Privacy Policy

Summary

TimeVisas uses personal data to provide and secure the visa service. Application documents follow a defined deletion schedule, optional AI review and analytics require separate choices, and we do not sell personal data. The sections below explain the complete policy.

1. Who we are

TimeVisas is a visa-facilitation service operated by Time Leisure, S45 Parvati Industrial Estate, Pune Satara Road, Pune 411009, Maharashtra, India (GSTIN: 27AANPN8440Q1ZS).

Privacy and grievance contact: support@timevisas.com · +91 90280 11022

2. Personal data we collect

Identity and contact data: Name, date of birth, passport number and expiry, email address, mobile number, and residential address.

Application and travel data: Destination, travel dates, accommodation, purpose of visit, employment and financial information, prior travel or visa history, and application status.

Documents: Passport scans, photographs, bank statements, salary slips, tax records, employment letters, and other documents required for the application.

Account, payment, and communication data: Authentication identifiers, payment order and transaction details, invoices, and communications with TimeVisas. Razorpay handles card and bank credentials; TimeVisas does not store those credentials.

Technical and security data: IP address, browser and device information, cookie choices, operational logs, malware-scan results, and staff access audit records. Google Analytics data is collected only after analytics consent.

3. Why we process personal data

We process personal data to assess and prepare visa applications, check documents, create requested cover letters and itineraries, submit information to the relevant authority or processing centre, take payment, provide invoices, communicate progress, prevent fraud and malware, secure the service, keep required business records, and handle questions, rights requests, and complaints.

We do not sell personal data or use application documents for advertising.

4. Grounds for processing

Where the Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of your consent or another use permitted by applicable law. The application form records consent for visa processing. Optional AI document review requires separate consent and is not required to submit an application.

You may withdraw consent by contacting us. Withdrawal does not affect processing already carried out. It may prevent us from continuing a service that requires the affected data, and it does not require deletion of records that applicable law requires us to retain.

5. Who receives personal data

Visa recipients: The relevant embassy, consulate, government authority, or authorised visa-processing centre, such as VFS Global, where needed for the requested application.

Service providers: Supabase (database and document storage), Clerk (authentication), Razorpay (payments), Resend (email), Vercel (website hosting), Railway and the malware-scanning service (document security), and Sentry (restricted operational error monitoring). Google Analytics receives usage data only after analytics consent.

Optional AI review: Anthropic receives selected passport scans or supporting documents only after the separate AI document-review consent is enabled.

Professional or legal recipients: Advisers, auditors, regulators, law-enforcement bodies, or courts where reasonably necessary or legally required. Providers may process data only for the relevant service and under their applicable terms.

6. International processing

Some service providers or visa authorities may process personal data outside India. Where this occurs, we use the transfer for the stated service purpose and subject it to applicable Indian restrictions and the provider's contractual and security safeguards.

7. How we protect personal data

We use access controls based on staff roles, authenticated document access, encrypted transport, restricted storage, malware scanning and quarantine, minimised operational logging, and an append-only staff audit record for protected document access and administrative changes.

No online system is completely risk-free. If a personal-data breach occurs, we will investigate and make notifications required by applicable law.

8. Retention and deletion

Active applications: Application data and attached documents are retained while the application remains active.

Completed applications: Attached application documents are scheduled for deletion 365 days after the application first enters delivered or rejected status. If an application is reopened before deletion, its automatic document-deletion date is cleared.

Abandoned uploads: Files uploaded but never attached to an application are scheduled for deletion after 7 days.

Quarantine: Files left in malware-scan quarantine are scheduled for deletion after 24 hours. Infected files are not released to staff or AI.

After document deletion: The stored file is deleted and its link is removed from the application. Limited application, payment, invoice, security, and audit records may remain where needed to provide the service, prevent fraud, meet legal obligations, resolve disputes, or establish or defend legal claims.

Account and other personal data: We erase or anonymise data when consent is withdrawn or its stated purpose is no longer served, unless retention is necessary under applicable law. Tax, accounting, security, and staff audit records are retained only for the period necessary for those purposes and are periodically reviewed.

9. Your choices and rights

Subject to applicable law, you may request a summary of personal data being processed and relevant sharing information; correction, completion, or updating of personal data; erasure of personal data; withdrawal of consent; grievance redressal; and nomination of another person to exercise your rights in the circumstances provided by law.

You may also refuse optional AI review or analytics cookies without losing access to the core application service.

10. How to make a request or complaint

Email support@timevisas.com or call +91 90280 11022. Describe the request and the account or application concerned. We may ask for proportionate information to verify your identity and protect the account.

We aim to acknowledge and resolve privacy requests promptly and within any period required by applicable law. If a grievance is not resolved through our process, you may use the remedies available under applicable law, including approaching the Data Protection Board of India when permitted.

11. Cookies and analytics

Essential authentication and security storage is used to operate your account and protect the service. Google Analytics is not loaded unless you select Accept Analytics in the cookie notice. No advertising cookies are used.

To change a stored analytics choice, clear the site data for timevisas.com so the consent notice appears again. Rejecting analytics does not prevent use of the application service.

12. Children's data

TimeVisas does not invite children to create or manage applications independently. If an application concerns a person under 18, the submitting adult confirms that they are the parent or lawful guardian, or are otherwise legally authorised to provide the child's data. We may request verification before processing where required by law.

13. Changes to this policy

We may update this policy when our services, providers, retention practices, or legal duties change. The revised effective date will appear on this page, and material changes will be communicated where required.

14. Contact

Privacy and grievance contact: support@timevisas.com Phone: +91 90280 11022 Address: Time Leisure, S45 Parvati Industrial Estate, Pune Satara Road, Pune 411009, Maharashtra, India

Applicable law

This policy is governed by applicable Indian law, including provisions of the Digital Personal Data Protection Act, 2023 and rules brought into force from time to time. Contractual disputes remain subject to the Terms & Disclaimer.