What we hold, where it goes, and how to get it back.

Your agency is the controller. Every student record, document, counselling note, consent record and commission line in your workspace is yours. You decide what is collected, why, who sees it and how long it is kept. A student asking about their own data asks you.

Visatory is the processor. We hold that data because we run the software it lives in. We do not sell it, we do not use it to train models, and we do not use one agency's records to do anything for another agency.

Each workspace gets its own database rather than a row in a shared table. That is an engineering decision with a privacy consequence: an export is a whole database, a deletion is a whole database, and a query written against the wrong agency has nowhere to land.

Separately from your workspace, we hold what running a business with you requires: the name and email address of the people who sign in, your agency name and country, your subscription and invoice history, your credit ledger, and the messages you send us. For that much, we are the controller.

Named, with what each one actually receives. This is the current list; when it changes, this page changes with it.

• VercelHosting and the content network. Every request to the product passes through it, so it processes what is in that request while it is in transit.
• TursoThe databases, including your workspace. This is where data sits at rest.
• ResendOutbound email: sign-in codes, notifications, and the campaigns you send. Receives the address and the message.
• AnthropicThe AI counsellor. Receives the text of a counselling or essay-feedback session at the moment one is run, and nothing else.
• PaddlePayments. Paddle is the merchant of record and takes card details directly, so Visatory never sees a card number.
• AiraloeSIM fulfilment. Receives an order when you buy a data package, and not otherwise.
• SentryError reporting.
• UnsplashCover photographs on this site and in the agency website templates. The images are loaded from Unsplash, so a visitor's browser makes a request to them.

Sentry is configured not to receive request bodies, not to receive user identifiers, and not to receive IP addresses. Session replay is not enabled at all. An error raised on a student form tells us the file and the line, not what was typed into the field. That costs us debugging context, and it was a deliberate trade.

Inside a workspace you set the retention window, and it runs from the last activity on a file rather than from the day the file was created. The product refuses to delete a record still inside its window and tells you the date it becomes eligible. Records you keep because a reviewer may ask for them are yours to keep; we do not expire them for you.

Your data leaves in a form you can read, whenever you want, without asking us. It is a feature rather than a request form, and it works on the last day of a trial exactly as it works on the first.

Ask on support@visatory.com and the workspace database is deleted, along with the documents stored against it, and we tell you when it is done. Backups held by our hosting and database providers expire on their own schedule; they are not searched for individual records.

The workspace goes read-only. It is not deleted. Every record is still readable and still exportable, because deleting an agency's student files over an unpaid invoice would be indefensible when those files are the evidence a review asks to see.

A student asking for a copy of their file, or asking for it to be erased, asks their agency — and you can answer both from inside the product. Where a request covers something only we hold, write to support@visatory.com and we will act on it and tell you what was done.

Material changes are announced in the changelog and by email to workspace owners before they take effect. The date at the top is the date this text last changed.

support@visatory.com for anything about data in a workspace. office@vnisgroup.com reaches VNIS Vietnam Company Limited, the company behind Visatory.