Privacy Policy

VisaFlow ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website and services (the "Service"). We aim to comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.

1. Who we are

VisaFlow operates an online platform that helps users prepare for Canadian study permit, work permit, and permanent residence applications. For privacy inquiries, contact us using the methods available in the Service.

2. Information we collect

Account and profile information

• Name and email address when you register.
• Password (stored only as a secure one-way hash; we cannot read your password).
• Onboarding and profile details you provide, such as pathway, country of residence, location (inside/outside Canada), dependants, timeline dates, and study program information where applicable.

Usage and application data

• Checklist progress, notes, funds tracking, and similar in-app state.
• Plan selection (Free, Plus, Expert).
• Content you submit for letter or SOP review, and scores or feedback generated.
• Messages sent through Ask an expert or consultant features.

Technical information

• Browser type, device information, IP address, and logs needed for security, debugging, and performance.
• Session identifiers stored locally in your browser to keep you signed in.

Payment information

When billing is enabled, payment card details are processed by our payment provider. We do not store full card numbers on our servers.

3. How we use your information

We use personal information to:

• Create and manage your account and authenticate you.
• Personalize checklists, dashboards, and processing-time views.
• Provide AI-assisted document feedback and expert messaging.
• Process subscriptions and communicate about your account or plan.
• Improve the Service, fix errors, and protect against fraud or abuse.
• Comply with legal obligations and enforce our Terms of Service.

4. Legal basis and consent

We collect and use information with your consent where required, and otherwise as necessary to provide the Service you request, for legitimate business interests (such as security and improvement), or to meet legal requirements. You may withdraw consent for optional features by discontinuing use or contacting us, subject to legal or contractual limits.

5. Where we store data

Account and application data are stored in secure cloud databases (including providers such as Neon Postgres). IRCC processing history may be stored separately in server-side databases used for analytics and charts. Data may be processed in Canada, the United States, or other jurisdictions where our providers operate, with safeguards appropriate to the sensitivity of the information.

6. Sharing and disclosure

We do not sell your personal information. We may share information with:

• Service providers who host databases, send email, process payments, or provide AI APIs, under confidentiality obligations.
• Consultants or staff who respond to your expert messages, only as needed to answer your question.
• Authorities if required by law, court order, or to protect rights, safety, or security.
• Successors in the event of a merger, acquisition, or sale of assets, with notice where required by law.

7. Retention

We retain personal information while your account is active and for a reasonable period afterward for backups, legal compliance, and dispute resolution. You may request deletion of your account; we will delete or anonymize data unless we must retain it by law.

8. Security

We use industry-standard measures such as encryption in transit (HTTPS), hashed passwords, and access controls. No method of transmission or storage is 100% secure; you use the Service at your own risk and should protect your login credentials.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion, subject to legal exceptions.
• Withdraw consent for optional processing.
• File a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

To exercise these rights, contact us through the Service. We will respond within a reasonable time as required by law.

10. Cookies and local storage

We use browser local storage to maintain your session and sync preferences. We do not use third-party advertising cookies. Essential technical cookies or similar technologies may be used for security and basic functionality. You can clear local storage via your browser settings, which will sign you out.

11. Children

The Service is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us so we can delete it.

12. Third-party links

The Service links to official IRCC and other government sites. We are not responsible for their privacy practices. Review their policies before providing information to them.

13. International users

If you access the Service from outside Canada, you understand that your information may be transferred to and processed in Canada and other countries with different privacy laws.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated via the Service or email where appropriate.

15. Contact

For privacy questions or requests, reach us through the contact options in the Service or your account dashboard.