Privacy Policy

1. Who we are

The data controller is QuantumHarbor (Dubai Sole Establishment, E-Trader Professional License No. 1511638, Dubai Department of Economy & Tourism), Dubai, United Arab Emirates.

For privacy questions, data-subject requests, or deletion, contact privacy@evisa.help. For general support, contact support@evisa.help.

2. Information we collect

We collect the following categories of personal information:

• Identity and contact data: your name and email address used to create and access your account.
• Traveler details: information you enter or that we extract from your documents — full name, date of birth, nationality, passport number and dates, and similar fields needed to complete a visa application.
• Document images: passport scans and portrait photos you upload, including the biometric-style facial image in a portrait photo.
• Payment data: handled by Stripe; we receive your email and non-identifying transaction metadata, not your full card number.
• Usage and device data: analytics and A/B-testing identifiers, pages viewed, and abuse-prevention signals.

3. How we use your information

We use personal information to:

• Prepare and assist with your visa or travel-authorization application.
• Extract data from your documents using optical character recognition and prepare portrait photos to meet application requirements.
• Process payments, prevent fraud and abuse, and provide customer support.
• Operate, secure, and improve the service, including analytics and experimentation.

4. Processing by third-party AI providers

To read your documents and prepare your photo, we send your passport scans and portrait photos to third-party artificial-intelligence providers via OpenRouter. These providers operate in various countries, including the United States and China.

We route these requests with a zero-data-retention setting and on a no-training basis, meaning the providers are instructed not to retain your images beyond the immediate request and not to use them to train their models.

This processing only happens after you grant AI-processing consent. If you decline, you can still complete your application by entering your details manually. Full details, including the specific providers and countries, are in our AI Processing Disclosure.

5. Who we share information with

We do not sell your personal information for money. We share it only with service providers ("sub-processors") who help us run the service, each under confidentiality and data-protection obligations:

• AI providers (via OpenRouter) for document OCR and photo preparation — see the AI Processing Disclosure.
• Supabase for hosting, database, and file storage.
• Stripe for payment processing.
• PostHog for analytics and A/B testing.
• Google Places for address lookup, Fingerprint for abuse prevention, Upstash for rate limiting, and Sanity for content management.
• Government or authority portals where you direct us to submit an application, and authorities or advisors where required by law.
• A current, maintained list of sub-processors (provider, role, and country) is available on our Sub-Processors page.

6. International transfers

Because our providers operate globally, your information may be processed in countries other than where you live, including the United States and China. We rely on the zero-data-retention and no-training routing described above, our contractual terms with providers, and our honest disclosure of recipients to safeguard your information.

7. How long we keep your information

We keep your account and document data for as long as your account is active, so your documents and details can be reused across applications without re-uploading.

You can delete any individual document or your entire account at any time from your account settings. Payment records are retained as long as required by applicable tax and accounting law. Document images are not retained by our AI providers (zero-data-retention routing).

8. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain sharing.

California residents (CCPA/CPRA): you have the right to know, delete, correct, and to opt out of the "sale" or "sharing" of personal information, and not to be discriminated against for exercising these rights. We honor Global Privacy Control (GPC) signals as a valid opt-out. You can also use the "Do Not Sell or Share My Personal Information" / "Cookie preferences" link in our footer.

UAE residents (PDPL): you have rights of access, correction, deletion, restriction, and to withdraw consent.

To exercise any right, use your account settings or contact privacy@evisa.help. We aim to respond within 48 hours.

9. Children

Our service is intended for adults. Account holders must be at least 18 years old. We do not knowingly collect personal information from children under 13. A family application may include a minor's details, which are provided and managed by the responsible adult account holder.

10. Security

We use encryption in transit, access controls, and database row-level security to protect your information. No method of transmission or storage is completely secure, but we work to protect your data using appropriate safeguards.

11. Changes to this policy

We may update this policy. When we make a material change, we publish a new version and ask you to accept it before you continue to use the affected parts of the service. The effective date and version appear at the top of this page.