Privacy policy

1. Controller

Arif Ali
Lucknow, Uttar Pradesh, India
Email: support@approvavisa.com

2. What we process and why

Your photo

When you upload a photo, it is sent to our image processing service to create the watermarked preview (crop, background replacement, checks). Legal basis: Art. 6(1)(b) GDPR (steps at your request before a contract). Before payment the photo is not stored on our servers; your browser keeps a copy locally (IndexedDB) so the files can be created after payment.

Your order

After payment we create the files, store them for 24 hours in cloud storage for download and send them to you by email. We keep the order record (order number, product, document, time, payment reference, email address) as long as needed for delivery, the guarantee and statutory retention duties. Legal basis: Art. 6(1)(b) and (c) GDPR.

Payment

Payment is handled by Dodo Payments as merchant of record. Dodo processes your payment data under its own responsibility; we never see your card details.

Technical data

To protect the service (e.g. limiting attempts) we briefly process your IP address. Legal basis: Art. 6(1)(f) GDPR.

3. Processors and recipients

• Hosting of the website, server functions and anonymous visit counts: Vercel Inc., USA (server functions run in the USA)
• Microsoft Clarity (Microsoft Ireland Operations Ltd.): only if you accept analytics (see below)
• Image processing: ApprovaVisa photo engine, hosted by Amazon Web Services, Inc. in the USA (region US East, Virginia)
• File storage: Cloudflare R2, Cloudflare, Inc., USA (files deleted automatically after 24 hours)
• Email delivery: Resend, USA (sent via servers in Japan)
• Payment: Dodo Payments (own controller)

The controller is based in India, and several providers process data in the USA or Japan, i.e. outside the EU. For Japan there is an EU adequacy decision (Art. 45 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR).

4. Visit counts, analytics and local storage

To know how many people visit each page we use Vercel Web Analytics. It uses no cookies and stores nothing on your device; it receives the page address without query string (never the payment page), the referring website, browser, device type and country. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing how the site is used).

Only if you click “Accept” in the banner do we use Microsoft Clarity for heatmaps and anonymous recordings of how the site is used (clicks, scrolling, mouse movement). Clarity sets cookies and processes, among other things, browser, device and IP address; ad storage stays switched off. Clarity never records your photo: the photo tool, the enlarged preview and your order are hidden from it, and it does not start on the payment page. Legal basis: your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time under “Cookie settings” at the bottom of every page; we then stop Clarity and delete its cookies.

Your browser also stores your pending order locally (IndexedDB), a note that you have seen the short tour, and your analytics choice (localStorage). These stay on your device and are needed for the service you request (§ 25(2) TDDDG).

5. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority. Write to support@approvavisa.com.

Translation for information; the German version is binding.