This notice explains both the non-identifying visa requirements check and the typed service application. The order summary identifies the contracting provider and data controller before payment. Card payment occurs on named hosted channels, and the website does not collect passport images or card credentials. The assisted e-visa package expressly includes one standard official application fee where payable.
The public website
You can read guides and use the current visa requirements checker without giving us a name, passport number or email address. The checker uses citizenship choice, purpose, duration and entries in your browser to display a preliminary result.
Normal hosting infrastructure may process technical logs such as IP address, browser, requested URL, time and security events. Analytics, if enabled, should use consent and configuration appropriate to applicable law.
Visa enquiries and service applications
For visa requirements checks, business quotes and uncertain cases, the form collects the selected service, citizenship, country of residence, truthful purpose, dates, entries, traveller count, cities, business-host details where relevant, name, preferred reply channel and optional notes. The preliminary insurance estimate asks for one birth year per traveller because age affects the final quote. General advice requests reject passport identity and payment fields.
If you continue to the full insurance application, we also collect each insured traveller’s name, birth date, citizenship and typed passport number, plus the contact email, residence and optional phone. These fields are sent to the designated service inbox to arrange the requested insurance offer. No payment is taken by submitting this application. We ask you not to enter medical records, scans or card details. Insurance identity details are not stored in the browser or included in a copy-to-chat fallback.
After a traveller selects a defined tourist-invitation or e-visa assistance product and sees an exact internal total or an explicit written-quote state, the paid-service mode also asks for each traveller’s passport-identical name, nationality, document type and number, birth details, sex marker, passport issue and expiry dates, address, occupation, other citizenships and previous Russia trips. It still rejects passport scans, file uploads and every card-data field.
Submitted requests and typed paid-service applications are sent through Cloudflare Email Sending to the designated Russian Visa Letter service inbox when that production transport is configured. A paid application email includes the biographical fields displayed in the form, including the typed passport number, because Russian Visa Letter needs them to fulfil the selected service. It never contains a passport scan, uploaded file, portal password, one-time code or card data. If the email service rejects or cannot confirm delivery, the public endpoint reports failure rather than presenting the application as accepted. An authenticated private HTTPS intake remains an optional fallback only when email delivery has not been configured. The endpoint itself does not write applications to a local database or place paid passport data in the copy-to-chat fallback.
The consent text refers to the Russian Visa Letter service. The order summary names the provider and data controller before payment. Business invitation guidance and e‑visa review remain separate services and are not described as tourist-voucher issuance.
Optional encrypted draft
You can choose to save a visa, insurance or business-invitation application for up to 24 hours in this browser, including after closing the tab. Saving is off until you select the draft checkbox. A draft may contain the passport, contact and trip fields you have entered. Visa, insurance and business drafts are kept separately. Housing, address, occupation and travel-history fields are optional in the main visa application.
Saving sends the draft over HTTPS to our same-origin encryption endpoint. The endpoint does not email it or store it in a database. Only encrypted data is kept in browser local storage; the encryption key is in a Secure, HttpOnly, SameSite cookie. Restoring requires that same browser and cookie, not another device or an email link. Drafts do not create an order and cannot be restored after 24 hours without another save. Expired encrypted data is removed the next time the form is opened; successful submission or Delete draft removes it immediately. Clearing browser data or using private browsing may remove it sooner. Do not enable saving on a shared device. Security and consent checkboxes are never restored as accepted.
Information we may process
Depending on your interaction and purchased service:
- contact details and correspondence;
- citizenship, residence and trip facts;
- name, birth date and passport details needed for document preparation;
- passport and portrait images only if a later, separately agreed secure document-exchange step requires them; the website form itself does not accept files;
- itinerary, host, occupation or application information;
- order, invoice and limited payment-reference data;
- correction, support and dispute records;
- consent and privacy-request records;
- technical and security logs.
We do not need your official portal password, email authentication code, card PIN or remote access credentials.
Why information is used
Information may be processed to:
- answer an enquiry;
- suggest which visa you may need;
- quote and contract for a service;
- prepare or arrange an invitation;
- review an e‑visa application under your control;
- deliver documents and support corrections;
- prevent fraud and protect systems;
- meet accounting, legal and regulatory obligations;
- handle complaints and exercise legal rights;
- improve general content using appropriately aggregated information.
Passport and application information is not used for behavioural advertising.
Legal grounds
Depending on applicable law and context, processing may rely on:
- steps requested before entering a contract;
- performance of the service contract;
- legal obligations;
- legitimate interests such as security, fraud prevention and service support;
- consent where required, including certain cookies or optional communications;
- establishment or defence of legal claims.
Where sensitive information is involved, an additional lawful condition may be required. Complex immigration or legal records should not be sent until the purpose and handling basis are clear.
Controller and other recipients
Requests submitted through the configured form channel reach the Russian Visa Letter service team. Before payment, the order summary identifies any provider that will receive data to fulfil the selected service.
Information may be shared only as needed with disclosed categories such as:
- the relevant host or invitation issuer;
- secure hosting and document-storage providers;
- Cloudflare Email Sending and the designated mailbox provider used to deliver and hold form correspondence;
- payment processors, which handle card data under their own secure systems;
- professional advisers and fraud-prevention providers;
- authorities where required by law or necessary for the requested service.
For tourist support, the order summary identifies the provider responsible for the voucher and confirmation before payment. The application form is a typed identity-data channel for the selected service; it is not a document-upload channel. Any onward disclosure requires the stated purpose and a named recipient where different.
International transfers
The service handles requests for travel to Russia, so a request sent from another country can involve an international transfer to the provider named in the order summary. Additional transfers may occur only where needed for a separately described host, processor or authority. Applicable mechanisms and safeguards depend on the customer location, purpose and recipient.
The order and any later secure document-exchange step identify the relevant recipient and purpose before passport or application documents are transferred. Do not treat an internet upload as proof that a lawful transfer mechanism exists.
Retention
Records are kept only for a stated service or legal reason. Our working schedule is:
- failed form submissions: not retained by the application endpoint;
- non-sensitive enquiries that do not become an order: up to 12 months after the last substantive contact;
- working passport and application data, including the designated inbox copy: for the active service, correction period and 90 days after completion, then deleted or irreversibly minimised unless a legal claim requires it;
- invoices, payment references and the minimum accounting record: 5 years after the relevant reporting year, or longer where law requires;
- complaint, fraud and dispute evidence: until the matter and applicable limitation period end;
- security logs: up to 90 days unless an investigated incident requires longer preservation;
- rotating backups: up to 30 days after deletion from the active system.
Deletion from an active workspace does not erase a legally required invoice. Conversely, an accounting duty does not justify retaining a passport image with the invoice. Where another recipient controls its own copy, we identify that recipient and help forward your request to them.
Cookies and analytics
Essential technologies can support security and site operation. Non-essential analytics or advertising technologies should not be set where consent is required until the user chooses them.
The static content site is designed to function without advertising cookies. If analytics is enabled, it should avoid collecting passport, form or document contents and should honour applicable consent controls.
Your choices and rights
Depending on applicable law, you may have rights to:
- access personal data;
- correct inaccurate data;
- delete data;
- restrict or object to processing;
- receive portable data;
- withdraw consent;
- complain to a supervisory authority;
- receive information about international transfer safeguards.
Rights can be limited by lawful retention and other exceptions. We explain any refusal or limitation.
Making a request
Use contact with the subject Privacy request. Describe the interaction and requested action. Do not email a new full passport copy automatically; we will use proportionate verification appropriate to the request.
Children
Each child needs their own e‑visa application, which can require personal information. A parent or lawful guardian should control the service interaction and provide only what is necessary. The service is not intended for children to order independently.
Security and incidents
We use the principles described on the security page: data minimisation, credential separation, limited access, secure transport, processor review and incident handling. No system can promise absolute security.
If you suspect exposure, report the time and channel without including live credentials. Change compromised passwords directly with the relevant official provider.
Changes to this notice
Material changes should be reflected in the text and review date. A change in operator, issuer flow, international transfer or sensitive-data purpose requires more than a silent date update.