Privacy Policy

1. About this policy

This policy explains how SoftNuvia handles information in the Indian Visa Form Auto Fill Max browser extension and its companion website at indianvisa-bangladesh.softnuvia.com. SoftNuvia is an independent software service, not an Indian or Bangladeshi government agency, embassy, consulate or visa application centre.

The extension helps you import documents, organise applicant profiles, prepare supporting documents and fill supported visa forms. This policy covers both information processed on your device and information received by our website. The government websites you use have their own privacy policies.

2. Information we handle and why

Information	Purpose and location
Applicant profiles and selected documents	Names, birth dates, nationality, passport identifiers, contact details, travel details, photographs and other fields contained in files you import or profiles you enter. Supporting documents can contain family, employment, education, financial or medical information. These are processed for extraction, document preparation and autofill. BGD PDF parsing and local passport OCR run on your device. In Monster AI cloud mode, selected passport page images and their contents are processed by SoftNuvia and Cloudflare Workers AI as explained below.
Visa page content and application identifiers	Supported form fields, temporary/application IDs, page addresses and relevant request information are used to fill forms, resume applications and download application documents. This is not a general browsing-history collection service.
Website account and connection data	Name, email, optional WhatsApp number, password hash, login/session records and extension authorisation records support your account and connected extension. The extension stores its connection token in extension-local storage so sign-in can persist after closing the panel or browser. The connection remains valid until sign-out or revocation, subject to account status and security checks.
Payments and service activity	Selected plan, amount, payment provider, sender number, transaction reference, optional notes, credit entries and review status are stored on our server to administer purchases and resolve disputes. Service requests may include an operation type, request identifier and completion status; these metadata are distinct from passport or PDF contents.
Support and technical information	Contact-form name, email, subject and message are stored for support. Hosting and security systems may process IP addresses, browser/request details, timestamps and error records for delivery, diagnostics and abuse prevention.

We do not ask for your mobile-wallet PIN, payment OTP or card security code. Do not include these, or unnecessary passport and medical documents, in support messages.

3. Local processing, Monster AI cloud OCR and autofill

Local mode: BGD PDF extraction and local passport OCR run in your browser using bundled processing libraries. Saved profiles, selected attachments, preferences and application-ID records use extension-local storage.

Monster AI cloud mode: The administrator selects the passport OCR mode. When cloud mode is enabled and you start passport extraction, the extension prepares selected passport pages as images and sends them over HTTPS to the SoftNuvia companion service. Our server forwards those images to Cloudflare Workers AI to read the document and returns extracted text and profile fields to the extension for your review. Images may contain passport numbers, photographs, dates of birth, addresses, family and emergency-contact details. Cloud OCR is not on-device processing. If you do not want this transfer, do not start cloud extraction; local passport OCR is available when the administrator selects local mode.

Purpose and retention: The OCR endpoint processes images and extracted text for the requested extraction and does not save them to our application database or a document archive. We retain separate job, credit and account activity metadata to administer the service. This does not mean that every infrastructure or provider record has zero retention; technical records and third-party processing are described below. SoftNuvia does not use these documents to train AI models. Cloudflare states that Workers AI customer content is not used to train models or improve its or third-party services without explicit consent; see Cloudflare Workers AI data usage. Processing may occur outside your country.

Local storage is not the same as anonymous or encrypted storage. Anyone with access to your browser profile or device may be able to access it. Use a trusted device and protect exported files and backups.

When you enable autofill, automatic navigation or document/photo filling, the extension can place your selected profile information and attachments into supported government forms. Those websites may receive information as their forms run or are submitted. Review your selected profile and the destination before enabling automation. Exporting or downloading a profile or PDF creates a separate file under your control.

3A. CapNuvia AI CAPTCHA recognition

Cloud processing: CapNuvia is a separate AI recognition service for CAPTCHA images on supported visa pages. When the service and your extension setting are enabled, recognition may run automatically. The extension sends the CAPTCHA image over HTTPS to the SoftNuvia companion service, which forwards it to Cloudflare Workers AI using the administrator-selected model. The recognized answer is returned to the extension to help fill the CAPTCHA field. Retrying or refreshing and recognizing a new image can create additional requests. This recognition request is for the CAPTCHA image; it is separate from Monster AI passport extraction.

Information and purpose: We process CAPTCHA images, recognized answers and provider responses, together with request identifiers, timestamps, model and connection details, operation duration, success or error status, and account identifiers. Request logs can be linked to your account name and email. We use this information to provide recognition, troubleshoot failures, monitor usage, apply rate limits and account for credits.

Stored logs and administrator access: Unlike the passport OCR endpoint described above, CapNuvia request logs may store CAPTCHA images, recognized answers and provider response or error details in the application database. Authorized administrators can view these logs for service operation and support. Do not include unrelated personal information in images submitted for recognition.

Retention and deletion: Success and error logs follow the administrator-configured retention period. Automatic cleanup runs hourly and removes logs older than the selected period; if automatic deletion is disabled, logs remain until an administrator clears them or a deletion request is handled. Account, credit and security records may have separate retention requirements, and backups may remain until their normal replacement cycle. Contact [email protected] to request access or deletion of logs associated with your account. Provider and infrastructure records are subject to their own policies; immediate deletion or zero retention is not guaranteed.

Your controls: You can turn off CapNuvia in extension Settings and enter the CAPTCHA manually. Turning it off stops new recognition requests from the extension but does not delete existing logs. Where available, retry, refresh and stop controls let you manage recognition attempts. Review the returned text before continuing; accuracy and response time vary.

Provider processing: CAPTCHA images and request data may be processed outside your country by Cloudflare. The Cloudflare processing and international-transfer disclosures in this policy also apply to CapNuvia. We do not sell this information or use it for personalized advertising, and SoftNuvia does not use submitted CAPTCHA images to train AI models.

4. Browser permissions

• Storage: save profiles, attachments, preferences and connection state.

• Side panel: display the extension workspace alongside visa pages.

• Active tab and scripting: interact with supported page fields and run the selected autofill and document tools.

• Downloads: save requested PDFs, application documents and exported profiles.

• Web request access: support relevant visa-page request and document workflows on permitted sites.

• Website access: operate on supported Indian visa domains and connect to the portal origin you approve. Development builds can also include localhost access; that is not a reason to grant access to unrelated sites.

You can manage site access, disable automation or remove the extension in Chrome. Denying a permission can prevent the corresponding feature from working. We do not use these permissions to monitor unrelated browsing or target advertising.

5. Sharing and limited use

We do not sell personal information, use applicant information for personalised advertising, or transfer it to data brokers. Information handled through the extension is used to provide its stated user-facing functions, maintain security and meet applicable legal obligations. Our use and transfer of extension user data follow the Chrome Web Store User Data Policy and its Limited Use restrictions.

For Monster AI cloud OCR, selected passport images and their contents are shared with Cloudflare Workers AI through our server. For CapNuvia, CAPTCHA images are also shared with Cloudflare Workers AI through our server, and authorized administrators can review recognition logs as described in section 3A. Information may also be disclosed to service providers needed to operate the portal, the visa website you choose to use, support providers you choose to contact, or authorities where disclosure is legally required. Any service-provider access is limited to the operational purpose. We do not give staff routine access to documents stored only on your device. Authorised administrators can review server-held account, payment and support records as needed; documents you voluntarily send to support can be read by support staff.

If ownership of the service changes, any transfer of personal data must remain subject to these commitments and applicable law. We will provide notice of material changes.

For account security and service analytics, we record successful sign-ins and authenticated extension activity with account ID, timestamp and IP address, approximate device type, operating system, browser and traffic source. Referral tracking stores only the referring domain, not the full URL or query string. Activity records are retained for up to 90 days. We use trusted Cloudflare headers when available; if location is unavailable, the IP address is sent over HTTPS to ipwhois for approximate country/city lookup and cached for up to 24 hours. Location may be inaccurate. These records are accessible to authorised administrators. Document contents, passwords and authentication tokens are not included in this analytics log.

6. Cookies and third-party services

The website uses session and security cookies for sign-in, form protection and account workflows. Hosting infrastructure and Cloudflare process requests to deliver and protect the site; Cloudflare Web Analytics may also receive page-load and performance information on the website. These website services are separate from local document processing. Cloudflare Workers AI also processes passport images when Monster AI cloud OCR is used (section 3) and CAPTCHA images when CapNuvia is used (section 3A).

Embedded tutorial videos use YouTube's privacy-enhanced player. Loading or playing the player can still disclose network and device information to YouTube/Google. WhatsApp support opens WhatsApp when you select it. Telegram or Tawk.to may be available if enabled; using them shares information with the selected provider under its own policies.

When enabled, Cloudflare Turnstile protects direct email login, signup and password-reset requests. Cloudflare processes browser and network signals for abuse prevention; our server validates the resulting token. Social sign-in does not require this Turnstile check.

If a social sign-in option is offered and you choose it, the provider shares an account identifier, name and email to create or authenticate your account. We do not receive your provider password. Our current sign-in integration does not request access to your email messages, Drive files or contacts. External providers may process information outside your country.

7. Retention, deletion and your choices

Extension-local profiles remain until you delete them, clear extension data or remove the extension. Exported files and backups must be deleted separately. Disconnecting or signing out of the portal does not automatically erase local applicant profiles.

Server records are retained while needed for account operation, payment reconciliation, fraud prevention, support and applicable recordkeeping duties. There is no single fixed retention period for every category. Deletion requests are reviewed against those purposes; records that must be retained are restricted to those purposes. Backup copies may remain until the relevant backup cycle expires.

You can edit account details in account settings, revoke extension sessions and manage browser permissions. To request access, correction, account closure or deletion of server-held data, email [email protected] or use our contact form. We may ask for proportionate proof of account ownership. We will explain any information we must retain. Rights and response requirements depend on applicable law; you may also contact your relevant privacy regulator.

8. Security and applicants' authority

The live portal uses HTTPS, password hashing and account-access controls. No system can guarantee absolute security. Keep your device, browser and credentials secure and tell us promptly about suspected unauthorised access.

The service is intended for adults and authorised representatives. If you process another applicant's information, including a child's or sensitive medical information, obtain the required authority and consent before importing or sharing it. We do not knowingly invite children to create accounts independently.

9. Policy updates

We will update this page and its revision date when practices change. Material changes will be brought to users' attention through the service where appropriate. A materially different collection or use of sensitive information requires the disclosures and consent applicable to that change; this policy is not blanket consent for future uses.

QUESTIONS OR REQUESTS?

Contact SoftNuvia

For privacy, access or deletion requests, contact our support team.

[email protected] ↗যোগাযোগ ফর্ম · Contact form →