Last updated 16 August 2026
Privacy policy
VisaLens reads the documents behind a visa application and tells you what does not add up in them. That means we handle some of the most sensitive paperwork you own: your passport, your bank statements, your employment history. This page says exactly what happens to it.
Not yet complete. This policy describes the system as it is actually built, but the operating company’s legal name, registered address, data controller identity, supervisory authority and (where required) EU/UK representative still need to be named below, and it should be reviewed by a qualified data protection lawyer before launch.
What we collect
Account information
Your email address, your name, and a password hash held by our authentication provider. We never see or store your password in a readable form. If you sign in with Google we receive your email address and name from them, and no password at all.
Application information
The destination, visa category and origin country you enter, plus the profile details you choose to fill in: travel history, employment, finances, family ties and any previous refusals. You control how much of this you provide. Fields you leave blank are simply absent.
If you record what happened to an application, that outcome is stored as your own report. VisaLens does not submit applications and does not receive decisions from any authority.
Documents, and the text inside them
Files you upload, and the text extracted from them. Extraction happens once, at upload, so that the assistant can answer against what your documents actually say rather than guessing. Extracted text is stored alongside the file and is deleted with it.
Voice, if you use the spoken interview
The text mock interview involves no audio. If you choose the spoken interview, your microphone audio is streamed to our voice provider so the practice officer can hear and answer you, and a recording of the call may be stored so you can play it back afterwards. You do not have to use the spoken mode; the text mode exercises the same questions.
A record of what the assistant told you
For every AI output shown to you we keep a short compliance record: which part of the product produced it, which model, which version of our policy was in force, and whether our advice filter blocked or rewrote anything. This exists so that we can show, after the fact, that the service stayed inside the boundary described in our terms. It does not store the text of the output, only the phrase our filter objected to, where there was one.
Usage
Which features you use and how often, recorded against your account so we can enforce the limits on your purchase and stop abuse. We do not run third-party analytics or advertising trackers. See the cookie policy.
Sensitive and special category data
A visa file often contains information that data protection law treats as special category: a TB certificate or medical report is health data, a spouse or dependant application reveals family life, and a religious worker route reveals religious belief. We do not ask for any of it directly. It arrives because you have uploaded a document that contains it, and where it does, our lawful basis is your explicit consent, given by choosing to upload that document for analysis. You can withdraw it by deleting the document, which removes the file and its extracted text.
Do not upload a document belonging to someone who has not asked you to prepare their application.
Why we are allowed to process it
- To provide the service you bought (performance of a contract): your account, applications, documents, analysis, drafts and interviews.
- Your explicit consent: special category data inside the documents you choose to upload, and voice audio if you use the spoken interview.
- Our legitimate interests: keeping the service secure, enforcing purchase limits, preventing abuse, and keeping the compliance record described above. We consider these proportionate because each is narrow and none of them profiles you or advertises to you.
- Legal obligation: keeping billing records for as long as tax law requires.
Where it goes
| Processor | What it receives | Why |
|---|---|---|
| Supabase | Account data, application data, uploaded files | Database, authentication and file storage |
| OpenAI | Document text and the details of the application it belongs to | Document analysis, drafting and assistant replies |
| Vapi | Your microphone audio and the application context for the interview, only if you use the spoken mode | Running and recording the spoken mock interview |
| Stripe | Email address and the billing details you enter with them | Card payments |
| Paystack | Email address and the billing details you enter with them | Card payments in supported regions |
Card numbers never reach our servers. They are entered on the payment provider’s own hosted checkout and we receive only a customer reference and whether the payment succeeded.
Some of these providers are based outside the UK and the EEA, so your data is transferred internationally. Those transfers rely on the provider’s standard contractual clauses or an equivalent approved mechanism, recorded in our processor agreement with each of them.
Who can see your files
Storage buckets are private. Every file lives under a path keyed to your user id, and row-level security in the database rejects any query for a row you do not own, including queries made by our own application code with the wrong session attached. Download links are signed and short-lived.
How long we keep it
- Documents and extracted text stay until you delete the document or the application it belongs to. Deletion removes the stored file and the extracted text together. Access to an application ending does not delete anything.
- Account data stays until you ask us to close your account.
- Voice recordings are held by our voice provider for playback and are removed when you delete the interview or your account.
- The compliance record is kept for two years, because its whole purpose is to answer a question asked after the fact. It is keyed to your account and deleted with it.
- Billing records are retained by the payment provider for as long as tax law requires, independently of your VisaLens account.
Your rights
If you are in the UK, the EEA or another jurisdiction with equivalent law, you can ask for a copy of your data, ask for it to be corrected, ask for it to be erased, ask us to restrict or stop processing it, ask for it in a portable form, or withdraw consent you previously gave.
Individual documents and whole applications can be deleted from inside the product at any time. For a full account deletion or a copy of everything we hold, write to privacy@visalens.app and we will action it within one month. Self-service export and account deletion are not built yet; until they are, the email route is the way to exercise those rights, and we will not charge you for it or ask you why.
You also have the right to complain to your data protection supervisory authority. The relevant authority will be named here once the operating entity is registered.
What we do not do
- We do not sell your data.
- We do not share your documents with immigration authorities, employers or universities.
- We do not use your documents to train models. Content sent for analysis is processed to produce your result and is governed by our processor agreement with the provider.
- We do not publish or aggregate outcome data. If you record what happened to your application, that record is yours and is not turned into a public statistic.
- We do not run advertising or profile you for marketing.
Automated processing
The analysis, scoring and drafting in VisaLens are automated. None of it produces a decision with a legal effect on you: no visa is granted or refused here, and no eligibility ruling is made. The readiness score measures how complete and internally consistent your document set is against published requirements. Every finding can be read, checked against the source we link, and disregarded.
Not legal advice
VisaLens is a document preparation and self-check tool. It is not a law firm and not a regulated immigration adviser, it does not provide immigration advice, and it does not guarantee any decision. See the terms of service for what the service will and will not do.
Contact
Data protection questions: privacy@visalens.app. Everything else: hello@visalens.app.