Privacy Policy

This Privacy Policy describes the categories of personal data we collect, how and why we use it, who we share it with, how long we keep it, how we protect it, and the rights available to you. It applies to personal data processed through the Services and through our interactions with you.

We are committed to handling personal data in accordance with applicable data protection laws, which, depending on your location and the nature of the processing, may include:

• The Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws in Canada;
• The EU General Data Protection Regulation (GDPR) and the UK GDPR and Data Protection Act 2018 in the European Economic Area and the United Kingdom;
• The Protection of Personal Information Act (POPIA) in South Africa; and
• The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable U.S. state privacy laws in the United States.

Where this Policy refers to a legal right or obligation, that reference applies to the extent the relevant law applies to you and to the processing in question.

For convenience, the following terms have the meanings below. Where a defined term in an applicable law differs, that statutory meaning applies for the purposes of that law.

Personal data (or personal information):

Any information relating to an identified or identifiable individual.

Special category data (or special / sensitive personal information):

Personal data revealing or concerning biometric identifiers, health, racial or ethnic origin, religious or philosophical beliefs, or data relating to criminal matters, and financial account information, where treated as sensitive under applicable law.

Controller:

The party that determines the purposes and means of processing.

Processor (or service provider):

The party that processes personal data on behalf of, and under the instructions of, a controller.

Data subject:

The individual to whom personal data relates.

Processing:

Any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.

For processing described in this Policy (other than processing we carry out on behalf of a business client), the controller responsible for your personal data is Intellivisa Corp. if you are located in the United States, and Nuron.AI Corp. if you are located outside the United States.

The categories of personal data we collect depend on how you use the Services. Because the Services support travel visa documentation and compliance, some of the data we process is necessarily detailed and, in certain cases, sensitive.

• Identity and travel document data — Full name, date and place of birth, nationality, gender, passport and other travel or identity document numbers, issue and expiry dates, and document images.
• Contact data — Postal address, email address, and telephone number.
• Visa application data — Purpose and details of travel, travel history, itinerary, accommodation details, employment or study information, invitation or sponsorship details, and other information required by a destination authority.
• Special category data — Where a destination authority's requirements make it necessary: biometric photographs, health information, criminal record declarations, information that may reveal religion or ethnic origin, and financial information such as bank statements. Processed only where permitted by law and, where required, on the basis of your explicit consent.
• Uploaded documents and supporting materials — Scans or images of passports, photographs, financial documents, and other supporting documentation.
• Account and authentication data — Username, password and other credentials, and account settings.
• Business and professional contact data — Name, role, organisation, and work contact details (for users acting on behalf of an organisation).
• Payment data — Billing details and transaction records (payment card details are processed by our payment providers and not stored by us).
• Technical and usage data — IP address, device and browser information, log data, and information about how you interact with the Services.
• Communications data — Content of, and metadata relating to, your communications with us, including support enquiries.

• Directly from you — When you create an account, submit an application or documents, communicate with us, or otherwise use the Services.
• From our business clients — Where a travel agency, online travel agency, global distribution system, university, visa processor, or similar client provides data to us so that we can deliver the Services on their behalf.
• Automatically — Through cookies and similar technologies when you use our website and applications.
• From third parties — Such as government and consular systems, official visa application centres, and identity or document verification providers.

We use personal data for the purposes set out below. Where the GDPR, UK GDPR, or a comparable law applies, we rely on the lawful bases indicated.

The Services use software, including machine learning and automated techniques, to help prepare, organise, classify, and check travel documentation, to identify applicable requirements, and to facilitate the submission of applications. The Services are not used to adjudicate applications.

We share personal data only as necessary to provide the Services. We do not sell personal data.

• Business clients — Where we process personal data on behalf of a travel agency, university, or similar client, we disclose data to and as directed by that client.
• Government and consular authorities — Including government visa portals and authorised application centres. Transfer to destination-country authorities is inherent to the visa process.
• Travel-technology and distribution partners — Including global distribution systems and platforms through which the Services are made available.
• Service providers and sub-processors — Cloud hosting, identity and document verification, communications, and analytics providers, under appropriate contractual safeguards.
• Payment providers — To process payments.
• Professional advisers — Auditors, lawyers, and insurers where necessary.
• Acquirers and successors — In connection with a merger, acquisition, or sale of assets, subject to confidentiality protections.
• Authorities and other parties — Where necessary to comply with law, respond to lawful requests, or protect the rights and safety of Intellivisa, our users, or others.

Because visa processing is inherently cross-border, personal data will be transferred to and processed in countries other than the one in which it was collected — including the destination country of an application and the countries in which we and our service providers operate. Where applicable law requires it, we rely on a lawful transfer mechanism, such as an adequacy decision, standard contractual clauses, or another mechanism permitted under applicable law. You may contact us for further information about the safeguards we apply. Transfers to government and consular authorities as part of the visa process are made because they are necessary to deliver the requested service.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected — including providing the Services, complying with legal, tax, accounting, and regulatory obligations, resolving disputes, and enforcing our agreements. When personal data is no longer required, we delete it or anonymise it. Criteria used to determine retention periods include the nature and sensitivity of the data, the purposes of processing, applicable legal and regulatory requirements, and the existence or likelihood of disputes. Where we process personal data on behalf of a business client, we retain and delete that data in accordance with our agreement with, and the instructions of, that client.

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss, or destruction. These measures include:

• Encryption of data in transit and at rest where appropriate
• Access controls and authentication
• Network and application security controls
• Staff confidentiality obligations

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. Where required by applicable law to notify you or a regulator of a personal data breach, we will do so without undue delay.

Subject to applicable law, you may have the following rights in relation to your personal data:

To exercise a right, contact us using the details in Section 3. We may need to verify your identity before responding and will respond within the timeframe required by applicable law.

Our website uses cookies and similar technologies to operate the site, remember your preferences, measure performance, and improve the Services. These fall into broad categories:

• Strictly necessary — Required for the site to function.
• Functional — Remember your choices and preferences.
• Performance and analytics — Help us understand how the site is used.

Where required by law, we obtain your consent before placing non-essential cookies. You can manage your preferences through our cookie controls or your browser settings. Disabling certain cookies may affect the functionality of the site.

The Services may contain links to, or interoperate with, third-party websites and services, including government portals and application centres. We are not responsible for the privacy practices or content of those third parties, and we encourage you to review their privacy notices.

The Services are intended for use by adults and by organisations and their authorised representatives. The Services are not directed to children for self-registration, and we do not knowingly collect personal data directly from children for that purpose.

We recognise that visa applications may involve minors — for example, in family applications or in connection with study by individuals under the age of majority. Where personal data relating to a minor is processed, it is provided by and processed in the context of an application managed by a responsible adult, parent or guardian, or an authorised business client, who is responsible for providing any required notices and obtaining any required consents. We apply additional care to personal data relating to minors in accordance with applicable law. If you believe a child's personal data has been provided to us other than as described, please contact us.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on the Services and, where required by law, provide additional notice. The version of this Policy that applies is the one posted on the Services at the time you access them. Your continued use of the Services after an update takes effect constitutes acceptance of the revised Policy to the extent permitted by law.

For any privacy enquiry, to exercise a right, or to make a complaint, please contact our Data Protection Officer, Srijan Magon, at operations@intellivisa.ai, or write to us at the correspondence address in Section 3. If you are not satisfied with our response, you may contact the relevant supervisory authority identified in Section 12.