Privacy Policy

Information We Collect

We collect the following information when you use VFSPhotoReady:

• Email address — provided voluntarily during checkout to receive your photo by email
• PayPal transaction data — your PayPal email, name, and order ID are provided by PayPal when you complete payment. We do not store credit card or bank details.
• Usage data — pages visited, actions taken, and browser type collected via Google Analytics (anonymized)
• reCAPTCHA data — Google reCAPTCHA collects browser and interaction data to verify you are human

We do not collect your name, address, phone number, or any government identification unless provided voluntarily.

How We Use Your Information

We use the information collected for the following purposes:

• Order fulfillment — to deliver your purchased passport photo and print sheet by email
• Payment processing — to confirm and record your PayPal payment
• Customer support — to respond to questions or issues sent to support@vfsphotoready.com
• Service improvement — anonymized analytics to understand how users interact with our tool
• Fraud prevention — reCAPTCHA data to protect against automated abuse

We do not use your information for marketing emails, targeted advertising, or selling to third parties.

Your Photos & Privacy

When you upload a photo:

• Your photo is processed locally in your browser using JavaScript and MediaPipe (Google's AI library)
• A compressed thumbnail is sent to AWS Rekognition (our face detection service) for face analysis only — it is not stored by AWS
• If you purchase AI background removal, your photo is sent to remove.bg for background processing — see remove.bg's privacy policy for their data practices
• If you provide an email address, your processed photo is sent via Amazon SES to deliver to your inbox — it is not retained after delivery

After you close or refresh the page, all photo data is permanently cleared from your browser's memory. We do not retain copies of your photos.

Payment Information

All payments are processed by PayPal. We never see, receive, or store your credit card, debit card, or bank account details.

When you pay, PayPal provides us with:

• Your PayPal email address
• Your first name (for the confirmation email)
• The transaction/order ID
• The amount paid

This information is used only to fulfill your order and maintain transaction records. We retain order IDs and amounts for accounting purposes in accordance with applicable tax laws.

Information Sharing

We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly for operating our service:

• Amazon Web Services (AWS) — cloud infrastructure, face detection (Rekognition), email delivery (SES)
• PayPal — payment processing
• remove.bg — AI background removal (only when you select this option)
• Google — reCAPTCHA (spam prevention) and Google Analytics (anonymized usage data)
• Web3Forms — OCI waitlist email capture (if you sign up on the OCI page)

We may disclose information if required by law, court order, or to protect the rights and safety of our users.

Cookies & Analytics

We use the following cookies and tracking technologies:

• Google Analytics (GA4) — anonymized usage statistics. IP addresses are anonymized. You can opt out via Google Analytics Opt-out Browser Add-on.
• Google reCAPTCHA — sets cookies to verify human interaction
• PayPal — sets cookies when the payment button loads (only on the payment page)
• sessionStorage — we store a flag in your browser's session storage to remember that you passed the reCAPTCHA check during your current visit. This is cleared when you close the tab.

We do not use tracking cookies for advertising or remarketing purposes.

Data Retention

• Photos — never retained on our servers. Cleared from browser memory when you close the page.
• Email addresses — retained only as long as needed to deliver your order, then deleted
• Order records — order IDs and payment amounts retained for up to 7 years for accounting and tax compliance
• Analytics data — anonymized usage data retained per Google Analytics default retention settings (14 months)
• Support emails — correspondence sent to support@vfsphotoready.com retained for up to 2 years

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of personal data we hold about you
• Deletion — request deletion of your personal data
• Correction — request correction of inaccurate data
• Portability — request your data in a portable format
• Objection — object to processing of your personal data

To exercise any of these rights, email us at support@vfsphotoready.com. We will respond within 30 days.

If you are in the European Union or UK, you have rights under GDPR/UK GDPR. If you are in California, you have rights under CCPA.

Security

We implement the following security measures:

• All traffic served over HTTPS via AWS CloudFront
• API endpoints protected by Google reCAPTCHA v2
• AWS API Gateway with CORS restricted to vfsphotoready.com
• No payment card data ever touches our servers (PayPal handles all card processing)
• Photos processed in-browser — never stored on our servers

While we take reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your information.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of VFSPhotoReady after changes constitutes acceptance of the updated policy.

For significant changes, we will make reasonable efforts to notify users via a notice on our website.