Privacy Notice
In plain language: you tell VisaOS about your circumstances and file documents, and we use them to help you prepare a visa application. We do not sell your information, we do not share it with any government on your behalf, and you can ask us to delete it.
1 · Who we are
VisaOS is operated by VisaOS™ OÜ, which is the controller of the information described in this notice. Contact routes are on Legal information.
VisaOS is independent. It is not part of, endorsed by or affiliated with any government, embassy or consulate, and it does not make visa decisions.
2 · Scope of this notice
This notice covers the VisaOS website, the application workspace, VisaOS Coach™, Final Review and Export, and our support correspondence. It does not cover the websites of embassies or consulates, or any third-party service you choose to use alongside VisaOS.
3 · What we hold
A visa application concentrates unusually sensitive material in one place. We have listed every category rather than summarising it, because you should be able to see exactly what that means.
- Passport and identity information
- Passport biographical pages, document numbers, nationality, date and place of birth.
- Passport photographs
- The photograph you file for the application, held as an image.
- Contact information
- Name, email address, and any telephone number you choose to give.
- Financial information
- Balances, income figures and the financial position you describe.
- Bank statements
- Statement documents you file as evidence, including transaction detail visible on them.
- Employment, business or qualifying-activity information
- Contracts, invoices, company details, client relationships and the nature of your work.
- Current-location and immigration information
- Address evidence, current country of residence, previous travel and immigration history you tell us about.
- Uploaded evidence
- Any other document you file into a section of your application.
- Answers and generated section narratives
- What you enter in each section, and the drafts prepared for your review and approval.
- VisaOS Coach™ interactions
- The questions you ask, and the guidance returned to you.
- Readiness and completeness information
- Which requirements are met, which remain open, and how complete each section is.
- Payment and transaction information
- A record that payment succeeded, the amount, and the identifiers our payment providers return. Card and bank credentials never reach VisaOS.
- Technical, security and usage information
- Device and browser information, IP address, and security and error logs.
- Cookie and preference information
- Your consent choices, the date you made them, and the policy version in force at the time.
Some of this material may include information that is specially protected under data protection law — for example health or family detail visible on a document you file. We do not ask for it, and where it appears we process it only as part of the evidence you have chosen to include.
4 · Why we use it, and on what basis
Each purpose has its own lawful basis. Where the basis is consent, the choice is genuine, off by default, and reversible without penalty.
- Providing the application workspace, guidance and Final Review
- Performance of our contract with you
- Drafting narratives with Application Intelligence™
- Performance of our contract with you
- Storing the documents you file
- Performance of our contract with you
- Taking payment and issuing receipts
- Performance of our contract, and legal obligation for tax records
- Keeping accounts, tax and financial records
- Legal obligation
- Security, abuse prevention and fraud detection
- Legitimate interests in protecting users and the service
- Diagnosing faults and improving the product
- Legitimate interests, or your consent where analytics technologies are used
- Analytics and marketing measurement
- Consent — off unless you choose it
- Product email and application guidance
- Consent — off unless you choose it
- Responding to your support messages
- Performance of our contract, and legitimate interests
- Recording your privacy choices
- Legal obligation to demonstrate consent
- Responding to a lawful request or defending a claim
- Legal obligation, and legitimate interests
Where we rely on legitimate interests we have considered your rights alongside ours, and you can object at any time using the contact details below.
5 · Application Intelligence™
Application Intelligence™ reads your answers and the documents you file in order to identify what your application still needs and to draft narratives in your own words. Drafting is assisted by Anthropic’s Claude models through the Anthropic commercial API. The model does not receive your credentials, your payment details, or anyone else’s application. A fuller explanation is on How VisaOS uses Application Intelligence™.
6 · Automated processing
VisaOS uses automated processing to work out which requirements apply to you, to check whether a section is complete, and to indicate how ready your application is. These indicators are guidance for you. They are not decisions about you, and they carry no legal effect.
No consular or government decision is made by VisaOS.
VisaOS does not decide, predict or influence whether your visa is approved.
No solely automated decision producing legal effects is made about you.
Nothing is submitted anywhere on your behalf.
7 · Who else is involved
We use a deliberately short list of providers, each acting on our instructions. The full register — including the categories where we have not yet published a provider name — is on Companies that help provide VisaOS.
- Authentication providers
- Signing in and keeping your session secure.
- Database and file-storage providers
- Holding your application and the documents you file.
- Hosting providers
- Running the service itself.
- Anthropic
- Claude models via the Anthropic commercial API — drafting narratives and identifying gaps.
- Stripe
- Taking payment at Export.
- PayPal
- An alternative payment method at Export.
- Email and support providers
- Sending service email and handling your messages to us.
We do not sell your personal information and we do not share it with advertising networks. We may disclose information where we are legally required to, and will tell you unless we are prohibited from doing so.
8 · International processing
Some of the providers we rely on process information outside the European Economic Area. Where that happens, a transfer mechanism recognised under EU data protection law is required. We have not yet published the specific mechanism in force for each provider, and we would rather name it here once it is confirmed against the signed agreement than assert that transfers are simply “safe”.
9 · How long we keep it
This is our retention schedule. Any change to it is reflected in the version and the dates at the top of this page.
- Active account and application data
- Retained while the account and application remain active.
- Inactive applications and uploaded evidence
- Automatically deleted after 12 months without activity, following advance warning.
- User-requested deletion
- Removed from active systems within 30 days.
- Backups
- Residual encrypted copies expire within 90 days.
- Generated application-pack files
- No longer than 30 days, where server-side retention is technically necessary.
- Support correspondence
- 24 months after the enquiry is closed.
- Security and fraud-prevention logs
- 12 months, unless needed for an incident or legal obligation.
- Marketing preferences and consent evidence
- Until withdrawal, plus up to 3 years to demonstrate the recorded choice.
- Terms and policy acceptance records
- 3 years following account closure, unless a dispute requires longer.
- Payment, tax and accounting records
- 7 years following the end of the relevant financial year.
10 · Your rights
Depending on where you live, you have the right to:
- Access — obtain a copy of the information we hold about you.
- Correction — have inaccurate information corrected.
- Deletion — have your information erased, subject to records we must keep by law.
- Restriction — ask us to limit how we use your information while a question is resolved.
- Objection — object to processing based on our legitimate interests.
- Portability — receive your information in a portable, machine-readable form.
- Withdrawal of consent — turn off anything you previously consented to, at any time, without penalty.
To exercise any of these, write to privacy@visa-os.com. We may need to confirm your identity before acting. Your cookie and marketing choices you can change yourself, at any time, in the Privacy Centre — which also sets out exactly what a copy, a deletion or an account closure covers before you ask for one.
11 · Complaints
If you are unhappy with how we have handled your information, please tell us first — we would rather fix it. You also have the right to complain to the data protection supervisory authority in your own country of residence, and you may do so without contacting us first.
No EU or UK representative is currently appointed.
12 · Children
VisaOS is for people aged 18 or over, and we do not knowingly create accounts for children. An adult may of course prepare an application that includes information about a child travelling with them.
13 · Changes to this notice
When this notice changes we update the version number and dates at the top of the page. If a change materially affects you we will tell you directly, and where the law requires it we will ask for your consent again rather than assume it.
14 · Contact
Privacy: privacy@visa-os.com
Support: help@visa-os.com
Operator and controller: VisaOS™ OÜ. See Legal information.