Privacy Policy

AgentVisa exists to let humans vouch for their AI agents — not to build profiles on people. We collect the minimum data required to perform verification, we do not sell or share your personal data with advertisers or third parties, and we never use your biometric data for any purpose other than verifying your identity during signup.

This policy applies to:

• AV Holders — individuals who create an AgentVisa account and complete biometric verification.
• Widget Holders — businesses and developers who register an account to embed the AgentVisa widget on their platform.
• Visitors — anyone who visits agentvisa.ai without creating an account.

During the verification process we collect:

• Email address — used to send your verification code, magic links, and important account notices. Not shared with Widget Holders.
• Phone number — used to send a one-time SMS code during verification. Stored in hashed form after verification is complete. Not shared with Widget Holders.
• Biometric credential (WebAuthn) — your Face ID / Touch ID assertion is processed entirely on your device by your operating system. We receive only a cryptographic credential handle — we never see or store a facial image, fingerprint, or raw biometric data. This handle is used solely to verify that the same device/person is present.
• Account metadata — account creation date, expiry date, and verification timestamps.

We collect your first and last name as part of the signup process. We do not build advertising profiles. We do not sell your data. Ever.

When a Widget Holder calls our API to verify your agent's token, the response depends on the Widget Holder's plan:

• Basic plan — Widget Holders receive only: valid: true/false and a short reason code. No personal data is shared.
• Pro plan — Widget Holders may additionally receive confirmation flags: age-range (over 18, over 21), whether multiple agents are authorized under your account, the year you joined, and whether your request was Web Bot Auth bound. Pro Widget Holders may also request AVS-style attribute confirmation — they supply a candidate email address or phone last 4 digits and receive only true or false. No name, email address, phone number, or biometric data is ever shared with Widget Holders.

You can review which sites have recently verified your agent in your dashboard under “Recent assertions.”

• Company name and email address — used for account management and support.
• Domain name — associated with each widget you create.
• API usage data — counts of verification calls per widget, used to enforce free tier limits and provide usage stats in your dashboard.

We use a single session cookie (av_session or vendor_session) to keep you logged in to your dashboard. This cookie contains a signed JWT and no personal data. It expires when you sign out or after a reasonable inactivity period.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

• AV Holder accounts — retained for the duration of your account validity (365 days) plus a short grace period. You may request deletion at any time.
• Assertion records — verification history is retained for 30 days and then deleted.
• Widget Holder accounts — retained while your account is active. You may request deletion at any time.
• Usage counts — aggregated validation counts are retained for billing/limit purposes for up to 13 months.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Request deletion of your account and associated personal data.
• Revoke your AgentVisa token at any time from your dashboard, which immediately invalidates all active sessions.
• Object to or restrict processing of your data where applicable law permits.

To exercise any of these rights, email info@agentvisa.ai with “Privacy Request” in the subject line. We will respond within 30 days.

AgentVisa tokens are stored as SHA-256 hashes — we never store the raw token value. Widget API keys are stored in our database and are never exposed in client-side code or logs; your server transmits them only over HTTPS to our API. Biometric data never leaves your device. We follow industry-standard practices for access control, secret management, and database security.

If you discover a security vulnerability, please disclose it responsibly by emailing info@agentvisa.ai.

We use the following third-party services to operate AgentVisa:

• Railway — cloud infrastructure hosting. Data is processed in their infrastructure.
• Resend — transactional email delivery (verification codes, magic links).
• Twilio — SMS delivery for phone verification.
• Meta — WhatsApp message delivery via the Meta Cloud API, for users who choose WhatsApp as their verification channel.
• Cloudflare — CDN, DNS, and DDoS protection.

Each of these providers has their own privacy policy and data processing terms. We share only the minimum data necessary with each provider to perform their function.

We may update this Privacy Policy from time to time. For material changes we will notify AV Holders by email before the change takes effect. The “Last updated” date at the top of this page will always reflect the most recent revision.

Questions, concerns, or requests about this Privacy Policy: info@agentvisa.ai