Privacy Policy

1Who we are

IVAC AI Guru Autofill (“the extension”) is a Chrome extension that reads a passport or a BGD application PDF into an applicant profile and fills in the Indian visa application form at indianvisa-bangladesh.nic.in. It is made and run by We Will Rise (“we”, “us”), which also runs the server at wewillrise.online that the extension uses for its paid features.

This policy covers the extension and that server. It does not cover the IVAC website, which has its own operator and its own policies.

2What stays in your browser

Most of what the extension handles never leaves your computer. It is kept in the extension’s own storage inside Chrome, which is not synced to your Google account and is not sent to us:

• Applicant profiles: the details the visa form asks for, such as names, date and place of birth, gender, religion, education, national ID and passport details, addresses, phone numbers and email, parents’ and spouse’s details, occupation and employer, any past military or police service, travel plans, previous visits and visa refusals, place of stay and references, and — for medical, attendant, student or business visas — the hospital, doctor, illness, patient, institution or company details you enter.
• Answers you type while extracting a passport (such as email, mobile, address, religion, education, occupation, hotel and ports), remembered so they are filled in for you next time.
• The applicant photo, resized to 350 × 350, and the passport copy, kept both as you attached it and as a PDF sized for IVAC’s Document Upload page. A passport attached next to a BGD application PDF is kept here too, and is never sent to our server.
• The Temporary Application ID the IVAC website shows after Basic Details is saved. The extension reads it from that page and saves it with the profile so you can copy it later.
• Your settings, your sign-in token and email, and your last known balance and prices.

You can view, edit and delete a profile at any time. Deleting a profile also deletes its passport copies, “Clear” removes the saved photo, signing out removes the sign-in token, and removing the extension from Chrome deletes everything it stored. The extension does not encrypt this storage, so anyone who can use your Chrome profile could open it: use the extension on a computer only you use.

3What is sent to our server

The extension talks to our server only over HTTPS, and only for the features below. Our server reads files with open-source text-recognition software that runs on the server itself: no file or detail is passed to any outside AI, OCR or cloud service.

Your account

When you create an account or sign in, the extension sends your email address and password. We store your email, a salted hash of your password (never the password itself), the dates you joined and last signed in, and a sign-in token, which signing out deletes.

Passport extraction

When you extract a passport, the photo or scan you chose is sent to be read; a PDF is first turned into an image in your browser. The server reads the passport’s details — such as names, date and place of birth, passport and national ID numbers, parents’ and spouse’s names, address and emergency contact — and sends them back to your browser, where they become a profile. Neither the file nor the details are stored on the server, and the charge is recorded without anything from the passport.

BGD application PDF

When you extract a BGD application PDF, the PDF is sent to be read and the details on it are sent back to your browser. Neither the PDF nor its details are stored, with one exception: the charge records the application’s Temporary Application ID — or, if the PDF has none, its passport number — so that a charge can be matched to the application it was for.

Captcha

When you press “Solve captcha”, or turn on “Auto-read the captcha”, the captcha picture on the IVAC page is copied and sent to be read. The answer is typed into the page for you to check. The picture is not stored; the answer’s text is noted on the charge.

Adding balance

When you report a bKash or Nagad payment, the extension sends the amount, the provider, the mobile number you paid from, the transaction ID and the number you paid to. We keep these so an administrator can check them against the bKash or Nagad statement and add the money to your balance. You make the payment in bKash or Nagad yourself; we never see your PIN or your wallet login.

Balance and prices

When you open the extension while signed in, it asks the server for your balance and the current prices.

Server logs

Like almost every web server, ours automatically records basic details of each request — the IP address, date and time, the address requested, the result and the browser’s user agent — to keep the service secure and to fix problems. These logs do not contain your files or the details read from them.

4What goes to the IVAC website

When you press Autofill — or with “Auto-fill next page” turned on — the extension types the chosen profile into the form on indianvisa-bangladesh.nic.in, and on the upload pages it puts the saved photo and passport copy into the website’s own upload boxes. The IVAC website receives this information when a page is saved, uploaded or continued, by you or, with “Auto-click Continue” turned on, by the extension. The extension never presses the final Submit. What the IVAC website does with your information is up to its operator, not us.

On IVAC pages the extension reads the page only to find the form’s fields, the captcha picture and the Temporary Application ID. It does not run on, read or record any other website.

5How we use information

Only for the extension’s single purpose — helping you fill in the Indian visa application — and what it needs to run:

• reading the documents you choose into profiles, and reading the captcha;
• filling in the IVAC form and uploading your files to it, when you ask;
• running your account: sign-in, balance, charges and payments;
• keeping the service secure and preventing abuse, for example by limiting sign-in attempts and accepting each payment transaction ID only once;
• answering your messages and fixing problems.

We do not use your information for advertising, profiling or credit decisions, or for anything unrelated to the extension. Uploaded files are not kept, so they are never used to train or tune our software.

6Sharing

We do not sell, rent or trade your information, and we do not share it with advertisers, data brokers or anyone else, except:

• the company that provides the machine our server runs on, only as part of hosting it;
• when the law requires it, or when it is needed to protect our users or the service from fraud or abuse;
• a new owner, if the extension is ever transferred, in which case this policy continues to apply to your information.

Payments are made in bKash or Nagad under their own terms; we send them nothing about you.

7Chrome Web Store Limited Use

The use of information received by this extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide and improve the extension’s single purpose, we do not transfer it except as described in this policy, and no person reads it — apart from the administrator of We Will Rise, who sees account, charge and payment records only to confirm payments, answer your requests, resolve billing problems, or for security and legal reasons.

8Permissions the extension asks for

• Storage — to keep your profiles, files, settings and sign-in in your browser.
• Scripting — to refresh the IVAC form’s drop-down lists after filling them. Only code built into the extension runs; nothing is downloaded.
• Tabs and windows — to open the extension in its own window, open its profile editor, and work with the IVAC tab you are filling. They are not used to read or record your browsing history.
• Access to indianvisa-bangladesh.nic.in — to show the Autofill panel there, fill in the form, put your files into its upload boxes, and read the captcha picture and the Temporary Application ID.
• Access to wewillrise.online — to reach our server.

9Security

• Everything sent between the extension and our server is encrypted with HTTPS.
• Passwords are stored only as salted hashes, sign-in attempts are rate-limited, and signing out revokes your sign-in token on the server.
• Files sent to be read are handled only while the request runs and are never saved to our database or kept as files.
• Access to the server and its admin pages is limited to the administrator of We Will Rise.

No system is perfectly secure, so we cannot promise that information will never be lost or misused. If we learn of a breach that puts your information at risk, we will tell you.

10How long we keep information

• In your browser: until you delete it or remove the extension.
• Files sent to be read, and the details read from them: not kept after the request.
• Your account (email, hashed password, balance): for as long as the account exists.
• Charges, deposits and payment reports: kept as the financial record of your balance for as long as the account exists, and afterwards for as long as needed for accounting, to resolve disputes and to prevent fraud.
• Your sign-in token: until you sign out.
• Server logs: only as long as needed for security and troubleshooting.

We also keep backup copies of our database to recover from failures, so information you delete can remain in a backup until that backup is removed.

11Your choices and rights

• See and correct: your profiles are in the extension, where you can view and edit them. For your account, email us for a copy of what we hold about you.
• Delete: delete profiles, or remove the extension, to erase what is in your browser. To close your account, email us from your account’s email address: we will revoke your sign-in, deactivate the account and delete or anonymise your email, keeping only the charge and payment records described above.
• Stop sending data: the extension contacts our server only when you sign in, open it while signed in, extract a document, solve a captcha or report a payment. Turn off “Auto-read the captcha” to stop captcha pictures being sent without a click.

We reply to requests within 30 days.

12Other people’s information and children

If you enter someone else’s details — as a travel agent, or for a family member — make sure you have their permission to use them with the extension. The extension is meant for adults, and children should not create accounts; a parent or guardian may use it to fill in a child’s visa application.

13Changes to this policy

We post every change on this page with a new “Last updated” date. If a change affects what the extension collects or how it uses your information, the extension shows you the new terms and asks you to agree before it handles your information in the new way.

14Contact us