Effective 17 October 2026. This notice covers the VisaClarity AI native app and its private testing programme. Public access and paid purchases are not open. The separate owner browser preview uses its host's account system.
Who operates VisaClarity AI
TRUSTWELL SAFETY LIMITED, New Zealand, operates VisaClarity AI. Contact support@trustwellsafety.co.nz for support, privacy questions, access, correction or deletion requests. Please do not email passports, immigration evidence, passwords or payment details.
Information you choose to provide
We process your account email and login information; destination, purpose and application details; documents and their filenames, categories and person labels; checklist tasks, notes, AI findings and cover notes; and usage counters. Documents can contain identity, relationship, financial and other sensitive information. Only upload evidence you are entitled to share, including appropriate permission for family documents. Account holders must be 18 or older.
Storage and AI processing
Supabase provides the native accounts, database, private file storage and backend. The project is hosted in Sydney, Australia. Applications and uploaded originals remain in your account until you delete them or request deletion. Access controls separate each account. Authorised service administration and providers may access information when necessary to operate, secure or support the service. Downloaded exports, Files/Photos copies and temporary import or sharing caches are separate from the cloud account.
When you request a review and consent, documents and application context go through our backend to OpenAI. Drafting sends your notes, context and review facts. We request store:false, so responses are not saved as retrievable OpenAI response history. This does not mean zero retention: provider safety, legal and operational retention can apply. Read OpenAI's data controls. Processing can occur outside New Zealand and Australia. AI may misread evidence or miss problems; it does not authenticate documents, assess eligibility or guarantee an outcome.
Accounts, payments and service providers
Supabase generates account-confirmation and recovery messages and sends them through Trustwell’s Brevo transactional email service, from sign-in@signin.trustwellsafety.co.nz. Brevo processes recipient addresses, message contents and delivery records; its storage is in the European Union and service processing may occur internationally. Anonymous engagement tracking is enabled in the existing Trustwell account; delivery and security records may still identify recipients. See Brevo’s privacy notice. Login tokens are held in the phone's secure storage. Cloudflare hosts these public information pages. RevenueCat is configured to support Apple/Google purchases and may process an app account identifier and technical connection information when you use purchase controls. Purchases are currently disabled. If enabled later, the relevant store handles payment; we will not receive your full card number. We will update the notice before introducing materially different processing. Support mail is processed through our company support mailbox and its email provider.
We do not include advertising SDKs or sell immigration documents. Technical logs, IP addresses and request times can be processed to deliver and secure the service. Usage counters contain counts and time periods rather than document contents. Do not include sensitive content in support messages.
Reports about AI responses
If you choose Report an AI response, we save only the text you review, report reason, account ID and submission time to investigate it. Original files and application contents are not attached automatically. Reports are retained while needed to investigate and resolve the issue and related obligations, then reviewed for deletion. Account deletion removes account-linked reports.
Your choices and deletion
You can delete individual files or applications, or use Account → Delete my account and documents. Successful account deletion removes the native account and its active application records, files, submitted reports and usage counters, and invalidates its sessions. Provider logs and backups can persist under provider retention and legal requirements; deletion cannot retract AI processing already completed. Delete exported copies separately. See account deletion instructions. Support correspondence is kept as needed to resolve the request and related obligations, then reviewed for deletion.
You may ask us for access to or correction of your personal information and raise a complaint using the contact above. If we cannot resolve a privacy concern, you can contact the New Zealand Privacy Commissioner. This notice will show an updated effective date when changed.