Privacy Policy

What Visakit is

Visakit prepares tourist visa application packs: a free eligibility pre-check, a document checklist for your route, a completed form-data pack, and an automated review of your documents. We handle identity and financial documents, so this policy names exactly what we collect, how it is protected, and when it is deleted.

The free pre-check stores no personal data

Your pre-check answers are processed to produce your result and are not stored. We keep only an anonymous counter — the route checked and the outcome (for example, how many checks a route receives) — with no answers, no name, and no contact details attached. If you ask us to add a route we do not cover yet, we store the email address and the route you submit so we can tell you if it opens.

Accounts and applications

An account needs an email address and a password, which is stored as a salted cryptographic hash — never in plain text. A session cookie keeps you signed in; it is essential to the service. In your application you enter the details your visa form requires and upload the documents your route's checklist asks for: passport and identity pages, bank statements, employment letters, photographs, travel bookings, and similar evidence.

How your documents are held

• Encrypted before storage. Every file is encrypted with AES-256-GCM envelope encryption before it is stored — a unique key per file, wrapped by a master key — so our storage only ever holds ciphertext.
• Automated review. Your documents are processed by our automated review to prepare and check your pack; a human operator accesses them only if the review flags your file for a second look.
• Automatic deletion. Your documents are deleted automatically 90 days after your pack is delivered. If a pack is never delivered, documents are deleted no later than 180 days after upload.
• Delete anytime. You can delete any single document, or your whole account, at any time inside the app — deletion removes the stored ciphertext and its record. You can also request deletion by email or via our data-deletion page.

We keep a record of each purchase — amount, price tier, and dates — for our accounts. That record does not include your documents.

Payments — Stripe

Payments are processed by Stripe, Inc. Your card details are entered on Stripe's checkout and never touch our servers. We receive the payment confirmation and the identifiers needed to run your order.

Who else is involved

Cloudflare hosts this site and stores the encrypted document vault. We do not sell personal information, and we share data only with the processors named in this policy, only as needed to run the service.

Cookies and measurement

We use Google Tag Manager to load and manage measurement tags on this site. Non-essential tags load only after you accept in the cookie banner; if you reject, they stay off. No advertising pixel is embedded in Visakit. On marketing pages such as our iVisa comparison (never inside the app), accepting also loads Travelpayouts Drive, which turns mentions of travel brands into affiliate links and counts the clicks; it stays off if you reject. Our own service analytics are the anonymous counters described above.

Email

If you join the launch list or request a route, we email you about that — launch news and route openings. Marketing emails carry a one-click unsubscribe, honoured promptly. Order and delivery emails are transactional and identify us as the sender.

Your rights, and who Visakit is for

You can access, correct, or delete your data in the app at any time, or by writing to [email protected]. Visakit is a service for adults (18+); we do not knowingly collect data from children. We are a document-preparation service — not a government body, not a consulate, and not a law firm — and this policy covers only Visakit's own handling of your data.

Changes

If this policy changes, the new version is posted on this page with its effective date. Material changes to how documents are held will be announced on the site before they take effect.