Privacy Policy

What this policy covers

It covers this website and the forms on it: the free assessment, the contact form, and the detailed application form you reach through a personal invitation link.

What we collect

We ask only for what we need to answer you and to prepare an application properly. Nothing on this site is bought from a data broker or enriched from another source.

• Assessment: your name, email, phone, country of residence, nationality, preferred language and contact method, and your answers about your goal, timeline, education, work, funding and family.
• Contact form: your name, email, and your message, plus a phone number, country and visa category if you choose to give them.
• Application form: the fuller detail an application needs, including passport data, addresses, education and employment history, travel history and background declarations.
• Technical: a one-way hash of your IP address and how long the form took to complete, both kept to detect automated abuse rather than to profile you.
• Usage: which page was viewed and which step of a form was reached. We record the page path without its query string, so a personal invitation link can never appear in our analytics.

Sensitive answers

Some questions invite genuinely sensitive answers: a previous refusal, an overstay, an arrest, a health matter. Free text you write in those fields is encrypted before it is stored, using AES-256-GCM, and is held separately from the rest of your answers.

That separation is deliberate. It means the sensitive text cannot appear by accident in a list, an export or a notification email — it is readable only by the consultant handling your case, and only when they open your record.

Why we use it

• To answer the question you asked us.
• To assess which visa routes are worth discussing in your circumstances.
• To prepare and organise an application when you engage us to do so.
• To keep a record of what was submitted and when, which is what lets us reconcile a discrepancy later.
• To send you marketing about our services only if you ticked the box asking for it, and to stop as soon as you tell us to.

How long we keep it

An enquiry that does not become a case is kept for 24 months, and a contact-form message for 12 months, after which the record is anonymised or deleted. Where you become a client, we keep the case file for as long as we are working with you and for the period we are required to afterwards.

Who else can see it

Your information is visible to the consultants working on your enquiry. We use an email provider to deliver confirmations and invitations, which necessarily sees your name, your email address and the content of those messages.

We do not sell your information, and we do not share it for anyone else to advertise to you.

How we protect it

• Sensitive free text is encrypted at rest and stored apart from the rest of your answers.
• IP addresses are stored as a one-way hash. We never keep the address itself.
• Staff accounts require a second factor from an authenticator app, not a code sent by text message.
• Actions taken on a record in our console are written to an audit log.
• Invitation links are unguessable, time-limited, and stored only as a hash, so a copy of our database yields no working links.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can withdraw marketing consent at any time without affecting the handling of your enquiry, and you can change your cookie choice from the link in the footer of every page.

Cookies and local storage

We set a small number of items in your browser, all of them either strictly necessary or chosen by you. The Cookie Policy lists each one, what it does and how long it lasts.

Changes to this policy

When we change this policy materially we raise its version number, and the version in force when you submitted a form is recorded against your record. That is what lets us tell you afterwards exactly what you agreed to.