Privacy

Last updated 27 September 2026.

Schengen Visa Radar is an independent service. We handle personal data under the UK General Data Protection Regulation and the Data Protection Act 2018; what that means in practice is the rest of this page, not a badge at the top of it. For anything here, write to help@schengenvisaradar.com.

What we collect

• Your email address — you give it to us to sign in, and we send alerts to it.
• A push endpoint, only if you choose to add one.
• Your alert rules — which countries and application centres you asked to be told about.
• Your plan — whether the account is free or paid, and the date paid access runs to.

That is the whole list. We do not ask for your name, your passport details, your visa application, or anything about your travel. We have no account password, so there is none to lose.

We do not use advertising trackers, and we never sell or share your address with anyone for their own purposes. Neither of those will change. We do not currently use any third-party analytics either — if we ever add a tool to understand how the site is used, we will name it on this page before it starts, and it will never be used for advertising.

Why we are allowed to hold it

Three reasons, depending on which data:

• Your consent — for sending you alerts. You asked for them, and you can withdraw that at any time by unsubscribing or deleting your account, which is a real button and not a request you have to send us.
• Our contract with you — if you buy a pass, we need your address and your plan dates to give you the thing you paid for.
• A legal obligation — a record that a payment happened has to be kept for tax purposes.

Withdrawing consent stops the alerts, and you can delete the account in the same breath. It does not erase a payment record we are required to keep, and we would be breaking a different law if it did.

Who else processes it

Only suppliers who run the service on our behalf, under their own data protection terms:

• Amazon Web Services — hosting, the database and email delivery. Your data is stored in AWS's London region (eu-west-2).
• Cloudflare — DNS, and forwarding mail sent to our addresses.
• ntfy.sh — only if you choose push notifications, and only the endpoint you gave us.
• Stripe — only if you pay. Card details go directly to Stripe and never reach us; we store only whether you are paid and until when.

Where your data is

Your account, your alert rules and the record of what we sent you are stored in the United Kingdom, in AWS's London region (eu-west-2).

Some suppliers sit elsewhere. ntfy.sh is in Germany, which UK law treats as offering equivalent protection. Cloudflare and Stripe are US companies, and anything reaching them travels under the safeguards UK data protection law requires for transfers out of the UK. Nothing goes to a supplier not named above.

Cookies

One cookie, and only once you are signed in. It is called vsr_session, it holds a random identifier and nothing about you, and it is what saves you from clicking a fresh sign-in link on every page. Script cannot read it, browsers do not send it from other sites, and it expires after 30 days.

There are no advertising cookies and no third-party cookies, which is why this site has no consent banner to click — a cookie that is strictly necessary to provide something you asked for does not need one.

How long we keep it

• Your account — until you delete it. There is no inactivity sweep that quietly removes it for you.
• Records of alerts sent to you — 90 days, then deleted automatically. These stop you being sent the same alert twice.
• Sign-in sessions — 30 days.
• Sign-in links — 15 minutes, stored only as a one-way hash, so the link in your inbox cannot be recovered from our database.
• Anti-abuse counters — a one-way hash of the address, kept briefly to limit repeated sign-in attempts.

Deleting your account removes your address, your alert rules, your plan and the index that maps your address to your account. Records that only mention your account's internal identifier, and payment records we are required to keep, may persist for the periods above or as the law requires.

Your rights

You can ask us for a copy of what we hold, correct it, or have it erased. Erasure is self-service: sign in and delete your account. You can withdraw consent at any time by unsubscribing — every alert carries a one-click unsubscribe, and it works without signing in.

If you think we have handled your data badly, you can complain to the data protection authority where you live. We would rather you told us first, but you do not have to.

Changes

If this page changes in a way that affects you, we will say so on the site before it takes effect.