Privacy Policy

To compare visa routes and prepare applications, VisaPassage collects the information you choose to provide and a limited amount of technical data:

• Account data — name, email address, a password if you sign up with email, and account type (traveler or agency).
• Profile & travel data — passports, citizenships, residencies, travel history, and other details you add to your profile.
• Documents — files you upload to your document vault, such as passport scans or supporting documents.
• Usage data — device, browser, and interaction data, collected by Vercel's cookie-free analytics and, if you allow it, by Google Analytics (see Cookies & analytics).

You decide how much profile data to provide. Some visa comparisons and checklists become more accurate the more complete your profile is.

We use your data only to operate and improve the service:

• Compare visa options across your passports and residencies.
• Generate document checklists and prepare application packages.
• Send reminders for appointments, document expiry, and rule changes.
• Maintain security, prevent abuse, and meet legal obligations.

We do not sell your personal data. We do not use your documents to train third-party models.

You can create an account and sign in with Google or Apple instead of a password. When you do, we receive only basic profile information from that provider:

• From Google — your name, email address, profile picture, and a unique Google account ID. These come from the standard sign-in permissions (openid, email, and profile).
• From Apple — your name (on first sign-in only), your email address or an Apple private relay address, and a unique Apple account ID.

We use this information only to create and secure your account, sign you in, show your name and picture in the app, and send you emails about your account and the reminders you set up.

We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service, and we cannot post or act on your behalf.

We do not sell Google user data, use it for advertising, or use it to train AI or machine-learning models. It is shared only with Supabase, our authentication and database provider, which stores it on our behalf, or where the law requires it.

Google user data is stored encrypted in our database in the European Union (Ireland) and kept while your account is active. It is deleted when you delete your account in Settings, or within 30 days of a deletion request sent to us by email.

You can also remove VisaPassage's access at any time in your Google Account at myaccount.google.com/permissions.

VisaPassage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share data only in limited, purpose-bound circumstances:

• With fulfillment partners — when you choose an assisted route and explicitly consent at checkout, the profile, documents, and case details needed to handle your application are shared with the licensed partner agency assigned to your case. Until you consent, partner agencies cannot see your personal data. You can withdraw consent at any time.
• With our payment processor — card payments are processed by Revolut. Your card details are entered on Revolut's hosted checkout and handled by Revolut under its own terms and privacy policy; VisaPassage does not receive or store full card numbers. We retain only the order reference, amount, and status needed to fulfill and account for your purchase.
• With processors — infrastructure providers acting on our instructions under contract: Supabase (authentication, database, and file storage in the EU), Vercel (hosting and cookie-free analytics), Google (Google Analytics and Google Tag Manager, with cookies only if you consent; see Cookies & analytics), and Resend (transactional email).
• For legal reasons — where required by applicable law or to protect rights and safety.

We use Google Analytics 4, loaded through Google Tag Manager or as the Google tag, to understand how VisaPassage is used and to improve it. It runs only as far as you allow:

• Strictly necessary — cookies that keep you signed in, protect forms, and remember your language, theme and cookie choice (the vp_consent cookie, kept for 6 months). They are always on.
• Analytics (optional) — Google Analytics cookies (_ga, _ga_*) measure which pages are visited, which features are used (for example a visa check or a new tracker), and your approximate country and device type. We send country codes and categories, never your name, email, documents or anything you type. If you are signed in and allow analytics, we also send a random account ID so that your visits on different devices count once.
• Advertising (optional) — Google advertising cookies measure how our ads perform and may personalise the ads you see. They are off unless you turn them on.

Nothing optional is set until you choose. By default, Google Consent Mode keeps analytics and advertising storage denied. While they are denied, Google tags do not set or read cookies; they may send cookieless pings without identifiers, which Google uses for aggregate modelling. Vercel Web Analytics is cookie-free, does not follow you across sites, and runs regardless of this choice.

You can change or withdraw your choice at any time with Cookie settings at the bottom of every page, or by deleting cookies in your browser.

Google Analytics event data is kept for 14 months and then deleted. Analytics cookies expire after at most 2 years. Your cookie choice expires after 6 months, and then we ask again.

Google Ireland Limited provides Google Analytics and Google Tag Manager to us as a processor under Google's data processing terms. Google may process this data in the United States and other countries. Those transfers rely on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's Standard Contractual Clauses.

You can also opt out of Google Analytics on every website with Google's opt-out browser add-on.

Documents are encrypted at rest and in transit. Access is governed by role-based controls and recorded in audit logs. For more detail on our safeguards, see the Security page.

We retain your data for as long as your account is active or as needed to provide the service. You can delete documents and your account at any time.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can:

• Edit or remove profile data and documents from your account.
• Withdraw consent for document sharing at any time.
• Request account deletion, which removes associated data.

To exercise these rights, contact us at contact@simnetiq.com.

VisaPassage is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. When we do, we change the date at the top of this page. If a change is material and you have an account, we will also email you before it takes effect.

Questions about this policy or your data can be sent to contact@simnetiq.com or via our contact page.