Privacy policy
Last updated 15 October 2026
This policy explains how Vizyt collects and uses personal data, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
In short: your letter is processed in memory to generate an explanation and is not stored by Vizyt. To produce the explanation it is sent to an AI service (OpenRouter, which routes it to a Google Gemini model). We ask for data collection to be denied. Details are below.
1. Who we are
The data controller is Vizyt, an independent project run by an individual (not a company). Contact: hello@vizyt.me.
2. What data we collect
- Your refusal letter (file or pasted text). It may include your name, date of birth, nationality, reference numbers, immigration status and history, details of your relationship and your partner, financial information and, sometimes, health information or details of past convictions. Some of this is special category data or criminal offence data under UK GDPR. We do not ask for it, but a letter may contain it. A letter can also contain information about other people, such as your partner or sponsor; by uploading you confirm you are entitled to share it. You may remove details that are not needed for an explanation, such as reference numbers.
- Contact details you give when asking to talk to a regulated adviser: name, email, phone (optional) and a short message.
- Firm details when an adviser firm contacts us: names, work contact details, regulator and registration number.
- Consent records: your cookie choices and the consents you tick on our forms, with the date and time.
- Analytics data, only if you accept analytics cookies: pages viewed, device and browser type, approximate location and events such as viewing an explanation.
- Technical data: our hosting provider processes IP addresses and request data to deliver the site and protect it from attacks. To limit misuse of the free explainer we keep a one-way hash of your IP address (combined with a daily-changing value, so it cannot be traced back to you) for up to 24 hours as a usage counter. We also keep anonymous daily totals, such as the number of letters explained.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Processing your letter to generate an explanation | Consent (Article 6(1)(a)); explicit consent for any special category data (Article 9(2)(a)), including for any criminal offence data in the letter. You give this by ticking the consent box before uploading. |
| Passing your details, and if you choose, a summary of your refusal reasons, to a regulated adviser when you ask | Consent (Article 6(1)(a)); explicit consent (Article 9(2)(a)) for any special category data included in the summary. |
| Responding to adviser firms about our panel | Legitimate interests (Article 6(1)(f)) in building and running our adviser network. |
| Analytics | Consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations). |
| Optional update emails | Consent (Article 6(1)(a)). You can unsubscribe at any time. |
| Hosting, security and preventing misuse | Legitimate interests (Article 6(1)(f)) in keeping the service secure. |
You can withdraw consent at any time by emailing hello@vizyt.me or, for cookies, using “Cookie settings” in the footer. Withdrawal does not affect processing that already took place.
Our explanations are produced by AI, but they are general information and do not make decisions that have legal or similarly significant effects on you.
4. Who we share data with
- Cloudflare — website hosting, content delivery and security (processor).
- OpenRouter (an AI routing service) and Google (the Gemini AI model it routes to) — the letter you upload is sent to them so the model can read it and write the explanation (processors). There is no separate text-recognition (OCR) provider: the model reads the image or PDF itself. We ask OpenRouter to route requests only to providers that do not collect or train on your data (“data collection: deny” and zero-data-retention routing). We rely on those settings and the providers’ own terms and cannot independently verify them.
- Google — Google Analytics, only if you accept analytics cookies.
- Regulated adviser firms — only when you request a referral and consent to it. The adviser becomes a separate controller of your data and handles it under their own privacy policy.
- Authorities, where we are required to by law.
We do not sell your personal data, and we do not use your letter for advertising.
5. How long we keep it
- Letters (files or pasted text): not stored by Vizyt. They are processed in memory and discarded when the explanation has been produced. Your browser keeps the explanation in session storage until you close the tab. We do not log the text of letters.
- Referral requests and adviser-firm enquiries: 12 months, then deleted.
- Consent records: for as long as we rely on the consent, and a reasonable period afterwards to show we had it.
- Anonymous daily usage totals: kept without personal data.
- Analytics data: according to our Google Analytics retention setting, no longer than 14 months.
6. International transfers
Some of our providers (including Cloudflare, OpenRouter and Google) may process data outside the UK, including in the United States. Where this happens we rely on appropriate safeguards, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), or the ICO’s International Data Transfer Agreement or Addendum.
7. Security
Data is encrypted in transit (HTTPS). We limit access to what is needed to run the service, and letters are not stored by us.
8. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing (including processing based on legitimate interests);
- data portability, where processing is based on consent;
- withdraw consent at any time.
To use any of these rights, email hello@vizyt.me. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO).
9. Children
Vizyt is intended for adults. We do not knowingly collect data from children under 18.
10. Changes
We will update the date at the top of this page when this policy changes, and tell you about significant changes where appropriate.