Legal

Privacy Notice

Last updated: 2026-05-12 · Site: visawiseconsultants.com

This is the privacy notice for VisaWise Consultants. The Operator takes data protection seriously and complies with the EU General Data Protection Regulation (GDPR) and the Portuguese national implementation.

Who the data controller is

The sole tradership trading as VBFactory, registered in Portugal. Tax identification number available on request. Contact: legal@vbfactory.co.

What data the Operator collects

Application data. The information you share to prepare your visa application: your name, nationality, date of birth, address, family situation, financial information, employment details, the visa category you are applying for, and supporting documents (passport scans, bank statements, contracts, employment letters, criminal record checks, etc.).

Conversation data. The full text of your conversations with the AI agents.

Account and payment data. Your account credentials and payment information (processed by Stripe, not stored by the Operator).

Technical data. IP address, browser type, session logs, security logs.

Special category data. Your application may involve health information, criminal record data, or other special category data under Article 9 GDPR. Where this is so, the Operator processes it under your explicit consent and only for the purpose of preparing your application.

Why the Operator collects it (lawful basis)

For application data and conversation data: performance of the contract with you (Article 6(1)(b) GDPR).

For special category data such as health or criminal records: your explicit consent (Article 9(2)(a) GDPR).

For technical data and security logs: legitimate interests in keeping the service secure (Article 6(1)(f) GDPR).

For direct marketing, if any: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

For sharing data with accredited professionals you engage through VisaWise: your consent for that specific sharing.

Who the Operator shares data with

Sub-processors used to run the service:

Sub-processor	What they do	Location
Anthropic	LLM API for the AI agents	US, with EU data residency options where available
Render	Application hosting and database	EU region preferred
Cloudflare R2	Encrypted document storage	EU edge preferred
Stripe	Payment processing	EU and US
SendGrid	Transactional email	EU and US

Accredited professionals you engage through VisaWise, only with your explicit consent for that engagement, and only the data relevant to their work.

Authorities, where legally required (court order, regulatory request).

The Operator does not sell your data. The Operator does not use your conversations to train any AI model.

International transfers

Some sub-processors process data outside the EU. The Operator relies on Standard Contractual Clauses approved by the European Commission, and on the EU-US Data Privacy Framework where applicable, to provide an adequate level of protection.

How long the Operator keeps your data

While your account is active and your application is in preparation.

After your application is submitted or your account is closed, the Operator keeps the data for as long as is legally required (Portuguese tax and accounting rules require retention of certain records for up to 10 years, immigration-related records typically for shorter periods), then deletes it.

You can request deletion at any time. The Operator will delete your data within 30 days of a valid request, except where legal retention obligations apply. Where legal retention requires the Operator to keep some data, the Operator will tell you what is kept and why.

Your GDPR rights

You have the right to:

Access the data the Operator holds about you (Article 15)
Correct mistakes (Article 16)
Have your data erased ("right to be forgotten", Article 17). The Operator will action this within 30 days, subject to legal retention obligations.
Restrict processing (Article 18)
Receive your data in a portable format (Article 20)
Object to processing based on legitimate interests (Article 21)
Withdraw consent at any time for processing based on consent (Article 7)
Not be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you (Article 22). You can ask for human review at any time.
Lodge a complaint with the Portuguese data protection authority (CNPD, www.cnpd.pt) or with the data protection authority in your country

The Operator responds within 30 days. The Operator will not charge you for exercising these rights, except in limited circumstances allowed by GDPR.

Automated decision-making

The AI agents process your information automatically, but they do not make final decisions that significantly affect you. Final decisions on your visa application are made by the Portuguese authorities. Decisions about whether to engage a professional, what to include in your application, and what to submit are decisions you make.

If at any point you feel that the platform is making a decision that significantly affects you and you want human review, ask. The Operator will provide human review per Article 22 GDPR.

Data protection impact assessment

The Operator has carried out a Data Protection Impact Assessment for the processing activities of VisaWise. A summary is available on request.

Security

The Operator uses encryption in transit and at rest, access controls, regular security review, and incident response procedures. If a personal data breach occurs that is likely to affect your rights, the Operator will notify you and the CNPD within the time limits set by GDPR.

Cookies

The site uses essential cookies (for session management) and optional analytics cookies. The cookie banner on the site lets you choose what to allow. You can change your choice at any time.

Contact for privacy and data protection

legal@vbfactory.co. Mark privacy requests with "Privacy" or "GDPR" in the subject line for fastest handling.