Privacy Policy

Version 0.1 (draft) · Last updated June 25, 2026

Draft — counsel review required

These clauses were drafted from the project specification to be substantive and specific, not placeholder text. They have not been reviewed by a licensed attorney and are not final legal copy. A licensed US attorney (and a Colombian habeas-data attorney) must review this document before launch.

This policy explains what data Sunward Visas collects, how we use and protect it, and the control you have over it. The service is directed to U.S. citizens applying from the United States.

Data we collect

Account & profile: email, and any name or self-declared U.S. state you provide.
Your progress: which checklist items you've completed and which visa journeys you've started.
Usage records (signed-in only): which guide pages you open and when. We use this to provide and improve the service and to assess refund requests fairly. Anonymous browsing is not recorded.
Feedback (optional): ratings and comments you choose to submit about your experience, including whether we may publish them.
Payments: processed by Stripe. We receive confirmation and receipt metadata; we never receive or store your card number.
Consent records: a timestamped log of the consents you give, to evidence informed consent.

We do not collect your immigration documents

The service does not ask for, store, or transmit your passport scans, financial statements, or any other immigration documents — those stay with you. We never make any document upload or biometric step a condition of having an account.

How we use your data

To provide the service: save your progress across devices, process your purchase, send transactional email (sign-in and receipts), and keep the site secure. We do not sell your data, and we never transmit anything to the government or any third party on your behalf.

Security

TLS encryption in transit and encryption at rest for the database.
Each user can access only their own data (enforced at the database level).
We never ask you to upload identity documents, and we never see or store your card details — payment is handled entirely by Stripe.

Retention

Your data is kept while your account exists and deleted when you delete your account. One exception: payment records are retained by Stripe, our payment processor, after account deletion — they are required for refunds, dispute resolution, and accounting.

Your rights

Access & export: download all your data in one file from the Account & data page.
Correction: edit your profile and progress.
Deletion: permanently delete your account and its data, self-serve, at any time.

These controls are built into your account. They are intended to satisfy both U.S. state privacy rights and Colombian habeas-data principles; the precise applicability of Colombia's Ley 1581 of 2012 to this service is a matter for counsel to confirm before launch.

Service providers

We rely on a small set of processors to run the service — hosting and database/storage (Supabase, Vercel), payments (Stripe), and transactional email. Each processes data only to provide their part of the service.

Cookies

See our Cookie Notice. Analytics, if any, are gated behind your consent.

Changes

Material changes will be reflected by an updated version and date above. The final policy is subject to counsel review.