Privacy Notice

1. Who is responsible for your data

Visa Manager is the data controller responsible for your personal data. For any privacy-related request, contact us at support@visamanager.io.

2. What we collect

• Account data — email address and a securely hashed password.
• Identity & application data — name, date of birth, nationality, passport details, travel plans, accommodation, employment and financial information.
• Sensitive documents — passport and ID copies, photographs, bank statements and supporting evidence you upload.
• Communication data — support tickets, chat messages, emails.
• Technical data — sign-in/session data and, only with your consent, product-analytics usage data.

3. Why we can process it (lawful bases)

• Explicit consent (special-category data) — for the sensitive documents you upload (passport, ID, photos), under GDPR Art. 9(2)(a) and the Thai PDPA. You give this at the upload step and can withdraw it any time.
• Performance of a contract — to provide the visa checking and preparation service you request.
• Consent — for optional analytics cookies and any marketing emails.
• Legitimate interests — security, fraud prevention and improving the service.
• Legal obligation — where law requires us to retain or disclose data.

4. Where your data is stored & how it's protected

Your data is stored in Singapore(Supabase, running on Amazon Web Services, ap-southeast-1), encrypted at rest and in transit (TLS). Uploaded documents live in private storage and are reachable only through short-lived signed links. Row-Level Security isolates every account's and every organisation's data, and access by our staff or a partner's staff is restricted to their own organisation.

5. Who we share it with (sub-processors)

We do not sell your data. We share it only with the providers needed to run the service, each under a data processing agreement:

• Supabase / Amazon Web Services (Singapore) — database, authentication and document storage.
• OpenAI and Google (Gemini API) — AI checks of your documents and application. Used on paid/zero-retention terms, so your data is not used to train their models.
• Anthropic — the in-app assistant and partner tooling.
• Stripe — payment processing (we never see or store your card number).
• Resend — transactional email (confirmations, reminders).
• PostHog (EU) — optional product analytics, only if you accept analytics cookies.
• Licensed visa Service Partners in Thailand — only when you buy Agent Review or Full Service, and only the data needed to process your application.

6. International transfers

Your data is held in Singapore. Some processors above operate in the United States or elsewhere, and a paid application is shared with Service Partners in Thailand. These transfers are covered by appropriate safeguards — Standard Contractual Clauses or equivalent data processing terms — so your data keeps an adequate level of protection.

7. AI assistance

We use AI to help check your application and flag missing or unclear documents. The AI assists — it does not decide your outcome; a human visa specialist reviews the results on paid review tiers. Documents are sent to the AI providers named above under zero-/limited-retention terms and are not used to train their models.

8. Cookies

Essential cookies (always on, no consent needed): your sign-in session, the partner-site selection (active_org), and your interface preferences.

Optional analytics cookies(PostHog): set only if you accept them in the cookie banner. We don't use advertising or cross-site tracking cookies. You can change your choice any time in Settings → Privacy & your data.

9. How long we keep it

We keep your account and application data while your account is active and for as long as needed to provide the service and meet legal obligations. If you delete your account, all associated data — including uploaded documents — is permanently removed within 30 days (a short grace period applies if an application is mid-processing). You can delete your documents or account sooner from Settings.

10. Your rights

Under the GDPR and the Thai PDPA you have the right to: access a copy of your data; receive it in a portable format; correct it; have it erased; restrict or object to processing; and withdraw consent (including the sensitive-data consent) at any time. Withdrawing the sensitive-data consent means we can no longer process or prepare your application.

Exercise most of these yourself from Settings → Privacy & your data (export, withdraw consent, delete account), or contact support@visamanager.io. We respond within 30 days. You may also complain to your local data protection authority — in Thailand, the PDPC.

11. Data breaches

If a breach is likely to put your rights at risk, we notify the relevant authority — in Thailand, the PDPC under section 37(4) — without undue delay and, where feasible, within 72 hours, and we notify affected users where required.

12. Children & changes

The service is for adults (18+); we don't knowingly collect children's data. We may update this notice; for material changes we notify registered users by email and update the date above.