Privacy Policy

Account & Profile: email, auth credentials, name, profile picture, demographic info, visa type, target country, education, employment history.

Usage & Interaction: visa audit responses, interview practice, features used, pages visited, time spent, error logs, device/browser/anonymized IP.

Payment & Billing: subscription tier, billing period, payment method type (no full card details stored), invoice history.

We use your data to provide services, process payments, send communications where you have consented, improve product quality through analytics, prevent fraud and abuse, and satisfy legal or regulatory obligations.

Your passport, visa documents, and identity files are classified as sensitive personal data under global privacy regulations including GDPR, UK DPA, CCPA, and NDPR.

Extracted Fields: We extract from your documents only the data necessary for visa guidance (full name, date of birth, document type, validity dates, visa-relevant metadata).

Raw Files Storage: Your actual uploaded files are stored encrypted at rest in Supabase Storage (EU-based, GDPR-compliant infrastructure).

Retention Period: Documents are retained for 24 months from upload date. You can confirm retention or request deletion at any time from your dashboard.

Automatic Deletion: After 24 months, we send you a notice. If you don't confirm retention within 7 days, your documents are automatically deleted from both storage and our database.

Early Deletion: You can request immediate deletion from your dashboard using the 'Delete my documents now' button, which triggers our privacy workflow through /contact?category=privacy for final confirmation.

Encryption: All files are encrypted in transit (TLS 1.3) and at rest (AES-256 equivalent). No unencrypted files are logged or cached.

JapaReady is designed to use TLS 1.3 in transit and AES-256-grade at-rest protections through our managed infrastructure providers. We use secure environment variable management, least-privilege operational access, and rely on PCI DSS payment providers so full card details are not stored in the application.

Regular security reviews are part of our operating plan. Formal penetration testing is planned as the platform matures; we do not represent that as completed unless and until it has actually occurred.

Supabase (database/auth, GDPR-compliant, EU-based infrastructure)

Google Generative AI (interview insights and recommendations)

Paystack, Flutterwave, Paddle (payments, PCI DSS Level 1)

Google Analytics (anonymized usage analytics)

All vendors have signed Data Processing Agreements.

Account data: while active, deleted within 30 days of request.

Documents (passports, visas, identity): 24 months from upload, or sooner if you request deletion.

Audit & practice data: 24 months, deletable anytime.

Payment records: 7 years (tax/accounting compliance).

Analytics data: anonymized, retained 2 years.

Please see our Cookie Policy for details on essential, performance, preference, and payment-related cookies.

Where personal data moves across borders, we rely on Standard Contractual Clauses or equivalent transfer safeguards where applicable.

If a breach affecting personal data occurs, we will notify affected people within 72 hours where GDPR requires it, explain the incident clearly, offer support, and report to regulators where legally required.

JapaReady is not intended for people under 18. If we discover under-18 personal data was collected in error, we will delete it promptly.

Use /contact?category=privacy for privacy inquiries · Response time: within 30 days

We will communicate significant policy changes by email and update this page accordingly.