Privacy Policy

1. Who We Are

VisaRunner ("we", "us", "our") operates the SaaS booking platform at visarunner.io — an automated booking and client management system for visa run operators across Southeast Asia. For all privacy-related matters, contact us at support@visarunner.io.

We act as a data controller for operator account data, and as a data processor for the personal data of your clients that you manage through the platform.

2. Data We Collect

2.1 Operator account data — collected when you register or configure your account:

• Company name, email address, hashed password
• Telegram account identifier (tg_user_id) when you connect Telegram notifications
• Billing information processed by Lemon Squeezy — we do not store card numbers or payment credentials directly
• URL slug, custom bot greeting text, pickup time templates
• Subscription plan and billing interval

2.2 Client booking data — collected through your Telegram bot when your clients make bookings:

• Full name and phone number
• Pickup address, geolocation coordinates, Google Maps link
• Departure date, visa type, number of passengers
• Visa expiry date and nationality
• Telegram username and user ID
• Preferred language, booking status and timestamps

2.3 Analytics and usage data — collected automatically when you use the platform:

• Page views, click events, session duration (via Google Analytics, Google LLC, USA)
• Heatmaps and user behaviour (via Yandex Metrica, Yandex LLC, Russia)
• Cookies, browser type, IP address, referrer
• Dashboard actions (filters applied, exports triggered, etc.)

3. Legal Basis for Processing

4. Third-Party Services

We share data with the following processors to operate the service:

Each processor has its own privacy policy and data processing agreement. We do not sell your data or your clients' data to any third party.

5. Cookies

We use the following categories of cookies:

• Essential cookies — required for authentication and session management. Cannot be disabled.
• Analytics cookies — Google Analytics and Yandex Metrica to understand how the platform is used. You may opt out via your browser settings or browser extensions.

We do not use advertising, retargeting, or cross-site tracking cookies.

6. Data Retention

After the retention period or upon deletion, data is permanently erased within 30 days.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access — request a copy of data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your account and associated data
• Right to data portability — receive your booking data in a machine-readable format (CSV)
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — for processing based on consent (analytics cookies)

To exercise any of these rights, email support@visarunner.io. We will respond within 30 days. Identity verification may be required.

8. Data Security

• All data is transmitted over TLS (HTTPS)
• Passwords are stored as bcrypt hashes — we cannot recover your plain-text password
• Sensitive fields (e.g. bot tokens) are encrypted at rest
• Production database access is restricted to authorized personnel only
• Servers are hosted on DigitalOcean in Singapore with regular automated backups

In the event of a data breach that poses a risk to your rights, we will notify affected users within 72 hours of becoming aware of it.

9. International Data Transfers

Some third-party processors (e.g. Google Analytics, Lemon Squeezy, Resend) may transfer and process data in the United States. These transfers are subject to appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms) as required by applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a prominent notice in your dashboard at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

11. Contact

For all privacy-related requests and questions, contact us at support@visarunner.io. We aim to respond to all requests within 5 business days.