The whole thing in three lines
- Your document scans are stored encrypted in London and never leave the UK.
- We delete them about 30 days after your order completes — we don't keep them as a record.
- We don't sell your data, and the only thing that leaves the UK is the address on an email we send you.
1Who controls your data
The controller is Avya Labs Ltd, trading as GetApostille, registered in England & Wales — company number [to be confirmed], registered office [to be confirmed]. For anything about your data, contact [to be confirmed].
2What we collect
The document you upload and any scan we take of it. Your name, email address and the postal addresses needed to send your document back. The country and document type you told our checker. A record of your order, its status and its payments.
Card details are handled entirely by Stripe and never reach our servers — we store only the result of the payment and the last four digits.
3Why we collect it
To do the thing you asked us to do: check your document, submit it to the FCDO, post it back, and tell you where it is. That is a contract, and it is the lawful basis for almost everything here.
We also keep enough of an order record to meet our tax and accounting obligations after your scans have been deleted.
4Where it is stored
In Amazon Web Services' London region, encrypted at rest and in transit. Document scans and stored personal data never leave the United Kingdom. This is a hard rule in how the service is built, not a preference.
5How long we keep it
Document scans are deleted about 30 days after your order completes, automatically. We keep the order record itself — dates, prices, status, and who it belonged to — for as long as tax law requires, because that record has no document image in it.
6Who else can see it
Amazon Web Services hosts the service in London. Stripe processes payments. Resend delivers our email; an email carries your address and your order's status, never a document or a scan, and Resend operates inside the EU. The FCDO receives the document itself, because that is the point of the service. Royal Mail carries it.
Nobody else. We do not sell your data, and we do not use it for advertising.
7Your rights
You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. You can delete your account yourself from your account settings, which removes your personal data and any scans still held.
To request a copy of everything we hold, email [to be confirmed] — we answer within one month. A self-service export is designed but not yet built, so today this is a manual request handled by a person.
If you think we have handled your data badly, please tell us first, but you can complain to the Information Commissioner's Office at ico.org.uk at any time.
8Cookies
We set only what the site needs to work — keeping you signed in and remembering an order in progress. We do not use advertising or tracking cookies, which is why you have not been asked to accept any.
Also here: terms of service and refunds and cancellations.