Privacy Policy
Last Updated & Effective Date: September 2026 • Version 2.4
Our Privacy Commitment
VisaFlow provides recruitment, education, travel, and pilgrimage agencies with an all-in-one Customer Relationship Management (CRM) and Enterprise Resource Planning (ERP) platform. We respect the privacy of agency clients, their counselors, and individual applicants/candidates whose inquiries are managed through our service.
Crucial Promise: VisaFlow never sells, rents, monetizes, or shares Meta user data or applicant records with third-party advertisers or data brokers. All data is strictly isolated to the authorized agency's secure workspace.
1. Information We Collect
We collect information in three primary categories to operate our agency automation services:
A. Agency Account & Staff Information
When an agency creates an account, we collect business contact details, admin and staff names, professional email addresses, phone numbers, agency licenses, and subscription billing details.
B. Meta Platform Data (Facebook, Messenger & WhatsApp)
When an authorized agency connects its Facebook Page or WhatsApp Business account to VisaFlow via Meta APIs, we process data strictly to provide CRM lead automation:
- Facebook Lead Ads Data: Candidate responses submitted via Instant Lead Forms, including full name, telephone/mobile number, email address, preferred destination country, trade/profession, and form metadata (via
leads_retrieval). - Facebook Page Information: Page name, Page ID, category, and permissions required to route leads to the correct agency department (via
pages_show_list,pages_read_engagement, andpages_manage_metadata). - Messenger & WhatsApp Inquiries: Inbound message text, message timestamps, Page-Scoped IDs (PSID), WhatsApp sender phone numbers, and profile display names (via
pages_messagingandwhatsapp_business_messaging). - Ad Referral Metadata: Campaign name, Ad ID, Ad headline, and Click-to-WhatsApp or Click-to-Messenger identifiers (
ctwa_clid, referral tokens) to attribute marketing effectiveness.
C. Applicant & Operational Processing Data
Information submitted by prospective passengers, students, or pilgrims for visa processing, including passport details, educational records, medical test statuses, embassy clearances, and booking references. The agency acts as the Data Controller for this operational data.
2. How We Use Collected Information
All information, including Meta platform data, is processed exclusively for the legitimate operational purposes of the subscribing agency:
- Lead Ingestion & Management: Automatically receiving prospective candidate inquiries from Facebook Lead Ads, Messenger, and WhatsApp into the agency’s secure CRM inbox.
- Customer Communication: Enabling authorized agency counselors to review inquiries, provide counseling, and respond to applicant messages directly.
- Smart Operational Routing: Auto-categorizing inquiries into the agency's appropriate operational vertical (Manpower, Study Abroad, Travel & Tours, or Hajj & Umrah).
- Deduplication: Preventing duplicate files for the same applicant across multiple inquiries to maintain data accuracy.
- Security & Authentication: Verifying agency staff identities and protecting accounts from unauthorized access.
3. Strict Prohibition on Selling or Sharing Meta User Data
Zero Data Monetization Guarantee
In strict compliance with Meta Platform Terms (Section 4) and developer policies:
- We NEVER sell, rent, lease, monetize, or trade any personal data or Meta user data.
- We NEVER transfer Meta user data to any third-party data broker, ad network, advertising exchange, or credit agency.
- We NEVER use Meta user data to build user profiles for cross-app retargeting or surveillance.
- Meta user data retrieved on behalf of an agency is accessible only to authorized staff of that specific agency workspace.
4. Data Security & Multi-Tenant Isolation
We implement robust technical, administrative, and physical safeguards to protect all stored information:
- Row-Level Security (RLS): Multi-tenant isolation at the database layer ensures that no agency can ever query, access, or view another agency’s candidate records or Meta tokens.
- Encryption in Transit: All data transmitted between browsers, Meta servers, and VisaFlow APIs is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at Rest: All database stores, credentials, and authentication tokens are encrypted at rest using AES-256 standards.
- Access Controls: Role-based access control (RBAC) ensures only designated agency team members can view lead contacts.
5. Data Retention Policy
We retain personal information and Meta platform data only for as long as necessary to fulfill the operational purposes described in this policy:
- Active agency customer and candidate records are retained for the duration of the agency's active subscription.
- Agencies may archive or permanently delete individual candidate cards at any time via the CRM interface.
- Upon agency account termination or cancellation, all associated leads, customer files, and Meta integration tokens are permanently purged from our primary databases within 30 days.
6. User Data Deletion Instructions (Facebook & Meta Data)
VisaFlow respects your right to control your personal information. In accordance with Meta Platform policies, any user or applicant whose data was retrieved via Facebook Lead Ads, Facebook Page Messenger, or WhatsApp may request the complete deletion of their data at any time using either of the following methods:
Method 1: Direct Email Request (Fastest)Processed within 48h
You can submit an immediate data deletion request directly to our Data Protection Team:
- Send an email to privacy@visaflow.com or support@visaflow.com.
- Use the subject line:
Meta User Data Deletion Request. - Include your full name, the phone number or email address associated with your inquiry, or your Facebook profile URL / Page you messaged.
- Our team will locate your record, permanently purge all personal information, contact numbers, and message logs from our CRM systems, and send you an official confirmation within 48 hours (maximum 30 days statutory window).
Method 2: Remove VisaFlow Access via Facebook Settings
If you interacted with a VisaFlow-powered agency through Facebook, you can manage and revoke app permissions directly:
- Log into your Facebook account and navigate to Settings & Privacy ➔ Settings.
- In the left sidebar, click Apps and Websites.
- Find VisaFlow Platform in your list of connected applications.
- Click Remove to disconnect the app.
- Click View Details under the removed app and click Send Request to automatically submit a Meta Data Deletion callback to VisaFlow.
7. Individual Rights (GDPR & Global Privacy Laws)
Depending on your geographical jurisdiction, you possess the following statutory rights regarding your personal data:
- Right to Access: Request a copy of the personal information we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete contact records.
- Right to Erasure ("Right to be Forgotten"): Request complete deletion of your records as detailed in Section 6.
- Right to Restrict Processing: Request limits on how your personal data is utilized.
- Right to Data Portability: Obtain your data in a structured, commonly used machine-readable format.
8. Changes to this Privacy Policy
We may update our Privacy Policy from time to time to reflect evolving regulatory frameworks or platform capabilities. Any updates will be posted directly on this page with an updated effective date. We encourage users and agency partners to review this page periodically.
9. Contact Us & Data Protection Officer
For any questions regarding this Privacy Policy, your rights, or data protection practices, please contact our dedicated Data Protection Officer:
Platform: VisaFlow Platform (ERP & Agency SaaS)
Data Protection Officer: Privacy & Compliance Team
Official Email: privacy@visaflow.com
Support Desk: support@visaflow.com