BigFat AI Labs LLP (“we”, “us”) operates MyVisaScore. This policy explains what personal data we collect, why, and your rights. We act as the Data Fiduciary for the personal data you provide, under India’s Digital Personal Data Protection Act, 2023.
1. Data we collect
- Assessment answers — your responses to the readiness questionnaire (visa type, destination, passport validity band, refusal history, occupation, funds indication, ties, etc.).
- Contact details — name, email address, and (optionally) phone number.
- Documents (paid Pro plan, when launched) — passport and bank-statement files you choose to upload for analysis.
- Payment data — processed by our payment gateway, Razorpay. We do not store your full card or bank credentials.
- Technical data — IP address, device/browser type, and usage events, for security and to improve the Service.
- Interaction data — how you move through our pages (clicks, scrolling, and anonymised recordings of page interactions), used to find and fix usability problems. See Section 4 for what is excluded and masked.
2. How we use it
- To generate your Visa Score, report, and document guidance.
- To deliver your report by on-screen dashboard, PDF, or email.
- To process payments and provide customer support.
- To detect fraud, abuse, and secure the Service.
- With your consent, to send you relevant product updates (you can opt out anytime).
Your documents and personal information are used only to generate your visa assessment and operate the Service. We do not sell your personal data.
3. AI processing
Your structured answers (and opt-in free-text notes) are sent to our AI provider to grade your profile. We do not send passport numbers or raw document scans to the AI model — only the structured labels needed for the assessment.
4. Cookies, analytics and advertising
We use a small number of third-party tools to understand how our site is used and to measure our advertising. We have deliberately limited what they can see:
- Microsoft Clarity — heatmaps and recordings of page interactions, to find usability problems. It runs in a cookieless mode (no Clarity cookies are set, and you are not tracked across visits). It is never loaded on your report page or our admin pages, and your questionnaire answers are masked so they are never uploaded. Text you type into any field is masked by default and never recorded.
- Meta (Facebook) Pixel and Conversions API — to measure the performance of our advertising. It records page views, including on your report page, and the fact and value of a purchase. Meta receives the web address of the page and sets advertising cookies. It is never loaded on our admin pages, and if your report link carries an access token in its address, the token is removed from the address before any Meta tag runs — so the token is never sent to Meta. Where we send Meta your email or phone number to match a purchase, it is irreversibly hashed (SHA-256) before it leaves our servers — Meta does not receive your raw contact details. Your name, phone number, assessment answers, score and report contents are never sent to Meta.
- Our own usage measurement — we record how far visitors get through this site so we can see where it is confusing: that a page was opened, that the questionnaire was started, the number of the furthest question reached, and whether the price page and checkout were seen. If you arrived from an advertisement, we also store the campaign tags on that link (such as
utm_source,utm_campaign, and the click id) and the website that referred you.
This record is kept against a random identifier generated by your browser. It contains no name, email, phone number, questionnaire answer, score or report content — only which stages were reached and where the visit came from. It is our own measurement, stored on our own servers, and is not shared with any third party.
Your report link contains a private access token. That token, your report contents, and your assessment answers are never shared with any analytics or advertising provider.
5. Sharing
We share data only with service providers who help us operate (hosting, database, payment gateways, AI model provider, messaging, and the analytics/advertising providers named in Section 4), under contract and only as needed. We may disclose data if required by law. We do not sell your personal data.
6. Retention
We keep your assessment and account data for as long as needed to provide the Service and meet legal obligations, then delete or anonymise it. Customer documents and personal data are retained only as long as necessary to provide the requested services. Upon account deletion or service termination, documents are deleted within 90 days, unless retention is required by applicable law.
7. Security
We use reasonable technical and organisational measures, including encryption in transit (HTTPS) and access controls, to protect your data. No method is 100% secure, but we work to safeguard it.
8. Your rights (DPDP Act)
- Access a summary of your personal data and how it is processed.
- Request correction or erasure of your data.
- Withdraw consent at any time.
- Nominate another person to exercise your rights in case of death or incapacity.
- Grievance redressal — contact our Grievance Officer below.
9. Grievance Officer
Amitesh Kumar Maurya
Email: amitesh.maurya@bigfatailabs.com
Address: Innov8 Orchid Center, 3rd Floor, Sec-53, DLF QE, Golf Course, Gurgaon – 122002, Haryana, India
10. Changes
We may update this policy; material changes will be notified on this page with a new “last updated” date.
11. Contact
Questions about your privacy? Use our Contact page or email contact@myvisascore.in.