Last updated: August 17, 2026
This page provides the detailed, technical data-processing disclosures required under GDPR (and similar frameworks) that complement our general Privacy Policy. Where this page and the Privacy Policy differ in detail, this page controls for GDPR-specific questions.
Controller: Universal Reason Inc., 75 E 3rd St, Sheridan, WY 82801 — info (at) visabook (dot) co.
| Processing activity | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account creation & authentication | Provide account access | Performance of contract |
| Profile data (age, nationality, citizenship, residency, income, work type) | Personalize visa search, checklists, and Case generation | Performance of contract |
| Document storage & classification | Enable document vault, checklist matching, Document Validation | Performance of contract |
| AI Consultant / Document Validation processing | Provide grounded, cited guidance and compliance checks | Performance of contract; consent for cross-border AI processing where required |
| Payment & subscription management | Bill for the Plus plan | Performance of contract |
| Renewal/deadline reminders | Notify you of upcoming deadlines | Performance of contract; legitimate interest |
| First-party analytics (cookie-free) | Measure page views, navigations, time on site, bounce, origin | Legitimate interest |
| Product analytics (search queries, usage) | Improve the Service, understand demand | Consent |
| Affiliate referral attribution (cookie) | Track and pay referral commissions correctly | Legitimate interest / consent, per applicable cookie law |
| Fraud prevention & security monitoring | Protect the Service and its users | Legitimate interest; legal obligation where applicable |
Where a specific processing activity involves data that may be treated as a special category under GDPR Article 9 (e.g., data that could reveal racial or ethnic origin, or biometric data derived from an identity document used for verification purposes), we obtain your explicit consent before that specific processing, separately from general account creation.
| Sub-processor | Purpose | Data involved | Location / transfer mechanism |
|---|---|---|---|
| Amazon Web Services (Bedrock) | AI processing (Claude) for AI Consultant and Document Validation | Profile, Documents, Chat content submitted | US / EU regions available; Standard Contractual Clauses apply for EEA data where processed outside the EEA; EU Inference Profile used where hard EU data residency is required |
| Cloudflare, Inc. | Application hosting, database (D1), content delivery, Workers/Workflows execution | All Service data | Global network; Standard Contractual Clauses apply for cross-border transfer |
| PostHog, Inc. | Product analytics | Pseudonymous page views, clicks, feature usage, session identifiers; account ID and email for signed-in users | EU Cloud; PostHog’s applicable data-processing and standard contractual safeguards apply |
| Stripe, Inc. | Payment processing, subscription billing | Billing contact info, subscription status; card data handled entirely within Stripe, never received by VisaBook | US / global; Stripe’s own certified transfer mechanisms apply |
This list is reviewed and updated as our infrastructure changes. We will provide notice of the addition of a new sub-processor with access to personal data with a reasonable opportunity to object, where required by applicable law or contract.
VisaBook is a US company (Wyoming), and our infrastructure providers operate globally. For users in the EEA, UK, or other jurisdictions with cross-border transfer restrictions, we rely on:
| Data category | Retention approach |
|---|---|
| Account & Profile | Retained while account is active; deleted or anonymized within [X days] of account deletion request |
| Documents (classified, linked to a Case) | Retained while account is active, subject to your deletion requests; case-outcome-driven retention may apply for closed Cases per our internal policy |
| Documents (unclassified, unlinked to any Case) | Shorter default retention window (e.g., 30-90 days) before automatic review/deletion, given the lower likelihood these are still needed |
| Payment/billing records | Retained per Stripe’s own retention practices and applicable financial record-keeping law |
| Consent records | Retained for as long as necessary to demonstrate compliance, even after the underlying data is deleted |
Under GDPR Articles 15-22, you have the right to: access; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; object to processing based on legitimate interest; and not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. VisaBook’s Document Validation and AI Consultant features are advisory and informational — no automated decision with legal or similarly significant effect is made by VisaBook without your own subsequent action (e.g., you choose whether and how to use the information in your own application).
To exercise any right, email info (at) visabook (dot) co. We will respond within one month, as required under GDPR (extendable by two further months for complex requests, with notice).
You also have the right to lodge a complaint with your local supervisory authority.
Given the nature of the data processed (nationality, immigration status, and related documents), we maintain an internal DPIA for the Service’s core processing activities and review it when introducing significant new features (e.g., a future Agency Marketplace, when built, will receive its own DPIA before launch given the additional third-party data-sharing involved).
Where a processing activity requires your explicit consent, we log the specific purpose consented to, the timestamp, and (where applicable) the destination/recipient disclosed to you at the time — so you (and we) always have a clear record of what was agreed to and when. You may withdraw consent at any time via your account settings or by contacting us, without affecting the lawfulness of processing before withdrawal.
Universal Reason Inc. 75 E 3rd St, Sheridan, WY 82801 info (at) visabook (dot) co
This page is a technical compliance disclosure and should be read alongside our Privacy Policy and Terms of Use.