Privacy Policy
Last updated: 7 November 2026
1. Who we are (Controller)
This policy explains how TOP SUITE DIGITAL MARKETING L.L.C, operator of the EZvisa software brand (Trade Licence No. 1271067, issued by Dubai Department of Economy and Tourism, registered address Office 66, Obaid Musabbeh Mohammed Al Mansoori Building, Hor Al Anz, Dubai, UAE) ("EZvisa", "we", "us") processes personal data when you use ezvisa.net, the EZvisa mobile app, WhatsApp, chat and our Schengen visa application preparation services.
TOP SUITE DIGITAL MARKETING L.L.C is the controller of your personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Where the EU/EEA General Data Protection Regulation (GDPR) applies, additional rights and obligations may also arise. EZvisa is a private company, not a government body.
Contact for privacy matters: hello@ezvisa.net · WhatsApp/Phone +971 54 710 9533.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity data | Full name, date and place of birth, gender, nationality, marital status | You |
| Identity documents | Passport bio page and copies, Emirates ID / residence visa, national ID, previous visas | You |
| Photographs | Passport-style photo | You |
| Contact data | Email, phone/WhatsApp number, address | You |
| Travel data | Destination, dates, itinerary, accommodation, flight details, travel companions | You |
| Employment & financial data | Employer, job title, salary/income, bank statements, sponsorship letters, NOCs | You |
| Family data | Spouse and dependants' details (where you apply together) | You — you must have their permission to share it |
| Payment data | Amount, transaction reference, payment status (we do not store full card numbers; cards are processed by the payment gateway) | You / Payment gateway |
| Account & communications | Login details, messages, website contact-form messages, chat transcripts, support history | You |
| Technical & usage data | IP address, device and browser type, pages viewed, referrer, cookie IDs, app push-notification token | Automatically, see the Cookie Policy |
Sensitive data. Identity documents, biometric photographs, and information that may reveal nationality, religion, ethnicity, health (e.g. travel insurance) or financial status can be sensitive personal data under the PDPL and special-category data under the GDPR. We use this information only as necessary for the service you request, subject to applicable legal grounds and security safeguards (Section 7). If we rely on your consent for a specific processing purpose, you may withdraw that consent; doing so may prevent us from completing that part of the service.
We do not knowingly collect data of children except where a parent or guardian submits it as part of a family application.
3. Purposes and legal basis
| Purpose | Data used | Legal basis (PDPL / GDPR) |
|---|---|---|
| Organizing visa application information, document uploads and draft travel itineraries (not confirmed bookings) | Identity, documents, travel, employment, family | Performance of the requested service and, where legally required, a separate consent or another applicable legal ground |
| Future AI-assisted form and itinerary drafts (not yet launched): information and documents the user chooses to provide, with user review required | Identity, documents, travel, employment, family | Performance of a contract; explicit consent for sensitive data |
| Creating and managing your account and the app | Contact, account, technical | Performance of a contract |
| Processing payments and refunds | Payment, contact | Performance of a contract; legal obligation |
| Customer support via WhatsApp, phone, email and chat | Contact, communications | Performance of a contract; legitimate interest in responding to enquiries |
| Service emails and notifications about your application and our service (for example a visa centre closure), on the website and as app push | Contact, push token | Performance of a contract |
| Managing enquiries and leads (CRM) | Contact, enquiry details | Consent / steps taken at your request before a contract |
| Optional marketing emails and offers, only for customers who have affirmatively opted into Travel tips and offers | Contact, push token | Recorded, revocable opt-in; you can opt out in Account → Notifications or through the unsubscribe instructions |
| Analytics and website improvement | Technical & usage | Consent (via cookie banner) |
| Fraud prevention and security | Technical, account | Legitimate interest; legal obligation |
| Accounting, tax and legal compliance; handling disputes | Payment, account, communications | Legal obligation (PDPL Art. 4(5); GDPR Art. 6(1)(c)); establishment or defence of legal claims |
We do not sell personal data and we do not make decisions about you based solely on automated processing that produce legal effects.
Current trip planner and planned AI assistant. The EZvisa mobile app currently creates general trip-plan suggestions using rules running on the device; this feature does not call an external AI model. If you save a trip plan to your account, that information may be synchronized to our database hosted through Supabase in the United States. A separate AI assistant for drafting form answers and personalized itineraries is in development and is not currently available. Before we enable external AI processing, we will identify the provider, explain which fields and document types it receives, verify processing location and data retention, and offer a specific affirmative choice for the relevant processing. Travel-plan drafting will not require uploading passport scans or bank statements to an AI model by default. Outputs remain drafts to review; they do not constitute genuine travel bookings or government advice.
4. Who we share data with
Service providers (processors) acting on our instructions under written terms:
| Provider | Purpose | Data | Location* |
|---|---|---|---|
| Supabase | Database, authentication and document file storage | All application data and uploaded documents | USA (AWS us-east-1) |
| Vercel | Website hosting and delivery | Technical data, data in transit | Global edge network / USA |
| Payment gateway | Payment processing | Payment and contact data | Provider processing location to be confirmed |
| HubSpot | CRM — leads and enquiries | Contact and enquiry data | USA/EU |
| Crisp | Live chat | Chat messages, contact, technical data | EU (France) |
| Google Analytics / Google Tag Manager | Website analytics and tag management | Technical & usage data (pseudonymous) | USA/global |
| Resend | Transactional email delivery | Email address, message content | USA |
| Expo | Mobile app push notifications | Push token, notification content | USA |
| Meta (WhatsApp) | Messaging when you contact us on WhatsApp | Phone number, messages | Global |
| AI model provider (planned; provider and processing location not yet confirmed) | Drafting form answers and travel plans after launch, subject to customer review | Relevant information supplied for AI assistance | To be confirmed before launch |
| Google Workspace (if used for case preparation) | Possible internal document workspace | Only documents needed for that purpose | Processing location depends on configured workspace |
| Flight and hotel providers (only if a separately authorized booking service is launched) | Potential genuine booking arrangement | Only information required for a requested booking | To be disclosed before use |
*Locations to be confirmed against each provider's current terms and our account settings. The planned AI model provider and any flight/hotel search integration must be verified before they are activated. Contact hello@ezvisa.net for the latest details.
Other recipients: third-party travel providers only where an actual booking feature is available and you separately request it, professional advisers (lawyers, auditors), and authorities where required by law or a court order. EZvisa does not send your application to an embassy, consulate or visa application centre on your behalf. In a sale or restructuring of our business, data may transfer to the successor under this policy.
5. Cross-border transfers
Certain service providers process or store personal information outside the UAE, including the United States (our Supabase hosting region). Such transfers must satisfy UAE PDPL Articles 22–23 and any other applicable rules. We assess the relevant contractual, protection and legal grounds for each provider; the selection of an external AI model remains subject to a separate assessment before activation. You may request information about a particular transfer at hello@ezvisa.net. If you independently submit a visa application to an embassy or visa centre, that authority's own privacy terms apply.
6. Retention
| Data | Retention period |
|---|---|
| Passport, ID documents, photos and supporting documents (bank statements, letters) | Retained while needed for an open application; closed-case deletion is subject to the configured retention process and legal holds. You may request deletion at any time, subject to legal obligations. |
| Prepared application files (forms, cover letter, itinerary) | Retained while needed for the service, then subject to the same closed-case retention and deletion process |
| Case folders in Google Drive, if used | Retention and deletion depend on the actual integration and must be verified before live use |
| AI agent run records (once launched) | A retention period will be published before launch, after confirming provider logs and deletion controls |
| Website contact-form messages | 12 months after last contact |
| Account data | While your account is active; deleted within 90 days after you request account deletion |
| Payment, invoice and transaction records | 5 years (or longer if required by UAE commercial/tax law) |
| Support communications and chat transcripts | 12 months after last contact |
| CRM leads that did not become customers | 12 months after last contact, or until you withdraw consent |
| Marketing choice records | Until you turn marketing off, plus 2 years as proof of your choice |
| Analytics data | According to the active analytics-provider retention settings and the consent choices you make |
| Backups | Overwritten on a rolling cycle of up to 30 days |
Deletion may be subject to technical processing times, backups and legal recordkeeping obligations. If you request account deletion, we will explain what can be deleted and what must be retained. For immediate privacy enquiries, contact hello@ezvisa.net.
7. Security
We apply safeguards including encrypted HTTPS connections, private storage buckets for uploaded documents, row-level database policies, and time-limited signed links for authorized downloads. Staff access, incident handling, contracts and international transfers are subject to ongoing security and compliance review. The future external AI assistant remains disabled until its access and consent controls are approved. No system is completely secure. When a personal-data breach triggers notification duties under applicable law, we will follow the legally required response and notice procedures.
8. Your rights
Subject to applicable law, you have the right to:
- be informed about processing and access a copy of your data;
- rectify inaccurate or incomplete data;
- erase your data (subject to retention we are legally required to keep);
- restrict or object to processing, including direct marketing at any time;
- data portability — receive your data in a structured, machine-readable format;
- withdraw consent at any time, without affecting processing already carried out;
- not be subject to decisions based solely on automated processing;
- complain to the UAE Data Office, or, where GDPR applies, to the supervisory authority in your EU country.
Send requests to hello@ezvisa.net or WhatsApp +971 54 710 9533. We may need to verify your identity. We respond within 30 days (extendable where permitted by law). Requests are free unless manifestly unfounded or excessive.
9. Cookies
We use essential cookies and, with your consent, analytics, marketing and chat cookies. See our Cookie Policy and manage choices via Cookie settings in the footer. Form data may be saved in your browser's local storage to preserve your progress until you submit it.
10. Third-party links
Our site links to embassy, visa centre and other websites. We are not responsible for their privacy practices.
11. Changes
We may update this policy. The "Last updated" date shows the latest version; material changes will be notified by email or a notice on the website/app before they take effect.
12. Contact
TOP SUITE DIGITAL MARKETING L.L.C (EZvisa), Office 66, Obaid Musabbeh Mohammed Al Mansoori Building, Hor Al Anz, Dubai, UAE · hello@ezvisa.net · WhatsApp/Phone +971 54 710 9533.