Privacy Policy

1. Who we are

The data controller is QuantumHarbor (Dubai Sole Establishment, E-Trader Professional License No. 1511638, Dubai Department of Economy & Tourism), Dubai, United Arab Emirates.

For privacy questions, data-subject requests, or deletion, contact privacy@evisa.help. For general support, contact support@evisa.help.

2. Information we collect

We collect the following categories of personal information:

• Identity and contact data: your name and email address used to create and access your account.
• Traveler details: information you enter or that we extract from your documents — full name, date of birth, nationality, passport number and dates, and similar fields needed to complete a visa application.
• Document images: passport scans and portrait photos you upload, including the biometric-style facial image in a portrait photo.
• Payment data: handled by Stripe; we receive your email and non-identifying transaction metadata, not your full card number.
• Rejection Protection records: if you add Rejection Protection, the price and the amounts covered for each traveler; the authority's decision on each traveler's application and the reason we record for it (for example, a refusal by the authority, a mistake on our part, or information that did not match the traveler's documents); a copy of the authority's refusal notice, which can show the traveler's name, passport details, and the reasons the authority gave; and any refund we issue.
• Usage and device data: analytics and A/B-testing identifiers, pages viewed, and abuse-prevention signals.

3. How we use your information

We use personal information to:

• Prepare and assist with your visa or travel-authorization application.
• Extract data from your documents using optical character recognition and prepare portrait photos to meet application requirements.
• Process payments, prevent fraud and abuse, and provide customer support.
• Decide and issue refunds under our Refund Policy, including automatic Rejection Protection refunds (section 5), and respond to payment disputes and chargebacks.
• Operate, secure, and improve the service, including analytics and experimentation.

4. Processing by third-party AI providers

To read your documents and prepare your photo, we send your passport scans and portrait photos to third-party artificial-intelligence providers via OpenRouter. These providers operate in various countries, including the United States and China.

We route these requests with a zero-data-retention setting and on a no-training basis, meaning the providers are instructed not to retain your images beyond the immediate request and not to use them to train their models.

This processing only happens after you grant AI-processing consent. If you decline, you can still complete your application by entering your details manually. Full details, including the specific providers and countries, are in our AI Processing Disclosure.

5. Rejection Protection refunds and automated decisions

If you add Rejection Protection and the authority refuses a protected traveler, we refund that traveler under section 6 of our Refund Policy without you having to ask. To do this, we use the Rejection Protection records described in section 2.

A member of our team records the authority's decision for each traveler and attaches the refusal notice. The rest is normally automated: our systems check that the traveler is covered, calculate the refund from the prices and terms saved when you paid, check your payment (for example, that it has not already been refunded and is not under dispute), and, after a short waiting period, instruct Stripe to issue the refund.

A person reviews the case before any money is refunded whenever it is not straightforward — for example, when the refusal notice is missing, the recorded reason is not a refusal by the authority or a mistake on our part, part of the payment was made with credit, the amount is above our limit for automatic refunds, the payment is under dispute, only some travelers in a bundle were refused, or a refund attempt fails. Our systems never decide on their own that a refund is not owed: that decision is always made by a person.

If you disagree with a refund decision or amount, write to support@evisa.help and ask for a person to review it. They will check the authority's decision, the refusal notice, and the calculation, and tell you the result. You can also ask for a copy of the information we used (see section 9).

Refusal notices are kept in our file storage (Supabase), in an area that only our systems and authorized staff can access; they do not appear in your account. We keep each notice until 18 months after the refund is completed or the claim is otherwise closed — long enough to cover the period in which the payment can still be disputed with your bank — and then delete it. If you delete your account before then, we delete it at that point.

6. Who we share information with

We do not sell your personal information for money. We share it only with service providers ("sub-processors") who help us run the service, each under confidentiality and data-protection obligations:

• AI providers (via OpenRouter) for document OCR and photo preparation — see the AI Processing Disclosure.
• Supabase for hosting, database, and file storage.
• Stripe for payment processing and for issuing refunds, including Rejection Protection refunds.
• PostHog for analytics and A/B testing.
• Google Places for address lookup, Fingerprint for abuse prevention, Upstash for rate limiting, and Sanity for content management.
• Government or authority portals where you direct us to submit an application, and authorities or advisors where required by law.
• A current, maintained list of sub-processors (provider, role, and country) is available on our Sub-Processors page.

7. International transfers

Because our providers operate globally, your information may be processed in countries other than where you live, including the United States and China. We rely on the zero-data-retention and no-training routing described above, our contractual terms with providers, and our honest disclosure of recipients to safeguard your information.

8. How long we keep your information

We keep your account and document data for as long as your account is active, so your documents and details can be reused across applications without re-uploading.

You can delete any individual document or your entire account at any time from your account settings. Document images are not retained by our AI providers (zero-data-retention routing).

When you delete your account, we remove it from our systems together with your traveler details, documents, applications, and the payment records in our own database. Records of your payments and refunds remain with Stripe, our payment processor, and are kept for as long as applicable tax and accounting law requires.

Rejection Protection records are not deleted with your account. We pseudonymise them: we remove the link to your account but keep the amounts, dates, decisions, and payment references, as financial records of money we collected and refunded, for as long as applicable tax and accounting law requires. Deleting your account also ends any Rejection Protection cover that has not yet paid out, so if a refund is due to you, wait until it has arrived before you delete your account.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, to opt out of certain sharing, and to ask for a person to review a decision made about you by automated means (see section 5).

California residents (CCPA/CPRA): you have the right to know, delete, correct, and to opt out of the "sale" or "sharing" of personal information, and not to be discriminated against for exercising these rights. We honor Global Privacy Control (GPC) signals as a valid opt-out. You can also use the "Do Not Sell or Share My Personal Information" / "Cookie preferences" link in our footer.

UAE residents (PDPL): you have rights of access, correction, deletion, restriction, to withdraw consent, and to object to decisions based solely on automated processing.

To exercise any right, use your account settings or contact privacy@evisa.help. We aim to respond within 48 hours.

10. Children

Our service is intended for adults. Account holders must be at least 18 years old. We do not knowingly collect personal information from children under 13. A family application may include a minor's details, which are provided and managed by the responsible adult account holder.

11. Security

We use encryption in transit, access controls, and database row-level security to protect your information. No method of transmission or storage is completely secure, but we work to protect your data using appropriate safeguards.

12. Changes to this policy

We may update this policy. When we make a material change, we publish a new version and ask you to accept it before you continue to use the affected parts of the service. The effective date and version appear at the top of this page.