Privacy notice
This notice explains how VisaVisa ("we") handles your personal data, in line with India's Digital Personal Data Protection Act, 2023 and the rules made under it.
What we collect and why
| Data | Why | Kept for |
|---|---|---|
| Email, name and optional mobile number for your account | To sign you in with a one-time code and contact you about your application | Until you ask us to delete your account, or 24 months after your last activity |
| Trip answers (destination, purpose, timing, previous refusal, plan, profile, travel date) | To build your checklist, timeline and fee quote | With your application |
| Documents you upload (passport, bank statements, tax returns, letters) | To check and prepare your visa application | Deleted 30 days after your application is closed or decided, unless you ask us to keep them |
| Payment records and invoices | Tax and accounting law | As long as the law requires |
| Call-back requests (name, mobile, email, message) | To respond to your enquiry | 180 days after your last contact, unless you become a client |
| Anonymous usage events (for example, that a step of the questionnaire was completed) | To improve the service | Up to 24 months, with no names, documents or financial data |
Our free tools (risk checker, checklist, bank balance calculator) run in your browser. Your trip answers stay in your browser until you choose to save your plan.
How documents are protected
Uploaded files are encrypted with AES-256 before they are written to disk, stored on servers in Bengaluru, India, and can only be opened through your signed-in account or by the VisaVisa reviewer working on your application. We never put documents in emails.
Automated document checks (optional)
If you switch on automated checks in your application, each new file is sent to our AI provider, OpenAI (USA), to look for problems such as blur, expiry, the wrong document or bank statement red flags. OpenAI processes it under its API terms and does not use it to train models. The result is provisional; an expert makes the final decision. Checks are off unless you turn them on, and you can turn them off at any time.
Consent
We process your account, trip and documents on the basis of the consent you give when you save your plan, and enquiry data on the basis of the consent on our form. You can withdraw consent at any time by emailing us; we will then stop processing and delete your data unless the law requires us to keep it.
Who we share data with
- Authorities and their visa centres: only what is needed for your application, and only when you ask us to proceed.
- Service providers: our hosting provider (DigitalOcean, servers in India), our email provider (Google Workspace, for sign-in codes and updates), Razorpay for payments, and OpenAI only if you switch on automated checks. Each is bound by contract to protect your data.
- We never sell your data, and we never use your documents for marketing.
Where data is stored
Our application, database and document storage are hosted in India (Bengaluru). Email delivery, and automated checks if you turn them on, involve providers outside India as described above.
Your rights
You can ask to access, correct or erase your personal data, nominate someone to exercise your rights, and raise a grievance. Email hello@visavisa.in with the subject "Data request". We respond within the time set by law.
Children
We process a child's data only with verifiable consent from a parent or lawful guardian, and only for the child's visa application.
Security incidents
If a personal data breach affects you, we will inform you and the Data Protection Board of India as required by law.
Grievance officer
Grievance Officer, VisaVisa. Email: hello@visavisa.in. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Changes
We will update this notice when our practices change and show the date above.