Privacy Policy

1. Scope

This policy covers the DoINeedVisa website at doineedvisa.to, the public API at api.doineedvisa.to, and the MCP server at mcp.doineedvisa.to. It does not cover third-party sites reached through official-source, affiliate, or other outbound links. Their own privacy policies apply.

2. Information we process

• Server and security logs: our hosting and reverse-proxy layer may process an IP address, request path, timestamp, response status, and user agent to operate, secure, and troubleshoot the services.
• Site analytics: Lite Analytics receives page URL, visit date and time, platform, country derived from the IP address, referrer, browser and version, operating system and version, and screen resolution. Lite Analytics states that it discards the IP address after geolocation and does not use analytics cookies. PostHog receives page views and outbound-link clicks only; autocapture and session recording are disabled. For visitors in the EU, EEA, UK, or Switzerland, PostHog does not initialize until the visitor accepts the analytics notice. Do Not Track disables PostHog collection.
• Passport preference and location suggestion: when you choose a passport, we store its two-letter country code in a first-party cookie for up to one year. If a local GeoLite2 database is configured, the server may use your IP address in-process to suggest a country. We do not send that lookup to a geolocation provider or store the lookup result in an account.
• Feedback and inquiries: helpful/not-helpful votes may include page context and IP address. An error report may include your message, optional email, page context, IP address, user agent, receipt time, and dataset version. The advertising inquiry form uses the same channel and may include the name/company and email you provide. Reports are delivered by Resend when configured, or saved to a local fallback file; feedback is saved to a local file.
• API access: we store a one-way hash and display prefix for each API key, the operator-supplied label, tier, quota, status, and usage counters. The plaintext key is shown only when issued and is not stored.
• Anonymous MCP access: to enforce the daily limit without an account, we store a SHA-256 hash of the client network identifier, the UTC day, and the call count. Raw network identifiers are not stored in this metering table. Records older than the current day plus the preceding 30 UTC days are deleted opportunistically as calls arrive.

We do not collect card details. If paid self-service plans are introduced, this policy will identify the payment processor before collection begins.

3. Why we use this information

We use it to deliver and secure the services, enforce quotas, answer support or commercial inquiries, investigate reported errors, understand aggregate use, and improve content and product reliability. We do not sell personal data or use it for cross-site advertising.

4. Service providers and disclosures

We disclose information only as needed to operate the services, comply with law, or protect users and the service. Current providers include our hosting and network providers, Lite Analytics, PostHog, and Resend when email delivery is configured. These providers process information under their own terms and privacy commitments.

5. Cookies and local storage

The passport preference cookie is functional and lasts up to one year. PostHog may set first-party analytics identifiers after consent where consent is required. Lite Analytics states that it does not use analytics cookies. The analytics consent choice and browser-side helpful-vote deduplication flag may be stored in local storage. We do not use advertising or cross-site tracking cookies.

6. Retention

Anonymous MCP metering records use the 31-calendar-day policy described in Section 2. API-key usage records are retained while the key is active and as needed for service administration. Server-log retention is controlled by the hosting configuration. Report and feedback files do not currently have an automatic deletion schedule; they are retained for investigation and product improvement until manually removed. Analytics providers retain data according to their configured or published periods.

7. Your choices and rights

You can delete the passport cookie and local-storage values in your browser, decline the PostHog notice where shown, or enable Do Not Track. You may ask for access, correction, or deletion of information associated with you or an API key. Some log or hashed metering data may not be reasonably linkable back to you without additional information.

8. Children

The services are not directed to children under 13, and we do not knowingly collect personal information from them.

9. Changes and contact

We will update this policy and its date when our practices materially change. For privacy questions or requests, email hello@doineedvisa.to or visit our support page.