Effective / last updated: October 7, 2026
This Privacy Policy explains how Case Studio, Inc. (“Case Studio,” “we,” “us,” or “our”), a Delaware corporation, collects, uses, shares, and protects information when you use Visa Engine, our AI-assisted petition workspace for talent and criteria-based visas (the “Service”). It is written for a real product. It is not legal advice and is not a substitute for advice from a qualified attorney about your own situation. Please read it together with our Terms of Service. We may update this policy from time to time; the date above reflects the latest version.
Visa Engine is a software product built and operated by Case Studio, Inc.. For personal accounts and for information about account holders that we process to operate the SaaS relationship (for example account, billing, and product analytics), Case Studio acts as the data controller. When a firm or other organization uses Visa Engine to process information about its clients, applicants, or other third parties on that organization's instructions, Case Studio acts as a data processor for that content, and the organization remains the controller. A draft controller–processor Data Processing Agreement and Subprocessor Schedule are published for firm customers; they remain templates pending counsel sign-off and are not yet in force as a final commercial offering until counsel approves. Case Studio also offers petition preparation and related professional services under separate arrangements; those engagements may have their own terms and privacy notices. This policy covers the Visa Engine SaaS product (the website, application, and related APIs) only.
We are not a law firm and do not provide legal advice or representation through the Service. An attorney (or other authorized legal practitioner) remains the person responsible for legal advice and filings.
For any privacy question, data request, or account deletion, contact us at akif@visaengine.app, or by mail at Case Studio, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.
EU representative (GDPR Art. 27). Case Studio is established in the United States and has not yet appointed an EU representative. Until a representative is appointed and named here, use the contact details above for GDPR-related requests.
Data Protection Officer (GDPR Art. 37). We have not designated a Data Protection Officer. Privacy matters should be sent to the contacts above while counsel completes a DPO-need assessment.
Türkiye representative (KVKK). Case Studio has not yet appointed a Türkiye-resident data controller representative. Until appointed and named here, KVKK applications may be sent to the contacts above (see also the Turkish-language notice).
Depending on how you use Visa Engine, we may collect:
We use the information above to:
Where the EU/UK General Data Protection Regulation (GDPR) or similar laws apply, we rely on these legal bases: performance of a contract (to provide the Service you request); legitimate interests (to secure, operate, and improve the Service and prevent abuse, balanced against your rights); consent (for optional analytics cookies and any optional communications, which you can withdraw at any time); and legal obligation (to meet tax, accounting, security, and other legal requirements).
We do not sell your documents or case contents, and we do not “sell” or “share” personal information as those terms are defined under U.S. state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). We do not use your uploaded documents or case content to train our own AI models.
Visa Engine is an AI-assisted product. To analyze evidence, score readiness, review narratives, generate drafts, power case chat, and similar features, we send document text, case context, chat messages, and related prompts to third-party large language model providers—currently OpenAI, and Anthropic's Claude models run by Amazon Web Services on Amazon Bedrock in AWS European Union Regions, both accessed through the Vercel AI SDK. This means sensitive immigration materials you upload or enter may leave our application database and be processed by those providers solely to return analysis or drafts for your use of the Service.
No solely-automated significant decisions. Visa Engine does not make decisions that produce legal or similarly significant effects about you or any applicant by automated means alone. All AI outputs—scores, evaluations, extracted facts, drafts, and chat answers—are informational and advisory, and are intended to be reviewed by you and, where relevant, a qualified attorney (a human “in the loop”) before any reliance or filing. AI systems can be wrong, incomplete, or misleading.
Provider handling. We configure our AI providers to process your content only to deliver the Service, and we use business/API tiers under which submitted content is not used to train the providers' general models, to the extent those terms and settings are available to us. Providers may retain limited data for a short period for abuse monitoring or as required by their terms and applicable law. Provider practices are governed by their own terms and privacy policies. On Amazon Bedrock the models run on AWS infrastructure: Anthropic does not receive your content, AWS does not use it to train models, and we do not log Bedrock requests. You should only upload materials you are authorized to share with cloud processors.
We rely on service providers (subprocessors) to operate Visa Engine. Key categories include:
These providers process data under their own privacy policies and, where applicable, data processing agreements. We use them to run the Service—not to sell your personal information. A public draft Subprocessor Schedule (and firm DPA) lists the current candidates; regions and vendor contracts remain subject to counsel verification. We may also disclose information when required by law, to enforce our Terms, to protect the rights, safety, or property of Case Studio or others, or in connection with a merger, acquisition, or sale of assets (with notice where required).
Immigration materials frequently contain sensitive personal information—for example passport and identity data, nationality and immigration status, and, in some cases, information revealing health, religion, or other special categories under the GDPR and similar laws. Where we process such information, we do so only to provide the Service you request and based on your instructions and consent, or another lawful basis where available. You are responsible for having a lawful basis to upload information about third parties (such as clients, applicants, recommenders, or family members) and for informing them as required by applicable law (including GDPR Art. 14 / KVKK aydınlatma where you are the controller). People who appear only inside uploaded documents and who do not have a Visa Engine account may contact akif@visaengine.app to make a privacy request; we may need to involve the uploading account or firm controller and to verify identity before acting. Please avoid uploading sensitive information that is not necessary for your case.
We use cookies and similar technologies that are strictly necessary to run the Service (for example, to keep you signed in and to maintain security). With your consent where required, we also use analytics and performance technologies (such as PostHog, and Google Analytics when configured) to understand aggregate usage and improve the product. PostHog may set cookies or similar identifiers for product analytics and session replay across the Service, including signed-in app pages; form inputs are masked in recordings where configured. You can control non-essential cookies through your browser settings and, where offered, our in-product controls. Disabling essential cookies may prevent the Service from working. For a list of tools and purposes, see our Cookie Policy.
You can delete documents and cases through the product (subject to in-app rules—for example, a case may need to be emptied of related content before it can be removed). When content is deleted in the product, we remove associated records from our systems as part of normal deletion flows; residual copies may persist briefly in backups or logs until those rotate.
To request deletion of your account and remaining personal data, email akif@visaengine.app. We will verify the request and delete or de-identify account data except where we must retain limited information for legal, security, or billing records (for example, transaction history Stripe may retain).
We keep personal information while your account remains active and as needed to provide the Service. If you schedule account deletion, we soft-delete the account and then hard-purge account data after 30 days (you may reactivate within that window). Production database backups are retained about 30 days; migration scratch objects about 14 days. Residual copies may persist in those backups until they rotate. Afterwards we keep information only as long as necessary for the purposes described in this policy, to resolve disputes, and to comply with legal obligations (for example Stripe billing records, PostHog analytics, OpenAI abuse-monitoring logs, and platform logs follow provider or counsel-approved schedules that are not fully enumerated here).
We use reasonable administrative, technical, and organizational measures appropriate to a cloud SaaS product—such as encrypted transport, access controls, and storage on reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach affecting your information, we will notify you and relevant authorities where required by applicable law.
Visa Engine is hosted on cloud infrastructure that may process and store data in the United States and other countries where our providers operate (including AWS, Stripe, Resend, and AI providers). If you access the Service from outside those locations, your information may be transferred across borders. Where required for transfers out of the EEA, the UK, or similar regions, we rely on appropriate safeguards available under applicable law (such as the European Commission's Standard Contractual Clauses) and our providers' terms.
Depending on where you live, you may have rights over your personal information. Where the GDPR or UK GDPR applies, these can include the rights to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local data protection supervisory authority.
Where U.S. state privacy laws apply (such as the CCPA/CPRA in California), you may have rights to know, access, correct, and delete personal information, and to opt out of any “sale” or “sharing” of personal information—although, as noted above, we do not sell or share your personal information. We will not discriminate against you for exercising these rights.
You can manage much of your case content directly in the product. For other requests, email akif@visaengine.app. We may need to verify your identity before fulfilling a request, and you may use an authorized agent where the law allows.
Visa Engine is intended for adults preparing or assisting with visa petitions. The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.
We may update this Privacy Policy as the product, our providers, or legal requirements change. When we do, we will revise the effective date above. Material changes may also be communicated in-product or by email when appropriate. Your continued use of Visa Engine after an update means you acknowledge the revised policy.
Privacy questions, data requests, and account deletion: akif@visaengine.app.
Mail: Case Studio, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.
Related: Terms of Service.