to check, prepare and submit the application you asked for, take your payment and keep you informed.

Some of them are sensitive: a photo of your face, and answers about convictions and immigration history. We ask for them only because the UK government's application asks for them, and we use them for nothing else. By authorising the application at the end, you ask us to process them for that purpose, and that is the consent we rely on for these details. We do not decide whether an answer makes a traveller ineligible: a person on our team reads them, and the Home Office decides.

We keep payment records because accounting and tax law require it, and security logs on the basis of our legitimate interest in running the service safely.

We share application details only with the parties needed to provide the service:

• The UK Home Office, which receives the application, the passport details and the photos when we submit on your behalf. Its own privacy notice applies from then on.
• Our own staff, who see an application in a restricted, signed-in workspace.
• Supabase, which stores the encrypted application data in the European Union, in Frankfurt, and Vercel, which hosts the service.
• Stripe, which processes your payment. It receives your email address, the amount, the option you chose, an internal reference for the application and the details you enter with it, such as your card. Card details are entered with Stripe and never reach us.
• Resend, which delivers the emails we send you.
• When automated photo checking is enabled, OpenAI processes the photos to assess their quality and to read the passport fields. We switch off storage of the response. The provider's own security and abuse-monitoring retention may still apply, and this is not a promise of zero provider retention. A person on our team looks at anything the check is unsure about. The check does not identify anyone and does not decide eligibility.

We submit applications to the Home Office in the United Kingdom, because you asked us to. Some of our providers are based in the United States. Where personal data leaves the European Economic Area, it does so under the EU standard contractual clauses or the EU-US Data Privacy Framework, and it remains protected to the standard required by EU law.

Application details and photos are encrypted before they are stored. Photos are never public, and staff open them only in the signed-in workspace, which records that they did. A secure cookie that scripts cannot read lets you return to your draft, so no passport information is kept in your browser's storage.

If you allow analytics, PostHog records how the application pages are used, with every input, your details and your answers hidden and every photo blocked: it sees the page as we wrote it, which steps you complete and where you click, never what you type, choose, answer or upload. If you allow advertising, OpenAI's advertising script also runs on application pages, as described under Advertising below. We never send it your photos, passport details or answers to the application questions. Card details never reach us. The emails we send about an application never contain a passport number or a photo.

Unpaid drafts are deleted after 7 days. Passport and face photos are deleted as soon as the traveller's application has been submitted to the Home Office. Other application details for a completed case are deleted 30 days after the case is completed. An open paid case is kept while we finish handling it.

Payment records and minimal operational records are kept separately for as long as accounting, disputes and security require. Backups made by our database provider follow that provider's own schedule, and the Home Office and Stripe keep their own records under their own rules.

Support messages are kept while the matter they concern is open, and then deleted unless the law requires us to keep them.

Only give us another person's details when you have their permission. For a child, you need the permission of a person with parental responsibility, and we ask for that person's contact details.

When you use the rest of this website we process messages you send through the contact form, with the name and email address you give, so we can answer you. Cloudflare Turnstile checks contact-form submissions for automated abuse. It receives the technical information needed to make that check, but not the message, your name or your email address.

We also keep technical logs needed to keep the site secure and to limit abuse, such as the time of a request and a secret-keyed identifier for its network or email address. Rate-limit windows expire after at most one hour, and stale counters are removed during later rate-limit checks.

The passport country you choose in the ETA check is used in your browser to take you to the application. The ETA check itself does not send anything else to us.

We ask for your choice the first time you visit, and you can change it at any time using the Cookie settings link in the footer. Until you choose, nothing optional runs. We store:

• Your cookie choice itself, kept in your browser so we do not ask again on every page.
• A necessary, secure cookie that lets you return to your application draft.
• A session cookie for staff signing in to our internal tools. It is never set for visitors.
• Analytics, only if you turn it on. On application pages it never sees what you type, choose, answer or upload. See below.
• Advertising measurement, only if you turn it on. It is a separate question from analytics, and answering yes to one is not answering yes to the other.

If you allow it, we use Vercel Web Analytics to see which pages people find useful, and Vercel Speed Insights to see which pages load slowly. Both are anonymous and aggregated, and neither uses advertising cookies or builds a profile of you.

With the same permission we use Google Analytics 4, with Google acting as our processor. It receives the address of the page you are on.

PostHog Cloud EU receives aggregate cookie-banner impression and choice events so we can compare clear versions of the banner. These events use a fixed aggregate identifier and no browser identifier, page address, referrer or customer data, so they can say how many people did something and never who. If you allow analytics, PostHog also receives an anonymous browser identifier, shortened page addresses, interaction events, masked session recordings and technical details about browser errors. We use it to understand which steps people complete, replay masked sessions, see which controls they use and diagnose browser errors. It masks every input value. Query strings and the private parts of staff page addresses are removed before they leave your browser. It receives the campaign labels in the link you arrived through, whether that link carried an advertising click code but never the code itself, and the name of the website that sent you, so we can tell which campaigns are worth running.

If you decline, or have not yet chosen, no optional analytics script is loaded and no optional analytics request is made. The separate aggregate measurement still records whether the banner was shown and which choice was made, without a browser identifier, page address or referrer.

Advertising is a separate question, and the answer is no unless you say otherwise. If you allow it, we use Google Ads and OpenAI Ads to tell which adverts brought someone to this site. Both act as our processors. Google may set advertising cookies once you have allowed it.

OpenAI's browser script then loads on every page of this website, including the application pages, and stores two references of its own in your browser, one for the advert you arrived from and one for the browser itself. On any page where you type them, including the contact form and the application form, it reads your email address, phone number, first and last name, and address details, hashes them on your own device, and sends the hashed values to OpenAI to match you to an advert. A hash is a one-way code that cannot be turned back into the value it was made from. Nothing from OpenAI Ads is loaded if you decline or have not yet chosen.

If you arrive from an advert, we note the advertising attribution token in the link in your browser's memory straight away, before you answer the cookie banner. It is only saved and sent to OpenAI if you then allow advertising. If you refuse, or you close the page without answering, it is discarded and never leaves your browser.

If you allowed advertising, when you pay our server also tells OpenAI about the purchase so it can be matched to an advert. It sends the amount and service chosen; hashed copies of your email address, our internal booking number, the first traveller's names and phone number, and the name and phone number on your payment method; the country, region, city and postcode of your billing address; the IP address and browser details of the device you paid from, and the approximate country, region and city that IP address points to; and the two advert references described above. Nothing else from your application form is sent, and never passport details, dates of birth, photos or answers to the application questions.

To send this after your payment is confirmed, we keep the IP address, browser details and approximate location of the device you paid from with the payment record at Stripe, our payment processor, alongside the two advert references. We only do this if you allowed advertising.

You can withdraw either permission at any time using the Cookie settings link in the footer. Withdrawing reloads the page, because a script that has already loaded keeps running until it does.

PostHog events, error details and session recordings are kept only while they help us understand and improve the website. We review whether they are still needed at least once a year and delete them when they no longer serve that purpose.

Under EU data protection law you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is wrong. Information already submitted to the government cannot be corrected by changing our copy, so tell us before we submit.
• Ask us to delete your data, except where we must keep it to meet a legal obligation.
• Ask us to restrict processing, or object to processing based on our legitimate interests.
• Receive the data you gave us in a machine readable form.
• Withdraw your consent to analytics or to advertising at any time using the Cookie settings link in the footer.
• Complain to the data protection authority in your country if you believe we have handled your data unlawfully.

Email support@etas.one from the address you used for your booking and tell us what you want. We may need to check that the request comes from the traveller or a person authorised to act for them. We answer within one month.

We update this page when our processing changes. The date below shows when it was last reviewed.