Privacy Policy

We collect the following when you use GetMyVisaPhoto:

• Your photo, the image you upload, which contains your facial image.
• Email address, required to deliver your finished photo and receipt.
• Name, optional, if you provide it.
• Technical data, IP address, browser/device type, and timestamps from server logs and analytics.
• Payment data, a payment token, card last-4, amount, and date (we never see your full card number).
• Order data, order ID, product, and status.
• Affiliate application data, if you apply to the partner program: name, email, the platform and link or handle where you will share, your audience size, destinations, audience region, an optional note, and the referral source. Used only to review your application.

We use your data only to provide the service:

• To process your photo into a government-compliant format (cropping, background removal, resizing, and automated compliance checks).
• To charge you for the service (via Stripe).
• To deliver your finished photo by download and email (via Resend).
• To provide support and prevent fraud and abuse.

To verify your photo meets official requirements, we send the processed image to Google's Gemini API / Vertex AI, which runs automated checks (e.g. eyes visible, no headwear, neutral expression) on servers in the United States. We use Google's paid services under the Data Processing Addendum for Products Where Google is a Data Processor. Per Google's Gemini API Additional Terms of Service, on paid services Google does not use your images or the results to train or improve its products; Google logs data only briefly to detect abuse and meet legal obligations. Google acts as our processor for this step.

We share data with the following processors. Each is bound by a data processing agreement and, for US transfers, is certified under the EU-U.S. Data Privacy Framework and/or relies on Standard Contractual Clauses:

• Cloudflare, Inc. (USA), website hosting and temporary photo storage, including object storage (Cloudflare R2).
• Hetzner Online GmbH (Germany), the hosting provider for our application servers, including server backups and snapshots.
• Google LLC (USA), automated photo compliance checks (Gemini/Vertex AI).
• Stripe, Inc. (USA), payment processing; Stripe also acts as an independent controller for fraud prevention and legal compliance under its own privacy policy.
• Resend (Plus Five Five Inc.) (USA), sending your download email.

We automatically delete your original uploaded photo within 24 hours of upload, and delete the finished photo files within 30 days. We do not keep your photograph after that. We retain your order and payment records (not your photo) for up to 6 years to meet tax and legal obligations.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these rights, including requesting deletion of your photo, contact us at contact@norshadynamics.com. We do not sell, lease, trade, or profit from your personal information, including your photo or any biometric data, and we do not "sell" or "share" your personal information as those terms are defined under the California Consumer Privacy Act (CCPA).

Our service is intended for adults. If a child's photo is submitted, it must be submitted by a consenting parent or guardian on their behalf. We do not knowingly collect personal data from children under 13.

Our processors are based in the United States. Transfers rely on each processor's EU-U.S. Data Privacy Framework certification and/or Standard Contractual Clauses. We do not run a site-wide analytics service. Microsoft Clarity provides optional heatmaps and session replay, but it is disabled by default and only activates after you explicitly opt in; photo-upload fields are masked from any recording.

When you submit a refund claim, we store the claim record and any screenshot or PDF evidence you upload. That claim evidence is retained for 60 days and then deleted.