← Back to home

Privacy Policy

Last updated: 5 October 2026

This Privacy Policy describes how SERVIS BUDU, TOO (“Company”, “we”, “us”, or “our”) collects, uses, stores, processes, and protects personal information when you access or use Alay, including our website, mobile application, and any related services (collectively, the “Services”).

This policy explains our data practices; it does not replace consent where consent is required. We request applicable permissions or consent before the relevant processing. You may contact us about your data rights at any time.

1. Company Information

Legal name: SERVIS BUDU, TOO
Registered address: 050052, Almaty, 12 Shaimerdenova St., Kazakhstan
Contact email: info@visabot.net

Alay is a private digital service that provides visa-related assistance tools, including appointment notifications, informational support, and automated or semi-automated appointment booking services.

Alay is not affiliated with, endorsed by, or connected to any government authority, embassy, consulate, or official visa application center, and does not issue visas or guarantee visa approval or appointment availability.

2. Scope of This Privacy Policy

This Privacy Policy applies to all users of the Services, regardless of geographic location, except where prohibited by applicable law.

SERVIS BUDU, TOO is the operator responsible for the personal data described in this policy. We process data to provide requested services, meet legal obligations, protect security, and, where required, with your consent. We comply with applicable data protection requirements and do not transfer our obligations to users.

Additional rights under mandatory local law remain available wherever they apply.

3. Information We Collect

3.1 Information You Provide Voluntarily

We collect personal information that you voluntarily provide when using the Services, including:

• Email address (used for account registration and communication);
• Full name;
• Contact information;
• Visa-related preferences (such as country, city, visa type, and appointment preferences);
• Passport details entered in text form only (e.g., name, passport number, expiration date), when required for specific services;
• Payment-related references associated with completed transactions.

Important clarifications:

• We do not collect or store Social Security Numbers (SSN);
• We do not collect biometric data, including fingerprints, facial recognition data, or DNA;
• We do not require users to upload passport scans or photographs into the application;
• Users are solely responsible for ensuring that the information they provide is accurate, complete, and lawful.

3.2 Information Collected Automatically

When you access or use the Services, certain information may be collected automatically, including:

• Device type, operating system, and application version;
• IP address and approximate location (country-level only);
• Log files, timestamps, and usage activity;
• Crash reports and diagnostic information;
• Interaction data related to application performance and stability.

This information is collected to maintain security, ensure proper functionality, diagnose technical issues, analyze performance, and improve the Services.

4. Purposes of Data Processing

We process personal information strictly for legitimate operational purposes related to the Services, including:

• Creating, authenticating, and managing user accounts;
• Providing visa-related notifications, booking attempts, and support services;
• Processing payments and preventing fraudulent transactions;
• Sending service-related emails and push notifications;
• Communicating confirmations, updates, and essential service notices;
• Monitoring, analyzing, and improving application performance and reliability;
• Protecting the Services against misuse, abuse, or unauthorized activity;
• Complying with applicable legal or regulatory obligations when required.

We do not sell, rent, or trade personal data to third parties.

5. Consent and Choices

Where processing requires consent, we request it separately and you may withdraw it by contacting info@visabot.net. Withdrawal does not affect earlier lawful processing. You may disable push notifications in device settings and request access, correction, or deletion. Withdrawing consent needed for a particular feature may prevent us from providing that feature.

You may initiate account deletion in the app through Profile → Settings → Delete Account, or use the web/email options on our Delete User Data page.

6. Payments and Billing Information

Payments may be processed by third-party payment service providers. The provider and payment conditions are identified in the applicable payment flow. We do not store full payment card numbers or sensitive card authentication credentials on our servers. Providers handle payment details under their own privacy and security policies. We may receive transaction references, payment status, amounts, dates, and billing details needed for service delivery, accounting, refunds, and fraud prevention.

7. Third-Party Service Providers

We use trusted third-party service providers to operate and support the Services, including but not limited to:

• Firebase (authentication, database, hosting, push notifications);
• Third-party payment service providers (payment processing);
• Email delivery services;
• Push notification services;
• Analytics and crash reporting tools (such as Firebase Analytics);
• MongoDB Atlas (cloud database infrastructure);
• Metricool (website traffic analytics through the website tracker).

These providers process personal data only as necessary to perform their services and are required to implement appropriate technical and organizational security measures.

Depending on the feature, these providers receive the account, device, usage, notification, support, or transaction data needed for their role. Website analytics may use cookies or similar identifiers and collect browser, device, IP address, and page-interaction information. Browser controls can restrict cookies; where consent is legally required, analytics processing requires that consent.

For appointment booking or assistance you request, relevant applicant and passport details may be shared with the applicable appointment platform or visa service recipient as needed to perform that request. We may also disclose limited information when required by law or to protect against fraud and security threats.

8. Data Storage and International Processing

We use cloud infrastructure, including MongoDB Atlas and Firebase. As described for the current Services, data is primarily stored on servers in the United States and may be accessed from Kazakhstan or other countries where providers operate. International processing remains subject to applicable data protection, localization, and transfer requirements; this policy does not waive those requirements. Where required, we obtain consent and use the safeguards required by applicable law.

9. Data Retention and Deletion

We retain account and service data while needed to provide the Services. After account deletion, account credentials, profile and passport details, preferences, notification tokens, appointment history, and account-linked support chat are deleted or irreversibly anonymized, except for the limited records described below.

• Payment and accounting records: up to 7 years where required by applicable tax or accounting law, or longer only where a specific legal obligation requires it. These include transaction references, amounts, dates, and required billing details, not full card numbers.
• Security and audit logs: up to 90 days for abuse prevention, incident response, and system integrity; longer only where necessary for a specific investigation or legal obligation.
• Necessary support and dispute correspondence: up to 2 years, only to the extent needed to resolve disputes or comply with legal obligations. Routine account-linked chat is deleted.
• Irreversibly anonymized analytics aggregates: may be retained indefinitely because they no longer identify you.

Retained personal records are restricted to the stated purposes and deleted when those purposes or required periods end. Service providers may retain records under their own legal obligations and privacy policies.

We acknowledge deletion requests and carry out identity verification within 7 business days of receipt, and complete deletion within 30 days after verification, or sooner if applicable law requires. We confirm completion by email. See Delete User Data for the full process. Cancellation of subscriptions is separate and does not prevent a deletion request.

10. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encrypted data transmission using HTTPS/TLS;
• Restricted and role-based access to systems and databases;
• Secure cloud infrastructure and backup procedures;
• Monitoring mechanisms to detect unauthorized access or misuse.

Despite these measures, no electronic storage or transmission method can be guaranteed to be completely secure, but this does not limit our obligations under applicable law.

11. Communications and Notifications

We may send users service-related emails, account notifications, and push notifications related to application functionality or service status. Users may disable push notifications through their device settings. Certain essential communications related to account operation or purchased services may still be sent by email.

12. Children’s Privacy

The Services are intended solely for individuals 18 years of age or older. We do not knowingly collect personal information from minors. If personal data from a minor is identified, it will be promptly deleted.

13. User Rights and Requests

Users may request to:

• Access personal information associated with their account;
• Correct inaccurate or outdated information;
• Delete their account and associated personal data.

Requests may be submitted by contacting info@visabot.net or via our Delete User Data page. We acknowledge requests within 7 business days. Deletion is completed within 30 days after identity verification, or sooner if required by law. Depending on applicable law, you may also request restriction, object to processing, request a portable copy, withdraw consent, or complain to the competent data protection authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in the Services or operational practices. Updates will be indicated by the “Last updated” date at the top of this document. We will provide notice of material changes where required and obtain renewed consent where required; continued use alone does not supply such consent.

15. Contact Information

info@visabot.net
SERVIS BUDU, TOO
050052, Almaty
12 Shaimerdenova St.
Kazakhstan