24-Hour Zero-Retention Data Policy

1. Tiered Zero-Retention Architecture (Encrypted Cloud Vault)

ApprovaVisa operates under an unconditional zero-retention architecture powered by private encrypted cloud object storage with automated hardware-level lifecycle rules:

• Standard Plan (24-Hour Purge): All images, biometric coordinates, and print sheets submitted to our engine are automatically and permanently purged from encrypted storage within 24 hours of generation.
• Premium Plan (7-Day Vault): For users who order the Expert Certified package, files are retained in an encrypted private vault for 7 days to enable specialist verification, consular PDF certificate generation, and cross-device re-downloads before being irreversibly deleted.

2. Zero Account & Cryptographic Session Security

We do not require users to create accounts, store passwords, or link personal identities. Transactions and file downloads are authenticated exclusively through cryptographically signed, tamper-proof HMAC-SHA256 session tokens. Download sessions automatically expire matching your plan's retention period (24 hours for Standard, 7 days for Premium), after which all access is permanently sealed.

3. Encryption & Transmission Security

All data transmission between your browser and our validation engine is encrypted using industry-standard TLS 1.3 with 256-bit SSL encryption. We never sell, license, share, or use your facial photography for AI model training or third-party behavioral profiling.

4. Payment Processing

All financial transactions are handled securely by Razorpay. ApprovaVisa does not collect, process, or store credit card numbers, CVVs, or banking credentials.

5. Optional Analytics and Session Recordings

Analytics notice updated: September 5, 2026.

With your consent, we use Google Analytics 4 to measure visits and selected usage events, and Microsoft Clarity to understand interactions through heatmaps and session recordings on selected public pages. These services can process device and browser information, network information such as IP addresses, and cookie identifiers under their respective privacy policies. Advertising storage and personalization are disabled in our integration.

Clarity is excluded from the studio, photo tools, and pages with URL parameters. Our custom Google Analytics events do not include uploaded photos, facial measurements, email addresses, payment identifiers, filenames, or download tokens. Analytics URLs exclude query strings and fragments. Analytics records have separate retention settings from the photo deletion periods described above.

Optional tags load only after you accept analytics. Rejecting them does not prevent you from using our photo service. Your choice is stored in your browser for up to 180 days. You can withdraw consent through Cookie preferences in the footer; this stops future collection and removes our first-party analytics cookies. Withdrawal does not erase records already collected. If you accept again after withdrawing, Clarity resumes on the next eligible full page visit.

Learn more in Google’s Privacy Policy and Microsoft’s Privacy Statement.