1. Information We Collect

When you use VisaCanvas, we collect:

• Account information: email address and name from your Google account or email sign-in.
• User-provided content: CVs, publication lists, recommender information, career history, and other materials you upload or enter for assessment and document preparation.
• Usage data: pages visited, features used, session duration, and browser/device information collected via Vercel Analytics.
• Payment information: processed by Stripe; we do not store your credit card details on our servers.

2. How We Use Your Information

We use your information to:

• Provide the Service: generate assessments, draft documents, and prepare petition materials.
• Maintain your account and case history.
• Process payments for paid features.
• Improve the Service through aggregated, anonymized usage analytics.
• Communicate with you about your account or the Service (no marketing emails).

3. AI Processing

Your content is sent to third-party AI providers (currently Anthropic Claude) for processing. This is necessary to generate assessments and draft documents. We do not use your data to train, fine-tune, or improve any AI models. AI provider processing is subject to their respective data handling policies, and we select providers that offer zero data retention for API usage.

4. Data Storage and Security

Your data is stored in Supabase (hosted on AWS) with encryption at rest and in transit. We implement industry-standard security measures including:

• TLS encryption for all data in transit.
• Encryption at rest for stored data.
• Row-level security policies in our database.
• Authentication via Supabase Auth with OAuth 2.0.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure.

5. Data Sharing

We do not sell your personal information. We share data only with:

• AI providers (Anthropic) for generating assessments and documents — under API terms with no data retention.
• Stripe for payment processing.
• Supabase for database and authentication hosting.
• Vercel for application hosting and analytics.
• Legal authorities if required by law, court order, or government request.

6. Data Retention

We retain your account data and generated materials for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Upon account deletion, we will remove your data within 30 days, except where retention is required by law.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your data.
• Export your data in a portable format.
• Withdraw consent for data processing.

To exercise these rights, contact us at privacy@visacanvas.com.

8. Cookies and Analytics

We use Vercel Analytics for basic usage metrics. We do not use third-party advertising trackers or sell data to advertisers. Essential cookies are used for authentication session management.

9. Children's Privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal information from children.

10. International Data Transfers

Your data may be processed in the United States. By using the Service, you consent to the transfer of your data to the United States and acknowledge that data protection laws may differ from your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised “Last updated” date.

12. Contact

For privacy-related questions, contact us at privacy@visacanvas.com.