Skip to content
Firzar

Privacy Policy

Last updated: 12 July 2026. This policy explains what data we collect, how we use it, and your rights under GDPR (EU/UK), CCPA/CPRA (California), and other privacy laws.

1. Data We Collect

1.1 Data you provide directly

  • Account data: Email address and password (hashed) when you create an account.
  • Profile data: Your selected passport/origin country, saved countries, and itinerary data.
  • Search data: Visa-check queries, comparison selections, and search history stored in your account.
  • Consent records: Timestamp of when you accepted the Terms of Service and Privacy Policy.

1.2 Data collected automatically

  • Technical data: IP address, browser type, device information, and referring URLs.
  • Usage data: Pages visited, time on page, click events, and navigation paths.
  • Cookie data: Session cookies (authentication), functional cookies (preferences), and marketing cookies (affiliate tracking) — see our Cookie Policy.

2. How We Use Your Data

  • To provide visa requirement lookups, country comparisons, and travel cost estimates.
  • To save your favourites, itineraries, and passport comparisons across sessions.
  • To send service notifications (e.g. account security alerts).
  • To analyse usage patterns and improve our services.
  • To comply with legal obligations and prevent fraud.

3. Legal Basis for Processing (GDPR Article 6)

  • Consent: For marketing cookies, affiliate tracking, and non-essential analytics.
  • Contract: For account creation, saved data, and core service functionality.
  • Legitimate interest: For security monitoring and service improvement.
  • Legal obligation: For tax records and regulatory compliance.

4. Affiliate Tracking & Third-Party Cookies

Firzar participates in affiliate programs with travel booking providers (e.g. Travelpayouts network, eSIM, FX, insurance, EOR services). Third-party networks may place cookies on your device to track purchases and award us commissions. We do not control these cookies — each network has its own privacy policy:

  • Affiliate tracking cookies are classified as Marketing cookies in our cookie consent banner.
  • Click-based affiliate cookies are not set until you accept marketing cookies or click a partner link (prior consent where required). The Travelpayouts Drive loader (emrld.ltd, marker 561222) is installed site-wide in the document head per network requirements and carries CMP attributes for consent tooling.
  • You can reject marketing cookies at any time while still using functional features like saving favourites.
  • See our Affiliate Disclosure for a full list of partner networks.

5. Cross-Border Data Transfers

Firzar is hosted on Cloudflare Workers (global edge network) and Supabase (data stored in EU and US regions). Your data may be processed on servers outside the UK or EU. We rely on the following legal mechanisms:

  • UK/EU → US transfers: Standard Contractual Clauses (SCCs) as adopted by the European Commission and UK Government.
  • Cloudflare: Certified under the EU-US Data Privacy Framework.
  • Supabase: Compliant with GDPR through Standard Contractual Clauses and data residency options.

6. Data Sharing

We share data with the following categories of recipients:

  • Cloudflare: CDN, edge computing, and security (DDoS protection).
  • Supabase: Database hosting, authentication, and file storage.
  • Affiliate networks: Only when you click an affiliate link — they receive referral data.
  • Google: If you use Google Sign-In, Google processes your authentication.
  • Apple: If you use Apple Sign-In, Apple processes your authentication.
  • Legal authorities: When required by law, court order, or to protect rights and safety.

7. Your Rights

7.1 GDPR Rights (EU & UK residents)

  • Right of access: Request a copy of your personal data via the data export tool in Account Settings.
  • Right to rectification: Correct inaccurate data in your account profile.
  • Right to erasure ("Right to be Forgotten"): Permanently delete your account and all associated data from Account Settings → Delete Account.
  • Right to data portability: Export your data in machine-readable JSON format.
  • Right to object: Object to processing based on legitimate interests.
  • Right to withdraw consent: Change your cookie preferences or disconnect social sign-in at any time.
  • Right to restrict processing: Request we limit how we use your data.

7.2 CCPA/CPRA Rights (California residents)

  • Right to know: What personal information we collect and how it is used.
  • Right to delete: Request deletion of your personal information.
  • Right to opt-out: Manage cookie preferences to opt out of sale/sharing of data.
  • Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

Do Not Sell or Share My Personal Information: Firzar does not sell your personal data. We do share data with affiliate networks when you click affiliate links, which may constitute "sharing" under CPRA. You can opt out by rejecting marketing cookies in our cookie settings.

8. Data Retention

  • Active accounts: Data is retained for the lifetime of your account.
  • Deleted accounts: All personal data is permanently deleted within 30 days of account deletion.
  • Anonymous usage data: Aggregated, non-identifiable data may be retained indefinitely for analytics.
  • Legal records: Consent timestamps and tax records retained as required by law.

9. Children's Privacy

Firzar is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us and we will delete it.

10. Security Measures

  • All data in transit is encrypted via TLS 1.3.
  • Authentication tokens are stored as HTTP-only cookies (not accessible by JavaScript).
  • Row-level security (RLS) policies enforce per-user data isolation in our database.
  • Regular security audits and dependency vulnerability scanning.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the website. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy enquiries, data requests, or to exercise your rights, contact us at privacy@firzar.com or write to: Firzar, London, United Kingdom.

You also have the right to lodge a complaint with your local data protection authority. In the UK: the Information Commissioner's Office (ico.org.uk). In the EU: your national supervisory authority.