Legal · Visafy
What personal information we collect, why we need it, and how we protect it.
Effective date: 21 July 2026Last updated: 21 July 2026Applies to: Visafy and all Visafy services
In plain language
We collect only what the government's application form requires — your details, passport information and documents. We share them with the destination government to file your application and with our payment provider to take payment. We never sell your information.
This summary is here to help. The complete text below is the governing document.
Visafy is the data controller for the personal information described in this policy. The operating company's registration details will be published here when its registration completes; until then you can request them through the contact form.
For privacy questions or requests, use the contact form and choose "Legal and privacy enquiries".
Your application answers (name, date of birth, contact details, passport details, travel dates), the documents you upload (such as your passport photo page and a passport-style photo), and basic payment confirmation from our payment provider.
We also keep an internal record of what happened to your application and when — who reviewed it, when it was filed, when the decision arrived — because a careful audit trail is part of handling your application responsibly.
We do not store your full card number.
To prepare, check and file your application — this is the entire purpose of the service, and the legal basis is performing our contract with you. To contact you about your application — also part of the contract. To meet legal obligations that apply to us, such as accounting rules — a legal obligation. To keep the service secure and prevent fraud — our legitimate interest in running an honest service.
We do not use your information for marketing unless you have asked us to, and we never make automated decisions about you: the eligibility checker only displays the government's published rules, and every application is reviewed by a human specialist.
The destination government (that is what filing means), our payment provider, and the Visafy specialists checking your file.
No one else. We do not sell or rent personal information, and we do not share it for advertising.
Key point
Your information is used to file your application — never sold, never used for advertising.
Like almost every online service, we run on carefully chosen infrastructure providers who process data on our behalf under contract: our database and encrypted document storage (Supabase, hosted in Singapore), our website hosting (Vercel), and our application-processing servers (Railway).
When online payment and email notifications are switched on, the payment provider and email-delivery provider will be added to this list before they handle any customer data.
These providers store and transmit data for us; they do not use it for their own purposes.
Your application data and documents are stored in Singapore. Depending on where you are, using the service therefore involves an international transfer of your data. Our infrastructure providers commit to recognised transfer safeguards, including standard contractual clauses, in their data-processing agreements.
Filing your application transfers the data the government's form requires to the destination government — that transfer is the service you are asking us to perform.
Draft applications that are started but never paid for are deleted after 30 days.
We keep your application record while it is active and for as long as we are legally required to afterwards.
When we can state exact retention periods per record type, we will publish them here.
You can ask us to delete your information; we will do so unless a legal obligation requires us to keep it.
Your information is encrypted in transit and at rest. Access is limited to the specialists working on your application. Documents are read only through an audited channel — every access is logged with who and why.
Uploaded documents are scanned for malware, and uploaded photos are re-encoded so that hidden metadata (such as the GPS location a phone embeds in a photo) never reaches storage.
Please use the secure upload inside your application for documents — not email.
Our promise
Passport data is the most sensitive thing we hold, and we treat it that way — encrypted, access-logged, and never shared beyond the issuing authority.
You can ask to see the information we hold about you, correct it, receive a copy of it, restrict or object to how we use it, or have it deleted. Where our use is based on consent, you can withdraw that consent at any time.
To exercise any of these rights, use the contact form and choose "Legal and privacy enquiries" so your message reaches the right people. We respond to every request and we do not charge for them.
You also have the right to complain to a data-protection authority — either the one in your country of residence or the one supervising us, which will be named here alongside the company registration details.
Applications for children are made by a parent or guardian through their own account. We collect a child's details only as part of such an application, and only what the government's form requires.
If we change what we collect or how we use it, we update this page and its effective date. We will not quietly broaden how your information is used.
Use our contact form and choose “Legal and privacy enquiries” so your message reaches the right people.
Please don’t send passport photos, card details or other sensitive documents by email — use the secure upload inside your application.
Related:Terms of ServiceCookie PolicyRefund PolicyDisclaimer