Privacy Policy

This Privacy Policy explains how visaworker.ai ("we", "us") collects, uses, and protects information when you use our software (the "Service"). We built the Service for people preparing immigration petitions, which means we handle sensitive personal information — we take that responsibility seriously.

1. Information we collect

Information you provide

• Account information — email address, display name, and authentication credentials.
• Case content — the biographical, professional, and evidentiary information you enter or upload for your petition, along with drafts and exhibits the Service produces on your behalf.
• Communications — messages you send us for support or feedback.

Information collected automatically

• Usage data — pages visited, features used, and approximate token consumption per case.
• Device and log data — IP address, browser type, operating system, timestamps, and error logs.
• Cookies — a small number of strictly necessary cookies used to keep you signed in and to route your session.

Payment information

Payments are processed by Stripe. We do not receive or store your full card number, CVC, or bank credentials. We do receive limited transaction metadata (amount, currency, last four digits, status) to reconcile your account.

2. How we use information

• To operate the Service, including drafting and compiling your petition.
• To authenticate you and secure your account.
• To process payments and manage token budgets.
• To communicate with you about the Service (transactional messages).
• To detect, prevent, and respond to fraud, abuse, or security incidents.
• To comply with legal obligations.

We do not sell your personal information. We do not use your case content to train third-party AI models.

3. How we share information

We share information only with the categories of recipients below:

• Infrastructure providers — cloud hosting, managed database (with row-level security), and object storage used to run the Service.
• AI model providers — the content you send to the agent (prompts and relevant case content) is transmitted to the underlying model provider(s) solely to generate your response. These providers are contractually restricted from using your content to train their models.
• Stripe — for processing payments.
• Legal and safety — when required by law, valid legal process, or to protect the rights, safety, or property of users or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to the receiving party honoring this Policy.

4. Security

Security is a first-class concern for us. In particular:

• Case data is scoped per account with database-level row-level security, so one user cannot query another user's rows.
• Traffic is encrypted in transit using TLS.
• Secrets and API keys are stored in an isolated secrets vault, separate from application source code.
• Access to production systems is restricted and audited.
• Payment card data is handled entirely by Stripe.

No system is perfectly secure. If you believe you have found a vulnerability, please email security@visaworker.ai.

5. Data retention

We retain your account and case content for as long as your account is active. If you delete a case, it is removed from the active Service and purged from routine backups within a rolling window. If you delete your account, we remove your case content within thirty (30) days, except where we are required to retain limited records (for example, payment records for tax and audit purposes).

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to lodge a complaint with a data protection authority. To exercise these rights, email privacy@visaworker.ai from the address associated with your account. We will respond within the time required by applicable law.

7. International users

The Service is operated from and hosted in the United States. If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States and other countries where our providers operate.

8. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by updating the "Last updated" date above and, when appropriate, by in-app notice.

10. Contact

Privacy questions or requests? privacy@visaworker.ai.