About PassportTrail
PassportTrail is a travel history tracking and visa compliance tool built for frequent travellers. We help you track border crossings, monitor visa compliance, and generate official travel history reports.
PassportTrail is operated by Haq Digital LLC, a limited liability company incorporated in the State of Wyoming, United States. Our registered address is 30 N Gould St Ste N, Sheridan, WY 82801. For privacy enquiries or data requests, contact us at support@passporttrail.com.
Information We Collect
Personal data you provide:
- Name and email address (account registration)
- Home country and passport nationality
- Passport details: nationality, issuing country, issue date, expiry date — stored as plaintext (not encrypted)
- Passport number — stored encrypted using AES-256 encryption
- Travel history: countries visited, entry/exit dates, ports, visa types
Data collected automatically:
- IP address (for GDPR consent records and security)
- Browser type and version
- Device type (mobile/desktop)
- Pages visited and features used, via:
- Plausible Analytics (cookie-free, no personal data)
- Google Analytics (GA4) — uses cookies, may process IP address, device, and browser data for aggregated usage statistics
- Error logs (anonymised)
Data we do NOT collect:
- We do not sell your data to third parties
- We do not use your passport data for advertising
- We do not share your travel history with governments or immigration authorities
- We use minimal cookies for analytics purposes (see Cookies section below)
How We Use Your Data
- To provide the PassportTrail service and your travel history
- To calculate visa compliance status (Schengen, UK, US, Canada rules)
- To send passport and visa expiry reminders you have opted into
- To process your subscription payment via Stripe
- To respond to customer support requests
- To comply with our legal obligations
Legal Basis for Processing
- Contract: processing necessary to provide the service you signed up for
- Legitimate interest: security, fraud prevention, service improvement
- Consent: marketing emails (you can withdraw at any time)
- Legal obligation: responding to lawful requests from authorities
Data Storage & Security
- All data stored in Supabase (hosted on AWS ap-northeast-2, Seoul, South Korea)
- Passport numbers encrypted using AES-256 encryption in application code before storage; other passport fields (nationality, issuing country, issue/expiry dates) are stored as plaintext
- Nationality, issuing country, and passport dates alone do not enable identity theft or financial fraud — the passport number is the sensitive identifier, and it is the field we encrypt
- All data transmission encrypted via TLS/HTTPS
- Access limited to authorised personnel only
- Regular security reviews conducted
Account Recovery
Your registered email address is your only account recovery key. If you forget your password, use the forgot password link on the login page to receive a reset email. If you no longer have access to your registered email address, contact support@passporttrail.com for assisted recovery. We recommend storing your login email in a safe place.
Data Retention & Lifecycle
- Active accounts: data retained for the lifetime of your account
- Deleted accounts: all personal data permanently deleted immediately upon deletion request
- Anonymised analytics: retained indefinitely (no personal data)
- Legal/financial records: retained for 7 years as required by applicable law
Inactivity: Free plan accounts inactive for 3 consecutive years (no login) will be notified at 33 months and 36 months before permanent deletion 7 days after the final notice. Lifetime accounts follow a 10-year inactivity threshold. Active Pro subscribers are never deleted due to inactivity.
Travel History Data — Retention Exemption
Travel history records (countries visited, entry and exit dates, ports of entry, visa types, and associated passport data) are classified as long-term regulatory compliance data. Travellers regularly require access to historical border crossing records spanning multiple years for visa applications, immigration interviews, tax residency assessments, and regulatory compliance filings.
- Travel history text logs are explicitly exempted from automatic lifecycle deletion scripts. PassportTrail does not run scheduled deletion jobs that purge travel records based on account inactivity, subscription lapse, or time elapsed.
- When a paid plan expires or is cancelled, accounts enter a 90-Day Frozen Vault state. After 90 days without reactivation, records are moved to a server archival state — a storage-efficiency measure that does not constitute deletion. Archived records remain fully restorable upon plan reactivation.
- This retention exemption does not override a user's statutory rights — see GDPR Rights below.
GDPR Right to Erasure — Manual Account Deletion
Notwithstanding the travel history retention exemption above, every account holder retains an absolute GDPR Right to Erasure (the “right to be forgotten”) which PassportTrail fully honours. This right is exercised exclusively via the manual Account Deletion sequence accessible from Account Settings.
- Upon submission of a verified account erasure request, all personal data — including travel history records, passport details, family member profiles, and associated identifiers — is permanently and irreversibly deleted immediately.
- Financial and legal transaction records are retained for 7 years as required by law, but are anonymised and cannot be linked back to your identity after deletion.
- Deleted data cannot be recovered. We recommend exporting your full travel history PDF before initiating account deletion.
- Erasure requests submitted through channels other than the Account Settings deletion flow are not processed automatically and will require identity verification before action is taken.
Your GDPR Rights
You have the right to:
- Access: request a copy of all data we hold about you
- Rectification: correct inaccurate data
- Erasure: request deletion of your data (“right to be forgotten”)
- Portability: receive your data in a machine-readable format
- Restriction: request we stop processing your data
- Objection: object to processing based on legitimate interest
- Withdraw consent: for marketing emails at any time
To exercise these rights: for erasure, use the manual Account Deletion sequence in Account Settings (see above); for portability, use Download My Data in Account Settings to export your data in JSON format; for all other requests, Contact Us. We will respond within 30 days. Identity verification required.
Cookies
PassportTrail uses minimal cookies:
- Essential cookies: session management, authentication (required, cannot be disabled)
- Analytics: we use Plausible Analytics (cookie-free) and Google Analytics (GA4), which uses first-party cookies to measure site usage and improve our service
- We do not use advertising cookies or third-party tracking cookies for marketing purposes
Third-Party Data Processors
- Supabase (database and authentication): supabase.com/privacy
- Stripe (payment processing): stripe.com/privacy
- Resend (email delivery): resend.com/privacy
- Vercel (hosting): vercel.com/legal/privacy-policy
- Plausible Analytics (website analytics): plausible.io/privacy
- Google Analytics (website analytics): policies.google.com/privacy
International Data Transfers
Your data may be processed outside your country of residence. We ensure appropriate safeguards are in place (Standard Contractual Clauses for transfers outside the EEA).
Children's Privacy
PassportTrail accounts are intended for users aged 16 and over. We do not knowingly collect personal data directly from children under 16. However, account holders may add minor dependants (sons, daughters, stepsons, stepdaughters, or wards) as family member profiles under their own account for family travel record keeping. In this case the account holder (parent or guardian) is responsible for the accuracy of data entered on behalf of their minor dependant and consents to its processing on the minor dependant's behalf.
Changes to This Policy
We will notify registered users by email of material changes.
Last updated: 27 July 2026