Privacy Policy

This Privacy Policy explains how buildmyvisa ("we", "us") collects, uses, stores, shares, retains and deletes your personal data when you use our website, questionnaires, checklists, document uploads, chat assistant, consultations and related services (the "Services").

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, buildmyvisa is the "Data Fiduciary" and you are the "Data Principal". This policy is also published in line with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

• Identity and contact data: full name, email address, phone number, city.
• Date of birth, nationality and passport details.
• Application data: destination country, visa type, course and admission details, travel plans, travel history, answers to our questionnaires.
• Financial and sponsor data: bank statements, income tax returns, sponsor details, scholarship or loan documents, blocked-account and fee receipts.
• Uploaded documents: passport scans, photographs, academic records, admission and offer letters, medical and police certificates, affidavits, translations and any other file you choose to upload.
• Communications: chat messages with our assistant or agents, emails and consultation notes.
• Technical data: login records, device and browser information, IP address and security logs.

We collect only what is necessary to prepare your visa file. Do not upload documents belonging to another person without their consent.

• To create and secure your account.
• To generate your checklist, red flags and visa readiness score.
• To review your documents (by automated tools and, where you have chosen it, by our in-house experts).
• To run consultations and respond to chat and support requests.
• To process payments and issue invoices.
• To comply with legal obligations and prevent fraud or misuse.
• With your consent, to send you marketing about our services using only your name, email address and contact number. You can opt out at any time via the unsubscribe link or by writing to us.

We never use your documents, date of birth, financial or other sensitive data for marketing, profiling, or any purpose unrelated to your visa preparation. We never sell your personal data.

We process your personal data on the basis of your free, specific, informed, unconditional and unambiguous consent, given through a clear affirmative action when you sign up and when you upload documents, as required by Sections 5 and 6 of the DPDP Act. Limited processing may also rely on legitimate uses permitted under Section 7 (for example, complying with a legal obligation).

You may withdraw consent at any time by writing to our Grievance Officer. Withdrawing consent is as easy as giving it. After withdrawal we will stop processing and delete your data within a reasonable time, unless the law requires us to retain it. Processing done before withdrawal remains lawful, and we may be unable to continue providing the Services.

If the applicant is under 18, the account must be created by a parent or lawful guardian who gives verifiable consent under Section 9 of the DPDP Act. We do not track, behaviourally monitor or target advertising at children, and we do not process a child's data in any way likely to harm their well-being.

• Uploaded files are stored in private, access-controlled storage — never on public links.
• Data is encrypted in transit (HTTPS/TLS) and at rest.
• Only you and the staff member assigned to your request can access your files, enforced by role-based access controls.
• Staff are bound by confidentiality obligations and access only what they need for your request.
• We maintain access logs and review our security safeguards regularly, in line with Section 8(5) of the DPDP Act.

We keep personal data only for as long as needed for the purpose it was collected.

• Uploaded documents: all files you upload are permanently deleted within 90 days after your visa application is marked as completed on buildmyvisa.
• If you close your account or withdraw consent, your documents and personal data are deleted, except where retention is required by law.
• Basic contact information (full name, email address and contact number) is retained after your visa process ends so we can send you service updates and marketing communications. You can unsubscribe or ask us to delete this information at any time, and we will stop within a reasonable time.
• Invoices and payment records are kept for the period required by tax and accounting laws.
• Inactive accounts may be deleted after 3 years, with prior notice to you.

You may ask us to delete your documents earlier at any time.

• Service providers who process data on our behalf under contract: cloud hosting and storage, payment gateways, email delivery and AI processing providers. They may use your data only to provide services to us.
• Our in-house agents and experts who handle your request.
• Government or law-enforcement authorities, where legally required.

We do not submit your documents to any embassy, VFS Global or BLS International on your behalf unless you expressly ask us in writing. Some providers may process data outside India, only in countries not restricted by the Central Government under Section 16 of the DPDP Act.

• Right to access a summary of your personal data and the processing activities carried out (Section 11).
• Right to correction, completion, updating and erasure of your personal data (Section 12).
• Right to grievance redressal (Section 13).
• Right to nominate another person to exercise your rights in the event of death or incapacity (Section 14).

To exercise these rights, contact our Grievance Officer. We will respond within the time limits prescribed under the DPDP Rules.

Your duties under Section 15: provide authentic information, do not impersonate anyone, do not suppress material information, and do not file false or frivolous complaints.

If a personal data breach occurs, we will act promptly to contain it and will notify affected users and the Data Protection Board of India, as required under Section 8(6) of the DPDP Act and the DPDP Rules, including what happened, the likely impact and steps you can take.

We use only essential cookies and browser storage needed to keep you signed in and to remember your chat session. We do not use third-party advertising cookies. Chat messages are stored to provide support and are covered by this policy.

For any question, data request, withdrawal of consent or complaint, contact:

• Name: Liza Dias
• Email: complaints@buildmyvisa.com
• Address: [registered business address, India]

We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

We may update this policy from time to time. Material changes will be notified on the website or by email before they take effect.