1. Introduction
Anureka Inc. ("Visacub," "we," "our," or "us") operates visacub.com and the related self-help immigration document-preparation platform (the "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. Visacub is software, not a law firm — information you share with us is protected as confidential under contract, not by the attorney–client privilege.
2. Information We Collect
- Personal information you provide: name, email, phone number, mailing address, date of birth, country of birth, citizenship, current immigration status, A-number, USCIS receipt numbers, and similar identifiers.
- Case information: facts and documents you upload to prepare your petition — passports, marriage and birth certificates, tax returns, joint financial records, photos, letters, prior USCIS filings, RFE/NOID notices, and other supporting evidence.
- Account information: login credentials (passwords are stored as salted hashes), authentication tokens, profile settings, and Service preferences.
- Payment information: processed by Stripe (see Section 4); we receive a tokenized reference, transaction status, and last-four digits — we do not store full card numbers on our systems.
- Usage and device data: IP address, browser and device identifiers, pages and features used, timestamps, referrer URLs, and error logs.
- Cookies and similar technologies: see Section 9.
3. How We Use Your Information
- Provide, maintain, and improve the Service, including generating AI drafts and form outputs from the information you supply.
- Authenticate you and secure your account.
- Process payments, issue refunds, and prevent fraud.
- Communicate with you about your account, your case progress, deadlines, USCIS-related reminders, and product updates.
- Provide customer support and respond to your inquiries.
- Analyze aggregate usage to improve features and reliability.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell your personal information. We do not use your case content to train any general-purpose AI model.
4. Sub-Processors and Third-Party Services
To operate the Service we rely on the following sub-processors. They process personal information only on our instructions and under contractual confidentiality and data-protection obligations. We update this list when we add or replace a sub-processor.
- Amazon Web Services (AWS), Inc. — cloud hosting, database storage (RDS / PostgreSQL), file storage (S3), email delivery (SES), and AI model inference (Amazon Bedrock). Region: us-east-1 (Northern Virginia, USA).
- Anthropic, PBC — large language model inference (Claude family) used to draft cover letters, organize evidence, and generate suggestions. Anthropic contractually does not train its models on Visacub API inputs or outputs.
- Google LLC — large language model inference (Gemini family) used for the same purposes as above. Google contractually does not train its models on Visacub API inputs or outputs.
- Stripe, Inc. — payment processing, billing, and refunds. Stripe handles full payment-card data under PCI-DSS Level 1; we do not see or store full card numbers.
- Vercel / CloudFront / Route 53 — content delivery, DNS, and edge networking.
- Email delivery providers — transactional and notification email.
- Analytics providers — privacy-preserving product analytics for aggregate usage trends.
Personal information may be transferred to and processed in the United States and other countries where our sub-processors operate. Data-center primary region is AWS us-east-1.
5. How We Protect Your Data
- Encryption in transit (TLS 1.2+) and at rest (AES-256) for stored files and database fields containing personal information.
- Hosted on SOC 2-audited Amazon Web Services infrastructure. Visacub itself follows industry-standard security practices but has not completed its own SOC 2 audit at this time; we will update this page when that changes.
- Role-based access control; only authorized personnel can access production data, and access is logged.
- Regular dependency updates, automated security scanning, and a published vulnerability-reporting channel (see Section 14).
- Background backups and disaster-recovery procedures.
No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to maintain reasonable safeguards proportionate to the sensitivity of immigration data.
6. How We Share Your Information
We do not sell your personal information. We share it only as follows:
- Sub-processors listed in Section 4, solely to operate the Service.
- Government agencies only if you choose to submit your petition (your I-130, I-485, I-140, etc.) — the act of filing transmits your information to USCIS or another agency. Visacub does not file on your behalf.
- Legal requirements — when required by law, subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Visacub, our users, or the public.
- Business transfers — in connection with a merger, acquisition, financing, or sale of assets, in which case the acquirer must honor this Privacy Policy or provide equivalent protection.
- With your direction — if you ask us to export your case file or send your data to a third party (e.g., an attorney you independently retained).
7. Data Retention
We retain personal information only as long as needed for the purposes described in this Policy, unless a longer retention period is required by law (for example, tax records). Specifically:
- Active accounts: for the duration of your account, plus a reasonable wind-down period after closure.
- Case files (uploaded documents and generated drafts): 24 months after the case is marked complete or your account is closed, then deleted, unless you request earlier deletion or longer retention.
- Payment and billing records: at least 7 years, to comply with U.S. tax and accounting requirements.
- Account profile and authentication data: deleted within 30 days of account closure (except minimum data needed to prevent re-registration abuse).
- Backups: rolling backups are overwritten within 35 days.
- Logs and analytics: retained up to 12 months in identifiable form, then aggregated or deleted.
You may request earlier deletion at any time as described in Section 8.
8. Your Privacy Rights
Depending on where you live, you may have the right to:
- Access and receive a copy of your personal information.
- Correct inaccurate or incomplete personal information.
- Delete your personal information, subject to legal retention requirements.
- Restrict or object to certain processing.
- Portability — receive your data in a portable format.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with your data-protection authority.
To exercise any of these rights, contact us through our contact form from the email associated with your account. We will respond within the time required by applicable law (generally 30–45 days). We will not discriminate against you for exercising your rights.
9. Cookies and Similar Technologies
We use the following categories of cookies and similar technologies:
- Strictly necessary — required for the Service to function (authentication, session security, load balancing, CSRF protection). These cannot be disabled.
- Functional — remember your preferences (language, locale, UI settings).
- Analytics — help us understand how the Service is used in aggregate, so we can improve it.
We do not use cross-site advertising or third-party marketing trackers. You can manage cookies through your browser settings; disabling strictly-necessary cookies will break parts of the Service.
10. California Privacy Rights (CCPA / CPRA)
California residents have additional rights under the California Consumer Privacy Act (as amended by the CPRA), including the right to know, the right to delete, the right to correct, the right to limit use of sensitive personal information, the right to opt out of sale or sharing, and the right not to be retaliated against for exercising these rights.
Visacub does not sell personal information and does notshare personal information for cross-context behavioral advertising as those terms are defined under the CCPA / CPRA. Some of the information you provide to use the Service (e.g., A-number, country of birth, immigration status) is "sensitive personal information" under the CCPA / CPRA; we use it only to provide the Service you requested.
To exercise your California rights, submit a request through the same channel described in Section 8. We may need to verify your identity before fulfilling certain requests.
11. EEA, UK, and Swiss Users (GDPR / UK GDPR)
If you are in the European Economic Area, the United Kingdom, or Switzerland, Anureka Inc. is the controller of your personal information for purposes of the GDPR / UK GDPR. Our legal bases for processing are: (a) contract — processing necessary to provide the Service you requested; (b) legitimate interests — securing the Service, preventing fraud, and improving the product; (c) legal obligation — tax and recordkeeping; and (d) consent — where required (e.g., certain cookies).
When personal information is transferred from the EEA, UK, or Switzerland to the United States or other countries that do not have an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum, with our sub-processors. You may request a copy of those mechanisms from privacy@visacub.com.
You have the right to lodge a complaint with your local data-protection authority.
12. Children
The Service is intended only for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Material changes will be highlighted or sent to you by email at least 30 days before they take effect.
14. Contact
Questions about this Privacy Policy or our privacy practices?