What we hold, where it goes, and how to get it back.

Your agency is the controller. Every student record, document, counselling note, consent record and commission line in your workspace is yours. You decide what is collected, why, who sees it and how long it is kept. A student asking about their own data asks you.

Visatory is the processor. We hold that data because we run the software it lives in. We do not sell it, we do not use it to train models, and we do not use one agency's records to do anything for another agency.

Each workspace gets its own database rather than a row in a shared table. That is an engineering decision with a privacy consequence: an export is a whole database, a deletion is a whole database, and a query written against the wrong agency has nowhere to land.

Separately from your workspace, we hold what running a business with you requires: the name and email address of the people who sign in, your agency name and country, your subscription and invoice history, your credit ledger, and the messages you send us. For that much, we are the controller.

Named, with what each one actually receives. This is the current list; when it changes, this page changes with it.

• VercelHosting and the content network. Every request to the product passes through it, so it processes what is in that request while it is in transit.
• TursoThe databases, including your workspace. This is where data sits at rest.
• ResendOutbound email: sign-in codes, notifications, and the campaigns you send. Receives the address and the message.
• PaddlePayments. Paddle is the merchant of record and takes card details directly, so Visatory never sees a card number.
• SentryError reporting.
• UnsplashCover photographs on this site and in the agency website templates. The images are loaded from Unsplash, so a visitor's browser makes a request to them.
• GoogleGoogle Analytics, on visatory.com only and never inside a workspace. It records which marketing pages are read and roughly where from. Nothing an agency puts into the product reaches it, because the tag is not loaded on any page that holds one.

Sentry is configured not to receive request bodies, not to receive user identifiers, and not to receive IP addresses. Session replay is not enabled at all. An error raised on a student form tells us the file and the line, not what was typed into the field. That costs us debugging context, and it was a deliberate trade.

Inside a workspace you set the retention window, and it runs from the last activity on a file rather than from the day the file was created. The product refuses to delete a record still inside its window and tells you the date it becomes eligible. Records you keep because a reviewer may ask for them are yours to keep; we do not expire them for you.

The records pack is the way data leaves: pick a period and it builds student files, agreements, disclosures, complaints, surveys and training into one file you can read without us. It is built in the background rather than handed over on the spot, it is capped at one a quarter on Starter, and it works on the last day of a trial exactly as it works on the first. There is no general workspace export yet, and no exit fee.

Ask on support@visatory.com and the workspace database is deleted, along with the documents stored against it, and we tell you when it is done. Backups held by our hosting and database providers expire on their own schedule; they are not searched for individual records.

The workspace goes read-only. It is not deleted. Every record is still readable and still exportable, because deleting an agency's student files over an unpaid invoice would be indefensible when those files are the evidence a review asks to see.

A student asking for a copy of their file, or asking for it to be erased, asks their agency - and you can answer both from inside the product. Where a request covers something only we hold, write to support@visatory.com and we will act on it and tell you what was done.

Material changes are announced in the changelog and by email to workspace owners before they take effect. The date at the top is the date this text last changed.

No statutory Data Protection Officer is appointed. Article 37 requires one for a public authority, for large-scale systematic monitoring, or for large-scale processing of special category data, and this is none of those - passports and financial evidence are sensitive but are not Article 9 categories. Writing the title on a page without the independence and reporting lines behind it would be worse than not using it. Data protection correspondence goes to office@vnisgroup.com, and it is read.

support@visatory.com for anything about data in a workspace. office@vnisgroup.com reaches VNIS Vietnam Company Limited, the company behind Visatory.