Privacy policy

Last updated: October 26, 2026

1. Scope of this policy

   The-A-Company Global, Inc. runs theacompany.ai: the chat, the visa pages, and our application services, for every visa and government service we offer. This policy covers all of them.

   Who is responsible: The-A-Company Global, Inc., a Delaware corporation, 9450 SW Gemini Dr PMB 60233, Beaverton, Oregon 97008, United States. Write to us at hello@theacompany.xyz.

   We built theacompany.ai, how it is structured and how it works, to follow the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), for everyone, wherever you live.

   The official government sites we link to have their own privacy policies. When you leave theacompany.ai, this policy stops applying.

2. Your questions, applications, and accounts

   1. Questions and chats. You can ask questions without an account and without telling us who you are. Your chat is kept 30 days in our logs. Sign in and save it, and it is kept until you delete it. What you type is sent to the AI provider that writes the answer.
   2. Documents and voice. Documents you choose to have read, such as your passport page, and your voice recordings are sent to the AI provider to read or transcribe them. We don't keep the file or the recording.
   3. Your applications. When you apply with us, you give us what the official form asks for, such as your name, date of birth, passport, address, travel, family, work, and education. We need it to prepare your application; without it we can't. If you ask, your application is reviewed before it is submitted.
   4. Security questions. The official form asks about your health, criminal record, and immigration history. Your answers are never sent to the AI, are used only to complete your application, and are stored, encrypted, with your application. Because this information is especially sensitive, we use it only with your explicit consent, which you give when you answer. You can withdraw it at any time by deleting your application.
   5. One account, for everything. What you save once fills in your next application, for any service we offer, so each one is faster and easier. You check every answer before anything is sent.
   6. Accounts. You don't need one. If you create one, we keep your email and a scrambled form of your password that can't be turned back. With Google or Apple, they tell us only your email and an account identifier.
   7. Payments. When you pay for a service, Stripe handles the payment. We receive whether you paid, and never your full card number.

3. Categories of information

   In the words of California law, in the last 12 months we collected these categories of personal information, and only these:

   1. Identifiers, such as your email address and account identifier.
   2. Customer records and protected characteristics, such as your name, date of birth, sex, nationality, address, and phone number.
   3. Commercial information, whether you paid for a service, when you pay.
   4. Professional and education information, from your application.
   5. Audio, when you choose to speak instead of typing. We don't keep it.
   6. Internet activity, the requests your browser makes, used in memory only, and, if you say yes, how you use the site, through Google Analytics.
   7. Sensitive personal information, such as passport and identity numbers, citizenship and immigration status, your answers about health and criminal record, and your account login. We use it only to provide the service you asked for.

   It comes from you, and from Google or Apple if you sign in with them. We disclose it only to the providers listed under How we share information, so they can run the service for us. We have not sold or shared any of it.

4. Technical information

   We receive the usual technical information with each request: the address requested, your network address, and the time. We use your network address only to stop abuse, in memory, and never write it to our database. We don't ask for your location; if you say yes to analytics, Google Analytics records the country you visit from.

5. Cookies, browser storage, and analytics

   We use one cookie to keep you signed in, and one that lasts 10 minutes while you continue with Google or Apple. Your browser keeps the open chat for this tab, the widths of the panels you resize, and, for 30 days, the key to an application you started without an account, so you can return to it on this device.

   If you say yes when we ask, we also use Google Analytics to see how the site is used: the pages visited, for how long, the kind of device, and the country you visit from. It sets its own cookies and keeps this information for 14 months. It never receives what you type, your applications, or your documents. Until you say yes, it doesn't load at all, and you can change your choice at any time on the Your data page.

   We have no ads and no advertising cookies.

6. Information we store and how long we keep it

   Everything we store is encrypted. We keep it only as long as we need it.

   1. Chats. Kept 30 days in our logs. Saved chats are kept until you delete them.
   2. Applications. An application you start without an account is kept 30 days after your last change, so you can come back and finish it. Then it is deleted. You can delete it sooner from My application, which also deletes its log. A saved application is kept until you delete it, so you can continue and reuse your answers.
   3. Account. Kept until you delete it, or after 3 years without signing in.
   4. Logs. Kept 30 days, to check answers and review applications before they are submitted. Not tied to your account.
   5. De-identified data. A copy of logs with names, dates, document numbers, addresses, email addresses, phone numbers, and application answers removed. Not linked to you. Kept 1 year, to improve our services.
   6. Feedback. Your rating and comment, with personal details removed. Kept 1 year.
   7. Backups. Kept 30 days. Something you delete is gone from backups within 30 days.

7. Why we use your information

   1. To provide the service you ask for. Answering your questions, preparing and saving your applications, and your account. This is needed to provide the service.
   2. To check answers and review applications. Our logs. This is our legitimate interest in giving you correct answers and complete applications.
   3. To improve our services. De-identified data and feedback. This is our legitimate interest in making our services better. You can object at any time.
   4. To see how the site is used. Google Analytics, only with your consent, which you can withdraw at any time.
   5. To keep the service safe. Limits, security, and backups. This is our legitimate interest, and sometimes a legal duty.
   6. Sensitive information. Your answers about health, criminal record, and immigration history, and your passport and identity numbers, are used only to complete the application you asked for, with your explicit consent.
   7. No automated decisions. We don't make decisions about you automatically. Only the government decides your application.

8. How we share information

   We share information only with the providers that run the service for us, under contracts that require them to protect it:

   1. AI providers. OpenAI, in the United States, writes the answers, reads documents, and transcribes voice. We only use AI providers that encrypt your information, never train their models on it, and keep it no longer than 30 days.
   2. Hosting. Fly.io hosts our servers in Frankfurt, Germany.
   3. Error reports. Sentry, in the United States, receives a report when something on the site breaks: the error, the page, and your browser. Never what you type or upload, and never your IP address.
   4. Payments. Stripe, when you pay.
   5. Sign-in. Google or Apple, only if you choose to sign in with them.
   6. Analytics. Google, in the United States, only if you say yes to analytics cookies.

   We have never sold your information or shared it for advertising, and we never will. Because we don't, there is nothing to opt out of; we treat a Global Privacy Control signal from your browser as a request not to, which we already honor.

   We share your information with a government, or with the systems it uses for appointments and payments, only to do what you asked, such as booking your appointment. You sign and submit your application yourself. We also share information when the law requires it.

   Our company is in the United States, our servers are in Germany, and our AI provider is in the United States. Each provider has signed a data processing agreement with us that limits what they may do with your information, including the EU Standard Contractual Clauses where they apply.

9. Security

   Everything you send us travels encrypted, and everything we store about you is encrypted on our servers. Passwords are never stored as written. We will never ask for your password by email or phone.

   If a breach affects your information, we will tell you and the authorities, as the law requires.

10. Your data is always yours

    At any time, with no reason needed, and for free, you can:

    1. See and download everything saved with your account, on Your data in the account menu.
    2. Delete any item, or your whole account, on Your data. Without an account, delete your application from My application.
    3. Correct anything we hold, by writing to hello@theacompany.xyz.
    4. Object to us using your chats to improve our services, or ask us to limit how we use your information, by writing to hello@theacompany.xyz.
    5. Withdraw your consent for your answers to the security questions, by deleting your application.

    We answer within one month. For a request by email, we confirm it comes from you by writing back to the email on your account. Someone you authorize can ask for you, with your signed permission; we then confirm with you directly. Using your rights never changes the service or the price you get.

    Logs, de-identified data, and feedback aren't tied to your account, so we can't find your part of them. They are deleted on schedule.

    You can also complain to the data protection authority where you live.

11. Children

    You must be 18 to create an account. A parent or guardian may prepare an application for their child. We don't sell or share anyone's information, including children's.

12. Changes to this policy

    We will post any change to this policy on this page and update the date at the top. If a change affects how we use your information, we will say so on the site before it takes effect.

Questions? Write to hello@theacompany.xyz.