Privacy Policy

1. Who this covers

This policy covers doineedvisa.to and, where noted, api.doineedvisa.to once it launches. It does not cover third-party sites you reach through affiliate links. Their own privacy policies apply there.

2. What we collect today

As of this writing the Site is a static informational site with no user accounts. What’s collected:

• Standard server logs (via the hosting/reverse-proxy layer): IP address, request path, timestamp, user agent. Kept for operational and security purposes, not tied to an identity.
• Aggregate analytics (via PostHog, our analytics processor): two things are recorded, the pages you view and clicks on links that leave the Site, so we can see which official portal or affiliate CTA people actually use. Nothing else. Autocapture and session recording are both switched off, so we do not record your other clicks, your keystrokes, anything you type into a form, or your screen. Anonymous visitors get no person profile, so these are counts, not a file on you. Analytics requests go to doineedvisa.to/ingest and we forward them, which means your browser never connects to a third-party host, though PostHog does receive the data as our processor. If you are in the EU, the EEA, the UK or Switzerland, none of this starts until you accept the notice at the bottom of the page: no analytics cookie is set and no event is sent before you do, and ignoring the notice is a valid way to decline. If your browser sends a Do Not Track signal, we collect nothing at all. We will not sell this data.
• No forms, no sign-up, no payment collection yet.

3. What we plan to collect as features ship

This section is written ahead of the features it describes, so it stays accurate as each ships:

• Passport-preference cookie: once client-side geo-detection ships, a cookie may store your selected/overridden passport country so the Site can suggest your answer on return visits. This is a preference, not an identity. No account is created.
• Geo-IP lookup: your IP may be looked up against a local database, in-process, to suggest a passport country. This lookup is never sent to a third party and never determines what content is served. It only personalizes a client-side suggestion.
• Payment data: if a paid feature or API tier launches, payment is handled by Stripe. We do not store your card details. Stripe processes and stores them under its own privacy policy.
• API keys: if you register for API access, we store your key, associated email, and usage counters to enforce rate limits and billing.

4. What we don’t do

We don’t sell personal data, and we don’t share data with third parties except the processors named above, only as needed to run the Site.

5. Cookies

The Site sets two kinds of first-party cookie, and no advertising or cross-site tracking cookie of any kind:

• Functional, e.g. remembering your passport preference.
• Analytics (see section 2): PostHog stores a random visitor ID and a session ID so repeat page views can be counted as one visit rather than several. The ID is a random string, it is set on doineedvisa.to rather than by a third party, and it is not used to follow you to other sites. In the EU, EEA, UK and Switzerland it is only set after you accept the notice. Turning on Do Not Track stops it being set anywhere.

We do not sell or share what these cookies measure, and if that ever changes this policy will be updated first.

6. Data retention

Server logs are retained only as long as needed for operational/security purposes. API usage counters are retained for the life of the associated key.

7. Your rights

You can ask what data we hold about you, or ask us to delete an API account, by emailing the contact below.

8. Children’s privacy

The Site is not directed at children under 13 and we do not knowingly collect data from them.

9. Changes to this policy

This policy will be updated as the features described in Section 3 actually ship, and the “last updated” date will change accordingly.

10. Contact

Privacy questions or data requests: hello@doineedvisa.to