KinVisaKinVisa

Privacy Policy

In force for KinVisa 0.2.0 and later. Published September 10, 2026, updated October 12, 2026.

This Privacy Policy explains how we ("KinVisa," "we," "us," or "our") collect, use, store, and share information when you use the KinVisa Relationship Photo Documents desktop application and its related services.

KinVisa is operated by Muhammad Momin Babar, a sole proprietor based in Pakistan, trading as KinVisa, who is responsible for the information described in this policy. A postal address is available on request from [email protected].

KinVisa is a desktop-first application for preparing relationship evidence PDF documents from photos and related case information. Its core workflows - photo labelling, face recognition, captioning, PDF generation, and project history - run entirely on your device.

This policy applies to KinVisa 0.1.21 and later. Two things change in that release, and both matter here.

First, the desktop app requires an account. You sign in with your email address, using a link we email to you, and the app does not open its workflow without a signed-in session. Section 1.7 describes what that account holds.

Second, saving a finished PDF spends a credit held by that account. Section 1.4 describes the records behind that.

The licensing subsystem described in earlier versions of this policy has been removed from the app entirely. Nothing in the product contacts a licensing service, and no license key is stored on your device.

From KinVisa 0.2.0, two further things change. Face detection and recognition use open-source models that are included in the app, so nothing is downloaded for them (Section 3.8). And error logs and bug-report log attachments are screened before they leave your device, so file paths, account names, and email addresses in them are replaced with placeholders (Sections 3.2 and 3.6). Earlier versions sent those logs unscreened and downloaded a face-recognition model on first use. You can also now choose not to attach logs to a bug report (Section 3.6).

Several parts of the app contact the internet automatically and cannot be switched off; Section 6.6 lists them.

1. Information the App Handles

Information that stays on your computer and is not intentionally sent to us. We do not receive or store it, and have no way to reach it, except that an error-level diagnostic log may incidentally contain a limited fragment of user-entered or file-related text as described in Section 3.2:

  • the photos you upload, and the PDF files the app generates;
  • the project content you type, such as the applicant name, case title, and section names and descriptions, and any dates you give a section;
  • face labels and face-matching data, described in Section 1.2;
  • your saved project files, described in Section 2.1;
  • app logs other than error-level ones, described in Section 1.3, except where you attach them to a bug report as described in Section 3.6.

Information that is sent off your computer:

  • statistics about the PDFs you generate, but never a PDF itself and never anything in one, described in Section 3.1;
  • device details, described in Section 1.3;
  • approximate country and city, and your IP address, described in Section 1.5;
  • error-level app logs, described in Section 3.2;
  • the name, email address, and message you submit through the in-app contact form, any recent app logs the app attaches to a bug report, and any message you submit through the website's good-vibes form, described in Section 3.6;
  • the email address you sign in with, and the account record built from it, described in Section 1.7;
  • your credit balance, credit ledger, and PDF export and unlock records, described in Section 1.4;
  • a one-way content fingerprint for each PDF you export, described in Section 1.4;
  • page views and basic browser details while you browse the KinVisa website, described in Section 3.7. This one is the website's, not the app's.

1.1 Case and document information

As you use the document workflow, the app may process and store:

  • the applicant name and case title;
  • section names and descriptions, and any dates you give a section;
  • uploaded images and their file metadata, such as filename, file type, and last-modified date;
  • face labels you enter, including names, relationship labels, and whether a person is the applicant;
  • detected face boxes, recognition status, match-confidence values, and any related review edits;
  • generated PDF files and their metadata, such as page count, image count, event count, file size, and generation time.

Except for the PDF metadata in the last bullet, which is sent as described in Section 3.1, the information above stays on your device and is not intentionally sent to us. We hold no copy of it, subject only to the limited diagnostic-log exception described in Section 3.2.

1.2 Face recognition and biometric information

KinVisa uses face detection and recognition to help identify the same people across the photos you upload. When you label a face, the app stores matching data on your device so it can recognise that person in future photos.

This face-matching data may be considered biometric or sensitive personal information under some privacy laws.

It is created on your device and never leaves it. We do not receive it, do not store it, and have no way to access it.

That is a property of how the app is built, not a promise about how we behave. Your face data cannot be used by us for advertising, profiling, identity verification, or training AI models, because we never have it in the first place. Face detection and recognition run entirely on your own computer, using model files stored there; no photo or face measurement is uploaded for processing. The models are open-source software published by third parties; the app lists them, with their licences, under Settings > About.

1.3 Device and usage information

The desktop app creates records on your device containing:

  • a randomly generated install ID;
  • a hashed machine fingerprint;
  • the operating system platform, device architecture, device hostname, and app version;
  • PDF generation records, including generation time, project ID, PDF size, page count, event count, and image count;
  • app logs, including timestamp, severity, scope, message, details, context, and sync status.

Some of this is sent to us. The device details and the PDF generation records are synced to a cloud service, as set out in Section 3.1. Of the app logs, only error-level entries are sent, as set out in Section 3.2; the rest stay on your device.

The device details and PDF-generation records do not include your photos, your PDFs, your face data, or anything you have typed into a project. They record that a PDF was made and what shape it was, not what was in it. Error-level logs are different: as explained in Section 3.2, they may incidentally contain a limited fragment of user-entered or file-related text.

One thing did change when accounts arrived, and it is worth stating plainly. These records used to stand alone, identified only by an install ID and a hashed fingerprint. They are now attached to the account signed in on that device, so they are linked to the email address you signed in with rather than to an installation on its own.

1.4 Credits, exports, and unlocks

Saving a finished PDF spends one credit from your account. A document your account has already paid for stays unlocked, so rebuilding, previewing, or saving that same document again is free. Editing it produces a different document, which is a separate unlock.

To run that, our cloud service stores:

  • your current credit balance;
  • a credit ledger: one permanent, unchangeable row for every movement in that balance, recording the amount, the reason, the resulting balance, and the time;
  • a record of each PDF export you request, with its status and timestamps;
  • an unlock record for each document your account has paid to save.

The last three each carry a content hash. That hash is a one-way fingerprint calculated on your device from the document's title, its section names, descriptions, and any dates, its captions, and the photos it contains. It is what lets the app recognise that a document you are saving again is one you have already paid for, without us holding the document.

A one-way fingerprint cannot be turned back into what produced it. It does not let us read, reconstruct, or infer the contents of your document, and the document itself is never sent to us. What we can tell from it is that some document was exported twice - not what was in it.

You can buy one-time credit packs through Polar Software, Inc. ("Polar"), our payment provider and Merchant of Record. We send Polar your account identifier as an external customer ID and the email address used for your receipt. Polar collects and processes the payment card, billing address, tax, and other checkout information under its own privacy policy; KinVisa does not receive or store your full card details. We retain limited purchase facts such as the package, amount, currency, provider order ID, payment status, and timestamps so we can grant credits, reconcile payments, handle refunds and disputes, and keep financial records.

For each purchase, we also record which versions of the Terms of Use and Refund Policy you agreed to at checkout, and when. Once the purchase is complete, we email you a confirmation setting out the pack, the amount, the order number, and the agreement you gave at checkout, so you have your own record of what was agreed.

1.5 Approximate location and IP address

The app works out an approximate country and city by asking a location-lookup service about your network IP address. That service receives your IP address in order to answer. This happens once each time the app starts, and Section 3.5 describes the request itself.

KinVisa stores the returned country and city in its local stats record and syncs those fields to a cloud service. Your IP address itself is not stored on your device.

The cloud service also records the IP address your app connects from. An IP address is part of any internet connection your computer makes - it is how a response finds its way back to you - so it is visible to the service whenever the app contacts it.

We use approximate country and city to understand broad regional usage and to support the product. We use the recorded IP address for security and abuse prevention.

KinVisa does not collect GPS coordinates or any precise location data from your device.

1.6 Support requests, suggestions, and website messages

This is one of the items Section 1 lists as leaving your device. If you use the in-app contact form to send a support request or a suggestion, we receive and store:

  • the name you enter;
  • the email address you enter;
  • the message you write;
  • for a bug report, a copy of the app's recent log entries from your device, unless you untick the option to attach them.

The log attachment applies to bug reports only. A suggestion carries nothing beyond the three items above it. Section 3.6 describes what those logs contain and why they are attached.

We keep these so we can read your message, reply to you, and refer back to it if you contact us again. Section 3.6 describes what is sent and what it is linked to, Section 7 how long we keep it, and Section 6.5 how to ask for it to be deleted.

Your email address is also saved on your device so the form can pre-fill it the next time you use it.

The KinVisa website also includes an optional good-vibes form. If you submit it, we receive and store the message you write. That form does not ask for your name or email address and is not linked to your desktop install ID or machine fingerprint.

1.7 Your account

The desktop app requires an account. There is no way to reach the workflow without signing in.

Signing in works by email link. You enter your email address, we send a single-use link to that address, and opening the link on the same computer signs the app in. There is no password, so we never hold one. Signing in for the first time with an address we have not seen creates the account.

The account record holds:

  • your email address;
  • an account identifier;
  • when the account was created, when it was last updated, and when you last signed in;
  • the sign-in method, which is email for every account;
  • which versions of the Terms of Use and Privacy Policy you accepted in the app, when, and the app version and install ID you accepted them from.

We keep that acceptance record to show what you agreed to. It is deleted with your account.

The account also links to the devices you have signed in on, recording for each one the install ID, hashed machine fingerprint, platform, device architecture, device name, and app version described in Section 1.3.

Two fields for a display name and a profile picture exist in the account record because the app was first built against a different sign-in method. Email sign-in supplies neither, so for accounts created this way they are empty, and nothing in the app asks you for either.

If you change your account email address from the Settings screen, we send a confirmation link to both the old and the new address, and we email the old address once the change has taken effect.

Your credit balance, your ledger, and your unlocked documents belong to this account rather than to a device, which is what lets you sign in on a second computer and still have them.

2. What Is Stored on Your Device

This section describes where things live on your device. Some of them are also sent to us, as the lists at the start of Section 1 set out - being stored locally and being sent are not alternatives. Anything those lists do not mark as sent exists nowhere but your computer.

2.1 Local project storage

Saved projects are stored on your device. A saved project can include project details, section and applicant information, uploaded images, face-label information, review edits, and generated PDF exports.

These files stay on your computer. They are never uploaded to us.

Since accounts arrived, each signed-in account keeps its own folder on the device. Projects, in-progress exports, statistics, app logs, and the face data described in Section 2.2 all live inside the folder for the account that created them, so two people signing in on the same computer do not see each other's work or each other's saved people. Anything saved on that computer before accounts existed is moved into the folder of the first account to sign in there.

2.2 Local face data

Face labels and face-matching data are stored on your device. Face memory is shared across projects belonging to one account on that device, rather than limited to a single project. It is not shared between accounts; as Section 2.1 describes, each account has its own folder.

We never receive this data. Deleting it is entirely within your control, using the reset described in Section 6.2.

2.3 Stats, logs, sign-in session, and install identity

The app stores the following records on your device:

  • an install ID;
  • device and PDF-generation statistics;
  • app logs;
  • your sign-in session, so you do not have to request a new email link every time you open the app;
  • the content fingerprint of each PDF you have exported, kept alongside that PDF in your project history, so the app can tell an already-paid document without asking the cloud service.

The sign-in session includes the tokens that keep you signed in. They are encrypted with the operating system's protected storage where the operating system provides it, and the app does not keep them in ordinary browser storage. Signing out clears them.

2.4 Cookies and browser storage on the website

This subsection is about the KinVisa website rather than the desktop app.

The website keeps two things in your browser, and both are settings you chose yourself:

  • whether you picked the light or the dark theme, so the page does not change appearance on your next visit;
  • which boxes you have ticked on a visa document checklist, so your place in a long list is still there when you come back.

Both are stored by your browser on your own computer. Neither is sent to us, neither identifies you, and neither is used to follow you between sites. Clearing your browsing data removes them, and the site works normally without them - it simply forgets the theme and the ticks.

The website sets no advertising or tracking cookies, and the analytics described in Section 3.7 sets no cookies at all. That is why you are not asked to accept cookies when you arrive: there is nothing to consent to beyond the two preferences above, which exist only because you asked for them.

The only cookies the website sets are on the private administrator area at /admin, which is for us rather than for visitors. They hold a sign-in session and are set only after an administrator signs in.

Buying credits happens at a checkout run by Polar, on Polar's own website. What Polar stores in your browser there is governed by Polar's privacy policy, not this one.

3. What Leaves Your Device

The app does not intentionally send your uploaded photos, generated PDFs, face-matching data, face labels, applicant details, section descriptions, or project files to us. There is no feature or setting that transmits this content as part of the app's normal workflow.

There is one limited exception worth naming plainly: an automatically generated error report can incidentally include a fragment of something you typed or named, such as a filename. That is a side effect of how crash diagnostics work, not a feature that transmits your project content. Section 3.2 describes it in full.

Cloud stats sync, remote error logging, the update service, and the location lookup (Sections 3.1, 3.2, 3.4, and 3.5) are a standard, always-active part of the app in packaged builds and run automatically - they are not user-configurable. Website analytics (Section 3.7) is a property of the website rather than the app, and loads only while you are browsing it. Sign-in and the credit checks behind saving a PDF (Section 3.3) contact our cloud service whenever you sign in and whenever you save a document. Support requests, suggestions, and website good-vibes messages (Section 3.6) are sent only when you choose to submit the relevant form.

3.1 Cloud stats sync

The app sends device and PDF-generation statistics to a cloud service on launch, after you generate a PDF, and periodically while the app remains open. This sync runs automatically and cannot be turned off from within the app. If your device is offline, the sync attempt fails in the background and is retried once connectivity is available. You may briefly see a notification when this happens; unsynced records remain queued locally in the meantime. Synced fields can include:

  • the device details and PDF generation records listed in Section 1.3;
  • country and city, if available;
  • the IP address the app connects from;
  • first-seen and last-seen timestamps;
  • limited metadata such as tracked time, app version, and PDF size in megabytes.

We use this sync to understand installation counts, platform usage, app-version adoption, and PDF-generation volume, so we can maintain the product, prioritise support, and diagnose release issues.

3.2 Remote error logs

Error-level logs are sent to a cloud service as a standard part of the app's operation and cannot be turned off from within the app. This includes logs from the app itself, from its local backend process, and from network requests made by the app. Remote error-log records can include:

  • log ID;
  • timestamp;
  • log level, scope, message, details, and context;
  • platform and app version;
  • install ID and hashed machine fingerprint;
  • a linked remote user/device record.

Error details are automatically generated by the app when a runtime error occurs, and typically contain technical diagnostics such as stack traces, exception messages, or operational context. Before an error log leaves your device, the app screens it: the account name in any file path, the folder and file names of your photos, projects, and exported documents, and any email address are replaced with placeholders. Paths to the app's own program files are kept, minus the account name, because they are what makes an error report useful. Screening removes most of what an error log could otherwise carry, but it cannot catch everything - for example, a name you typed that appears in an error message other than as part of a file path. Error logs are not deliberately used to capture applicant names, section descriptions, or other project content, but we cannot guarantee they never incidentally contain fragments of user-entered text.

We use remote error logs to diagnose crashes, sync failures, sign-in and credit failures, update failures, and other app runtime problems. They exist for technical troubleshooting, not to deliberately review your project content.

3.3 Sign-in and credits

The app contacts our cloud service to sign you in and to run the credit checks behind saving a PDF. There is no way to use the app without this: it is the one part of the product that has to reach the internet before the workflow will open at all.

Signing in sends:

  • the email address you enter, so the sign-in link can be emailed to it;
  • the sign-in link's single-use token when you open it, which is exchanged for a session.

Once signed in, the app sends, on your behalf and identified by your session rather than by your device:

  • the install ID, hashed machine fingerprint, platform, device architecture, device name, and app version of the computer you are signing in on, so the account records the devices it has been used from;
  • when you save a PDF, the content hash described in Section 1.4 and an export request identifier, so the service can decide whether that document is already unlocked and whether a credit should be spent.

What the app does not send at any point in this exchange is the document. The PDF is built on your computer, and the service is asked a question about a fingerprint of it, never given the thing itself.

An email delivery service handles the sign-in link, the email-change confirmations, the notice sent to your old address after an email change, and the purchase confirmation described in Section 1.4. It receives the address the message is being sent to, and for a purchase confirmation, the pack, amount, order number, and the agreement you gave at checkout.

3.4 Update service

In packaged builds, the app checks for updates automatically at startup. This cannot be turned off from within the app. Update checks may disclose ordinary network information to the update host, such as IP address, app version, operating system, and request metadata.

When an update is available the app downloads it in the background, and installs it by restarting itself. It will not do this while you have work open - if you are part-way through a project, the update waits and installs the next time you close the app.

3.5 Location lookup services

Once each time the app starts, it contacts a location-lookup service to obtain an approximate country and city. The result is reused for the rest of that session rather than requested again. Those services receive your IP address as part of the request and may process it under their own privacy policies.

This lookup is used only for approximate regional statistics and troubleshooting - never for advertising, precise tracking, or determining the contents of your projects.

3.6 Support requests, suggestions, and website messages

If you choose to send a support request or a suggestion through the in-app contact form, the name, email address, and message you enter are sent to a cloud service and stored there so we can read and respond to them. Each submission is linked to the account you are signed in to, and records the hashed machine fingerprint of the computer it was sent from, so we can tell which account and which machine a report came from when diagnosing it. Note that this means a submission is linked to your account's email address, which is not necessarily the address you type into the form.

If the submission is a bug report, the app also attaches a copy of the recent log entries held on your device, newest first, up to a size limit. The option to attach them is ticked by default, and you can untick it before you send the report. This is the same information the app would otherwise ask you to find and paste in by hand. It is the full local log, not only the error-level entries described in Section 3.2, and it is screened in the same way before it is sent, so file paths, account names, and email addresses in it are replaced with placeholders. For the reason set out in Section 3.2, it may still contain a fragment of text you entered. A suggestion carries no log attachment.

Nothing is sent unless you fill in the form and submit it. Along with the log attachment just described, this is the part of the app that deliberately transmits text you have written yourself; Section 3.2 describes the one way a fragment of your text can reach us by accident.

Separately, if you submit the optional good-vibes form on the KinVisa website, the message you write is sent to our cloud service and stored so we can read it. The website form does not ask for your name or email address and does not link the message to your desktop install ID or machine fingerprint.

3.7 Website analytics

This section is about the KinVisa website, not the desktop app.

Pages on the website load an analytics script from `ustats.kinvisa.com`, a server we run ourselves rather than a third-party analytics platform. It records page views and a small number of interactions — which page was viewed, which download button was used, and how far down the longer guide pages a visit reached — so we can tell which pages are useful and where people give up.

What it receives with each of those is ordinary web request information: the page address, the referring page, and the browser, operating system, device type, screen size, and language your browser reports. As with any web request, the server also sees the IP address the request came from, and derives an approximate country from it.

It is not linked to your desktop install ID, your machine fingerprint, or your KinVisa account, and it is not used to build a profile of you or for advertising. It runs only on the website; the desktop app does not load it.

Browsing the website is optional in a way the app's telemetry is not — you can read the guidance, download the app, and use it without the analytics script ever loading again, and an ad or tracker blocker that blocks it does not affect anything else on the site.

3.8 Face-recognition models

Nothing leaves your device for face recognition. The face-recognition models the app uses, about 51 MB in total, are included in the app itself, so the app does not download them and does not contact the hosts where their authors publish them. Each time the app starts, each model file is checked against a fixed fingerprint, and a changed or damaged file is never run.

The models are general-purpose files, identical for every user, and hold no information about you or anyone in your photos. They are part of the app, so they are removed when you uninstall it, and they are not affected by the reset described in Section 6.2.

Versions before 0.2.0 downloaded a different face-recognition model on first use and kept it in the app's data folder. The first time version 0.2.0 or later starts, it deletes those downloaded files. The people you had labelled are kept: their names and relationships are moved to the new face-matching data, the old face measurements are deleted, and each person's face is learned again on your device from the photos in your saved projects.

4. How We Use Information

The app processes information locally, on your device, to:

  • provide the local document-preparation workflow;
  • detect faces in photos and match saved people across images;
  • generate captions and PDFs;
  • save and reopen local project history;
  • maintain local app state, logs, and troubleshooting information.

The photos, PDFs, face-matching data, and project content behind these functions are processed and stored on your device and are not intentionally sent to us. As explained in Section 3.2, an error-level diagnostic log may incidentally contain a limited fragment of user-entered or file-related text.

Separately, we use the limited telemetry described in Section 3 to:

  • sign you in, keep you signed in, and confirm an email change you ask for;
  • keep your credit balance and your unlocked documents, and decide whether saving a PDF spends a credit;
  • record which versions of our Terms of Use, Privacy Policy, and Refund Policy you agreed to, and email you a confirmation of each purchase, so there is a record of what was agreed for refunds and disputes;
  • check for and deliver desktop updates automatically at startup;
  • understand installation counts, platform usage, and PDF-generation volume through standard app telemetry;
  • diagnose crashes, sync errors, sign-in and credit errors, update failures, and other app runtime issues;
  • detect unusual activity and protect the service from abuse;
  • read and respond to support requests and suggestions you send us.

4.1 Legal bases for processing (UK and EEA users)

Where UK or EU data protection law applies to you, we rely on the following legal bases:

  • Performance of a contract - to provide the app itself and the features you ask it to carry out, to run your account, credits, and unlocks, to record which versions of our terms you agreed to, and to respond to a support request you send us.
  • Legal obligation - to email you a confirmation of each purchase that sets out the agreement you gave at checkout, where consumer law requires one, and to keep the limited purchase records described in Section 7 where accounting, tax, or consumer law requires them.
  • Legitimate interests - for the standard telemetry, remote error logging, update checks, and the security and abuse-detection purposes described in Sections 1.5 and 3. Our interests are in keeping the product working, diagnosing faults we would otherwise never see, and protecting the service from misuse. We have considered the impact on you: this data is limited to device, account, and diagnostic information, is not used to build a profile of you, is never sold, and is never used for advertising.
  • Consent - where you choose to send us a support request, a suggestion, or a website good-vibes message, and where you leave the option ticked to attach your logs to a bug report.

You can object to processing carried out on the basis of legitimate interests; see Section 12. Note that the standard telemetry, error logging, and update checks described in Section 3 cannot currently be switched off within the app, and neither can sign-in, so the practical way to stop them is to stop using the app and uninstall it.

5. How We Share Information

We share information with service providers that help operate the app's features:

  • a cloud service, for accounts and sign-in, credits and unlocks, our standard telemetry, PDF-generation statistics, device records, remote error logs, and any support requests or suggestions you send;
  • an email delivery service, for the sign-in link, the email-change confirmations, the notice sent to your old address after an email change, the purchase confirmation sent after you buy credits, and to notify us when you submit a website good-vibes message;
  • an update service, for update checks and downloads;
  • location-lookup services, for approximate country and city lookup as part of standard telemetry;
  • Polar, as payment provider and Merchant of Record, for checkout, receipts, tax, refunds, disputes, and anonymizing its linked customer when you delete your account.

The website's analytics described in Section 3.7 runs on our own server rather than a third party's, so no analytics provider receives anything about you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We may disclose information if required by law, to protect rights and safety, to investigate misuse, or as part of a business transfer such as a merger, acquisition, financing, or sale of assets.

6. Your Choices and Controls

6.1 Delete local projects

You can delete saved projects from the app's history screen. Deleting a project removes that project's locally saved data, including its stored images and PDF exports.

6.2 Reset face data

The app includes a reset action that clears the saved people and face-matching data from your device - that is, everyone the app has learned to recognise, and the measurements it uses to recognise them.

This does not remove the face-recognition models described in Section 3.8. They are part of the app, identical for every user, and hold no information about you or anyone in your photos.

6.3 Your account

The Settings screen shows the account you are signed in as, and lets you:

  • sign out, which clears the sign-in session from your device;
  • change the account email address, confirmed by a link sent to both the old and the new address;
  • see your current credit balance;
  • permanently delete your account.

Signing out does not delete your account or the projects saved under it on that device. Deleting your account removes the KinVisa identity and its cloud data, unused credits, and unlocks, and removes that account's app-managed projects, photos, generated history, pending exports, settings, logs, statistics, and face data from the computer where you confirm deletion. It does not delete PDFs or other files you deliberately saved elsewhere, data in a backup, or another computer's local account folder.

If the account has reached Polar, deletion also asks Polar to delete the customer linked by your KinVisa account ID with personal-data anonymization enabled. Polar may retain information attached to historical orders where required for tax, accounting, refunds, fraud prevention, or disputes. KinVisa likewise retains only the limited, profile-independent credit and purchase audit records described in Section 7. Deletion does not itself request a refund.

6.4 Clear local logs

The app's settings include a control that clears the local app logs stored on your device. Clearing them does not delete any error-log records that have already been sent to the cloud service; to request deletion of those, see Section 12.

6.5 Support requests and suggestions

There is no in-app control to edit or delete a support request or suggestion once you have submitted it, or the log attachment that went with a bug report. To request deletion of a message you have sent, contact us using the details in Section 14. Clearing your local logs before you submit a bug report, as described in Section 6.4, limits what the attachment can contain.

The email address the contact form remembers is replaced whenever you submit the form with a different one. To remove it entirely, delete the app's data folder as described in Section 7.

6.6 What cannot be disabled

These run automatically in packaged builds. There is no in-app setting, account option, or administrator configuration that turns any of them off:

  • signing in, and the credit check that runs when you save a PDF, described in Section 3.3;
  • cloud stats sync, described in Section 3.1;
  • remote error logging, described in Section 3.2;
  • update checks, downloads, and installation, described in Section 3.4;
  • the location lookup, described in Section 3.5.

Sign-in is the one on that list you cannot avoid by staying offline: the app will not open its workflow without it.

7. Retention

Local project files, face-matching data, stats, and logs remain on your device until you delete them through the app's available controls, including account deletion. The shared install identity is not specific to one account and remains until you remove the app's data folder.

Removing the application does not by itself remove the data it stored. This is normal behaviour for desktop software, but it means uninstalling KinVisa leaves your projects, face data, and logs in place on your device. To remove everything, delete the app's data folder as well as the app itself.

Remote device, stats, PDF-generation, and error-log records synced through the app's standard cloud sync are kept for 24 months, then the parts that identify you are removed automatically:

  • error-level logs are deleted 24 months after they were recorded;
  • a device's name, city, and recorded IP addresses are removed once that device has not been seen for 24 months, and any recorded IP address more than 24 months old is removed even from a device still in use;
  • PDF-generation records are no longer linked to your account after 24 months.

What remains after that - platform, device architecture, app version, country, and counts - no longer identifies you, and we keep it as anonymous statistics.

Your account record, its device links, your credit balance, your live credit ledger, your export requests, and your unlock records are retained for as long as the account exists, so that credits you hold stay yours and a document you have paid for stays unlocked. The live credit ledger is append-only by design while the account exists. Deleting the account removes those records and archives only limited credit movements and purchase facts without your email, profile, device links, document unlocks, or a foreign-key link to a live account. Those purchase facts include which versions of the Terms of Use and Refund Policy you agreed to at checkout, and when. We retain that limited financial audit record only as needed for accounting, tax, refunds, disputes, fraud prevention, and legal obligations.

Support requests, suggestions, the log attachment on a bug report, and website good-vibes messages you send are retained until we no longer need them, or until you ask us to delete them. Account-linked support requests, suggestions, and attachments are also removed when you delete the account.

8. Security

KinVisa keeps the photo and PDF workflow on your device. Your projects, photos, generated PDFs, and face data are stored on your computer and nowhere else.

That has a direct consequence worth understanding: because we hold no copy, the security of those files rests on your device rather than on us. Your operating system account, disk encryption, backups, malware protection, and physical device security are what protect them. We cannot lose your project data in a breach of our systems, and equally we cannot restore it for you if your device fails - there is nothing on our side to restore from.

Your sign-in session is stored using the operating system's protected storage where the operating system provides it, as described in Section 2.3. There is no password to steal, because email-link sign-in never creates one.

No method of storage or transmission is perfectly secure. Please protect your device, and avoid using KinVisa on shared or untrusted computers when working with sensitive family, immigration, or identity-related documents.

If a breach of our systems affects personal information we hold and is likely to cause you serious harm, we will tell you as soon as practicable, using the email address on your account, and notify the regulator where the law requires it: in New Zealand, the Office of the Privacy Commissioner; in Australia, the Office of the Australian Information Commissioner; in the United Kingdom or the European Union, the relevant data protection authority. We will tell you what happened, what information was involved, and what you can do.

9. Sensitive Documents and Immigration Materials

KinVisa may be used to prepare documents containing family photos, relationship history, names, dates, and other sensitive information. You are responsible for deciding what to include in your projects and generated PDFs. KinVisa does not verify the legal sufficiency, accuracy, or completeness of the documents you create.

10. International Data Transfers

Information sent to our cloud service, our email delivery service, update hosts, or location-lookup services as part of the app's standard operation may be processed in countries other than your own, which may have privacy laws different from those where you live. Information covered by this policy routinely crosses a border. In particular:

  • the operator is based in Pakistan, and can access the information we hold from there;
  • our cloud service, which holds your account, credits, unlocks, device records, statistics, error logs, and support requests, stores that data in Japan;
  • our email delivery service is established in the European Union;
  • app updates are downloaded from GitHub, operated from the United States;
  • the location-lookup services described in Section 3.5 operate from the United States and elsewhere;
  • Polar, our payment provider, is based in the United States.

Where information about someone in the United Kingdom or the European Economic Area reaches a country that has not been recognised as offering equivalent protection, we rely on the data protection terms of the provider concerned, which incorporate the standard contractual clauses approved for that purpose, alongside the security measures described in Section 8. Our email delivery provider is established in the European Union. You can ask us which provider holds what, using the contact details in Section 14.

Payments are the exception, because we are not the ones moving that data. Polar is the seller of record and collects your payment and billing details directly under its own privacy policy, which governs how it transfers them.

11. Children's Privacy

KinVisa is not directed to children. Because users may upload family photos, project content may include images or information about minors.

Those photos, and any face data derived from them, stay on your device. We never receive them. You should only upload and process photos and information you have the right to use.

12. Regional Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection regarding personal information we hold. You may also have the right to appeal a privacy decision or lodge a complaint with a regulator.

Because most of KinVisa's data is stored only on your device, we cannot access, inspect, export, or delete it on your behalf. We do not have it. This is not a restriction we could lift on request - there is nothing on our side to retrieve. You control that data directly, using the app controls described in Section 6. Your photos, your projects, and your face data are all in that category.

Your account is the exception. It lives on our side, and Section 6.3 describes how you can delete it yourself from the Settings screen.

The rights above therefore apply, in practice, to the information we do hold: your account record and the devices linked to it, your credit balance, credit ledger, export requests and unlock records, your device and PDF-generation statistics, remote error logs, recorded IP address, and any support request, suggestion, log attachment, or website good-vibes message you have sent.

Deleting your account removes the credits it holds and the record of which documents it has unlocked. We cannot restore either afterwards. Limited financial audit records and Polar's historical order records may remain for the purposes described above, without the live KinVisa profile.

For remotely synced data, you may contact us to request access or deletion where applicable. We may ask for information sufficient to verify the account, install, or device record related to your request.

If you are not satisfied with how we handle a privacy request or complaint, you can complain to a regulator: in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz); in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in the European Union, the data protection authority where you live.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above, and if the changes are material, we will provide notice through the app, release notes, website, or another reasonable channel.

14. Contact

For privacy questions or requests, contact:

Email: [email protected]