Privacy Policy

1. Who we are and how to reach us

EffortlessVisa is operated by Effortless Visa LLC, a small family-run business based in Texas, United States. You can reach us with privacy questions or requests through the support contact form.

2. Scope

This policy covers effortlessvisa.com, the EffortlessVisa web application, any optional packet-review service, and support interactions. It does not cover the government agencies you file with or other websites we link to.

3. Information we collect

Depending on what you do, we collect:

• Account & contact: your name, email, role (petitioner/sponsor or beneficiary), and language preference.
• Case content you enter: the immigration and personal information a filing needs - which can include identity, passport, citizenship, entry and travel, relationship and marriage, criminal-history, employment, financial, tax, military, and household information, and information about beneficiaries, children, relatives, former spouses, employers, interpreters, and preparers. This content is encrypted in your browser (see section 8), so we cannot ordinarily read it.
• Uploaded documents and photographs you add as evidence - also encrypted in your browser.
• Payment information: your payment is processed by our payment provider; we receive the amount, status, and transaction identifiers, not your full card number.
• Support communications you send us.
• Device and security data: IP address, browser/user-agent, and sign-in and security events used to keep accounts secure and rate-limit abuse.
• Cookies and similar storage - essential only; see the Cookie Policy.
• Information you deliberately share with a reviewer or support person if you choose to grant access.

You should have the authority to provide information about anyone else you enter (for example, your fiancé(e), spouse, or child).

4. How we use information

We use information to: create and manage your account; save your progress; generate your forms and packet; run validation and consistency checks; process payments; provide support or a review you request; secure the service and prevent fraud; fix bugs and measure performance; comply with law; and send you transactional messages (like a receipt or a security notice). We only send marketing where permitted and with a clear choice. We do not use your sensitive case data for behavioral advertising.

5. AI

We do not send your case information to any artificial-intelligence provider. The software makes no calls to any large-language-model or AI service. The optional document text-recognition (OCR) feature runs entirely inside your own browser and does not transmit your documents to us or anyone else. If we ever introduce an AI-assisted feature that would process your information, we will update this policy first, minimize and where possible redact sensitive data, tell you whether a provider could retain or train on it, obtain any consent that is required, and keep our commitment not to let sensitive case data be used to train general-purpose AI models.

6. Who we share with (subprocessors)

We don’t sell your information. We use a small set of vendors that process data on our instructions to run the service - hosting, database, and (when enabled) payments. The current list is on the Subprocessor List. We may also disclose information when required by law, in connection with a merger or sale of the business (with notice), or to someone you deliberately authorize. Because you print and file your own packet, we do not transmit your information to USCIS or any government agency as part of the ordinary service.

7. No sale, no targeted advertising

We do not sell your personal information and do not share it for targeted or cross-context behavioral advertising. We do not run advertising or third-party analytics or session-replay tools on the site, so there are no such trackers to receive your questionnaire data.

8. How we protect information

• Encryption in transit: the site is served over HTTPS.
• Encryption of case content: your case answers and uploaded documents are encrypted in your browser using a key derived from a case password you choose. The unlock keys are generated and used only in your browser and are never sent to us, so we cannot ordinarily read your case content.
• What is readable by us: to operate the service, we can see your account email, name, role, case labels and status, payment records, and support messages you choose to send us - but not your encrypted case content or case-evidence documents. Support messages and approved support attachments are encrypted at rest under a separate service key because authorized support staff must be able to read and answer them.
• Access controls: administrator accounts require two-factor authentication, and no administrator tool can decrypt your case content.
• Your responsibility: keep your passwords, recovery key, and any access you grant secure. If you lose your case password and haven’t saved a recovery key, that case cannot be recovered - including by us.
• Backups & limits: our database provider keeps encrypted backups; deleted data can persist in backups on a delayed rotation. No online service can be guaranteed perfectly secure, and we don’t claim otherwise.

9. How long we keep information

We keep information only as long as we reasonably need it. In general:

• Active accounts and cases: while your account is open, so your work is there when you return.
• Cases you delete: removed from our live systems promptly; residual copies age out of backups on a delayed rotation.
• Uploaded documents and generated forms: stored (encrypted) with the case and deleted when you delete the case.
• Payment and tax records: retained as needed to meet financial and legal recordkeeping obligations.
• Security logs and consent records: retained for a limited period for security, fraud prevention, and proof of agreement.
• Support conversations: retained while needed to answer and document the request, operate billing/privacy workflows, prevent abuse, and meet legal obligations. Ordinary admin controls archive rather than permanently erase messages; verified privacy requests use a controlled deletion process.
• Deleted accounts: removed from live systems; backups purge on the rotation above.

You can delete case information or your entire account yourself in the app at any time when there’s no legal reason for us to keep it.

10. Your privacy rights

Depending on where you live and applicable law, you may have rights to access, correct, delete, or export your information, to withdraw consent, to object to or limit certain uses, and to appeal a denied request. We aim to offer these broadly. You can manage and delete your cases or account in the app; for other requests, contact us through effortlessvisa.com. We may need to verify your identity before acting, and an authorized agent may submit a request with proof of authorization. We won’t discriminate against you for exercising these rights.

11. International users and transfers

EffortlessVisa’s systems are hosted in the United States, and the service is intended for people preparing U.S. immigration filings. If you access the service from another country, your information is processed in the United States. Where the law of a region we serve requires specific transfer safeguards, we will put an appropriate mechanism in place. We do not rely on the defunct EU-U.S. Privacy Shield.

12. Children and derivative beneficiaries

Accounts are for adults. Minors may not purchase or manage the service on their own. However, because a fiancé(e) or spouse case can include a minor derivative beneficiary (for example, a K-2 child), a parent or lawful guardian may enter information about a child as part of preparing a filing. When they do, we use that child’s information only for the requested immigration-document service and related support, security, and legal purposes. A parent or lawful guardian must authorize entering a child’s information. Because we may collect information about children under 13 in this narrow way, we don’t claim never to.

13. Security incidents

If we learn of a security incident affecting your information, we will investigate it and notify regulators and affected individuals as and when applicable law requires. We don’t make a blanket promise to notify everyone within a fixed number of hours, because the right timing and recipients depend on the incident and the law.

14. Do Not Track and Global Privacy Control

Because we don’t sell or share your information for advertising and don’t run cross-site tracking, there is nothing for a “Do Not Track” or Global Privacy Control signal to opt out of. If we ever add such processing, we will honor these signals where the law requires.

15. Changes to this policy

We may update this policy. We’ll change the version and the “last updated” date, keep prior versions on file, and give notice of material changes. Continued use after a change means you accept the updated policy where that is permitted.