Last updated: May 13, 2026
EasyOnward ("we," "us," "our") is a travel intelligence platform that helps travelers understand visa, transit, and entry requirements for international travel. This Privacy Policy explains how we collect, use, store, and protect your personal information.
When you create an account, we collect your name and email address via your OAuth provider (Google, Apple). We do not collect or store your OAuth provider password.
To provide personalized travel compliance analysis, you may voluntarily provide:
When you use the passport scan feature, your passport image is uploaded to our server for MRZ (Machine Readable Zone) extraction. The image is processed in memory and is not stored. Only the extracted text fields (name, nationality, expiry, etc.) are saved to your profile.
We collect anonymized usage data including search queries, affiliate link clicks, pages visited, and feature usage. This data helps us improve the product and is not linked to your identity unless you are signed in.
Draft — pending counsel review. The wording below describes the consent posture engineering has built into the product. The legal review will confirm whether the language and scope meet GDPR Art. 9, UK GDPR, and CCPA / CMIA sensitive-data requirements before public launch.
Some of the data EasyOnward's rules engine can evaluate is considered a special category of personal data under GDPR Article 9 — most notably health information (vaccinations, medications, chronic conditions, pregnancy, travel-insurance coverage). The GDPR forbids us from processing this data unless one of the exemptions in Article 9(2) applies. We rely on Article 9(2)(a): your explicit consent.
You can use EasyOnward without ever entering any health information. When you skip these fields, the rules engine falls back to generic destination-level guidance (for example, it will still warn you about yellow-fever requirements in endemic regions, but it won't personalise the warning to your vaccination status). Every health field on the Profile screen is labelled "optional" — you choose what to share.
Before you can save any health information to your profile, you must tick an affirmative-consent checkbox. The checkbox label reads "I'm choosing to share this health information to personalise my screening." By ticking it, you give EasyOnward explicit consent to:
Nothing the rules engine outputs is medical advice. We surface destination-level facts (e.g., "yellow-fever vaccination is mandatory for entry") and the official source behind them so you can make informed decisions with a qualified healthcare professional. Always consult a doctor or travel-medicine clinic before changing or starting any treatment, and treat our output as a checklist, not a prescription.
You can revoke consent at any time from Profile → Medical-data consent. Revoking blocks any further health-data writes immediately and prevents the rules engine from using your health fields in future evaluations. Revoking does not delete the data you have already entered — use the "Delete profile" flow if you want it removed. (We separate the two actions so you can pause sharing without losing the data you have curated.)
EasyOnward does not collect or evaluate biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or data concerning sex life or sexual orientation. We do store passport metadata that includes the "sex" field machine-read from the document's Machine Readable Zone — that field is treated as ordinary identifying data under Art. 6, not special-category data under Art. 9, because it is the value the document itself encodes and is required to match the document when crossing a border.
We do not sell your personal information. We share data only in these limited circumstances:
To run EasyOnward we rely on a small set of third-party services that may process limited categories of your data on our behalf. We choose providers we believe meet appropriate security and data-protection standards, and we only share the minimum data each provider needs to perform its function.
When you click a "Browse other prices" or comparable affiliate CTA, your browser navigates directly to the partner site. EasyOnward does not transmit your profile, search history, citizenship, or any other server-held data to the partner — the partner sees the same HTTP request your browser would have sent had you typed the URL yourself, plus the affiliate identifier in the URL. The flight-search affiliates that appear on result cards are:
tp.media/click. The Aviasales CTA goes directly to Aviasales; Travelpayouts receives that click via Aviasales' server-side attribution callback.The authoritative implementation reference is docs/subprocessors.md in our repository, which records each integration's code paths and is reviewed quarterly. When we add a new sub-processor, this section and that document are updated together.
Your profile data is retained as long as your account is active. You can delete your profile data at any time from the Traveler Profile page. If you delete your account, all associated data (profile, trips, evaluations) is permanently deleted within 30 days.
Specific retention windows by data category:
Depending on your jurisdiction, you may have the right to:
Data export scope (GDPR Art. 20): the JSON export available from Settings → Privacy includes your account metadata, traveler-profile fields, saved trips, and search history. Some fields are encrypted at rest with per-user keys (passport / visa / permit numbers, free-text notes) and are not emitted in plaintext on the bulk export; they remain accessible to you in their decrypted form through the Profile / Entry Authorisations pages while you are signed in. Request a one-time decrypted bundle by email to the address below if you need it for a portability migration.
To exercise any of these rights, contact us at [email protected].
We use two essential cookies, both set by our server. We do not use third-party advertising cookies, fingerprinting, or client-side tracking pixels. Analytics is logged server-side from the request, not from a browser cookie. Anonymous visitors receive zero cookies until they take an action that needs one (signing in or starting an OAuth round-trip).
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
| session | Authenticated session for a signed-in user. Used to identify your account on every API call. Server-side revocable. | 30 days | HttpOnly, Secure, SameSite=Lax |
| oauth_state | Short-lived state for an in-flight Google or Apple sign-in round-trip. Lets us verify the provider's callback. | 1 hour | HttpOnly, Secure, SameSite=None |
We also use browser localStorage for a few non-identifying preferences (theme, currency, draft guest profile). These are not cookies, are not sent in HTTP requests, and stay on your device until you clear them.
EasyOnward is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. Continued use of the platform after changes constitutes acceptance.
Draft — pending appointment. EasyOnward is not established in the European Union. Article 27 of the GDPR requires us to designate a representative in the EU for data subjects and supervisory authorities to contact. The appointment and the published contact details below will be finalised before public launch in the EU. Until then this section is a placeholder and you should reach us through the main contact channel in Section 12.
EU Representative (to be appointed):
Name: [Pending appointment]
Postal address: [Pending appointment]
Contact email: [Pending appointment]
The representative will act as the point of contact for EU and EEA data subjects exercising their rights, and for the supervisory authority of any EU member state. The appointment does not change who acts as the controller — that remains EasyOnward — nor does it limit your ability to lodge a complaint with your own national data-protection authority.
For privacy-related questions or requests — including the rights listed in Section 7 — contact us at [email protected].
If you do not receive a response within seven days, please try again from a different address — replies can be lost to aggressive spam filters on either side. We are working on an in-app contact form to remove this dependency before public launch.