Privacy & Document Protection Policy

2. Categories of Information We Collect

To process your independent tourism visa preparation and manual lodging, we collect only the necessary biographical and travel information required by sovereign destination immigration authorities:

3. Private Document Vault & Cryptographic Token Protection

Uploaded identity documents (passport bio pages, photographs, visas, and flight confirmations) are treated with the highest tier of confidentiality:

• Zero Public Directory Storage: Files are stored strictly outside the public web server root in isolated private storage directories.
• Randomized Secure Filenames: Uploaded files are renamed using cryptographically secure random 128-bit hashes (`crypto.randomBytes`) to prevent file enumeration.
• Short-Lived Signed URLs: Documents can only be retrieved using temporary HMAC-SHA256 signed tokens that expire automatically within 15 minutes.
• Role-Based Access Control (RBAC): Only authenticated operations staff with verified permissions can inspect documents for consular audit.

4. Strict No-Sale Commitment & Lawful Basis

We maintain an absolute, zero-tolerance policy against the commercialization of traveler data:

• We do not sell, rent, monetize, or trade applicant personal data, passport numbers, or contact records to third-party advertisers or data brokers under any circumstances.
• Personal data is processed strictly on the lawful basis of contract performance (preparing and lodging your requested tourism visa application) and legal compliance.
• Data is shared solely with the relevant destination government immigration authorities and consular posts required to adjudicate your visa application.

5. Secure Payment Processing via Stripe

All financial transactions are conducted directly through Stripe, a certified PCI-DSS Level 1 Service Provider:

• Our servers never receive, store, or log raw credit/debit card numbers, CVV codes, or full banking credentials.
• Cardholder data is tokenized directly within Stripe elements.
• We retain only the Stripe PaymentIntent identifier, the transaction amount, currency, and payment status for accounting and audit compliance.

6. Data Retention & Cryptographic Disposal

7. Your Rights Under GDPR, CCPA & Data Protection Laws

Subject to applicable jurisdiction, travelers maintain comprehensive rights regarding their personal information:

• Right of Access: Request a copy of the personal information we maintain regarding your application.
• Right to Rectification: Request correction of inaccurate biographical details prior to consular lodgment.
• Right to Erasure (Right to be Forgotten): Request deletion of your dossier and uploaded passport files, subject to statutory consular records obligations.
• Right to Restriction of Processing: Request suspension of processing if you dispute data accuracy.

To exercise any of these rights, contact our Data Protection desk at privacy@evisaroute.com.