Privacy policy

DS160 Easy helps you prepare a U.S. DS-160 visa application in your language and, if you choose, file it with the official Consular Electronic Application Center (CEAC). This policy explains what personal data we handle, why we handle it, and the choices you have.

We run this service under the brand DS160 Easy. We are an independent product. We are not part of the U.S. government, and you can still complete a DS-160 for free on CEAC. Questions about this policy or about personal data go to contact@ds160easy.com.

Who this policy covers

• Visitors who browse ds160easy.com.
• Account holders with a DS160 Easy login: people filling their own (or a family member’s) form, staff of a visa agency, and affiliates.
• Applicants whose DS-160 is prepared on DS160 Easy. An applicant may be the account holder, a family member, or a client of an agency.
• Agency clients who receive a fill link from an agency workspace.

Our role

Personal data	Our role
Applicant answers in an individual account	We decide why and how this data is used to provide the service.
Applicant answers in an agency workspace	The agency decides why and how its clients’ data is used. We process that data to run the workspace the agency asked for.
Account, billing, and affiliate data	We decide why and how this data is used to run accounts and payments.
Visitor usage data on the marketing site	We decide why and how this data is used, including optional analytics if you accept cookies.

If an agency prepares a form for you, that agency should give you its own privacy notice. Requests about that client file should go to the agency first. We help the agency answer them.

Personal data we process

About applicants

Application answers. Everything the DS-160 asks: names, date and place of birth, nationality, passport and national ID details, addresses, phone numbers, email addresses and social media identifiers; travel plans and travel history; family; education and work; and the security and background questions.

Health and criminal history. The official form asks about health (for example certain diseases or conditions) and about arrests, convictions, and similar matters. We process those answers only because the U.S. government requires them on the DS-160, and only to complete and file the application you asked for.

Visa photo. The photo you capture or upload for the application. We check it in the product (size, format, face position). We do not send the photo to a separate vendor just to run that check.

Passport details from the machine-readable zone. If you use the passport scan helper, the reading happens on your device. When you continue from a phone to a computer, the lines travel in an encrypted handoff. Our servers store ciphertext we cannot read. Suggested answers are not saved onto the form until you choose them.

Filing records. When a form is filed on CEAC: the Application ID, the security question used to retrieve it, confirmation pages, and PDFs of what CEAC showed back.

Edit history. Changes to answers, who made them, and when, so you or the agency can see what changed.

About account holders

Account data. Email address, name if you give one, language, and role (client, agency, affiliate, or admin). We do not use a password. You sign in with a one-time code or magic link sent to your email. If you choose “Continue with Google,” we receive your Google identity and email.

Agency workspace. Workspace name, staff, branding, and the fill links sent to clients.

About payments

When you pay to file, Stripe processes the card or Pix details. We receive a payment reference, amount, currency, and status. We never see a full card number.

About support, affiliates, and visitors

Support. What you send through the contact form or by email, including your email address so we can reply.

Affiliates. Coupon code, payout details you give us (for example a Pix key, stored encrypted), and referral activity needed to credit a sale.

Usage and logs. Pages visited, device and browser, IP address in technical logs, and in-product events we need to run and debug the service.

Marketing-site analytics. If you accept optional cookies, Google Analytics measures visits. See Cookies.

Why we use this data

• Provide accounts, store your answers, translate them after payment, and file the DS-160 on CEAC when you confirm.
• Take payment and keep records we need for accounting.
• Send service email (sign-in codes, filing status, receipts).
• Keep the service secure, investigate failed filings, and prevent abuse.
• Improve the product from aggregated usage, not by selling application answers.
• Answer support messages and run the affiliate program you joined.

We do not sell personal data. We do not use DS-160 answers to advertise to you.

Who we share it with

U.S. Department of State / CEAC. Filing means entering the applicant’s answers on the official site. That transfer is the service you requested. Once filed, that copy is outside our control.

The agency, for applicant data in its workspace. Its staff can see and edit the answers and filing records.

Service providers that help us run DS160 Easy, each only for the purpose below:

Provider	What it does	Data involved
Cloudflare	Hosts the marketing site and the product app	Visitor and account traffic needed to deliver the pages
Stripe	Card and Pix payments	Payment details, amount, status
Resend	Sends sign-in and service email	Email address and message content
Google	Optional sign-in; optional site analytics; translation when Gemini is the active AI provider	Google identity; usage data if you accept analytics cookies; text sent for translation
OpenAI or Anthropic	Translation and transliteration when that provider is active	The answers being translated
Amazon S3	Optional storage of CEAC confirmation PDFs	Filing documents, if that storage is enabled

We may also disclose data if the law requires it.

How long we keep it

• Accounts, application answers, photos, filing records, and edit history stay while the account or agency workspace exists.
• If you ask us to delete your data, we delete what we hold, except payment and accounting records the law requires us to keep, and except what already went to CEAC.
• Technical logs and diagnostic records of a filing attempt are kept only as long as we need them to run and secure the service, then removed.
• Sign-in codes expire after a short time. Sessions end when you log out or the refresh token expires.
• Backups may hold a copy for a short extra period after deletion, then rotate out.

Deleting data at DS160 Easy does not delete a DS-160 already held by the U.S. Department of State.

Cookies

The product needs a signed-in session, your language, and a few interface preferences to work. Those are not advertising cookies.

On the marketing site we may use:

• A first-party consent cookie so we remember your analytics choice.
• Google Analytics 4, only if you accept optional cookies. It can set cookies such as _ga. You can accept or reject them in the banner, and change your mind later from the footer.

We do not use advertising cookies on the site today.

Security

Traffic to DS160 Easy uses HTTPS. Access to production systems is limited to the team that operates the service. API keys, gateway secrets, and affiliate Pix keys are stored encrypted. Visa-photo and passport helpers keep sensitive material on your device or in ciphertext whenever the product is built that way.

Staff do not open an application unless we need to investigate a problem you (or an agency admin) asked us to look at.

Email is different: a message travels through mail servers we do not control. We send mail over an encrypted connection to our email provider.

Your rights

Depending on the privacy laws that apply to you, you may be able to:

• access the personal data we hold and receive a copy;
• correct it if it is wrong (you can edit most application answers yourself);
• ask us to delete it;
• restrict or object to certain processing;
• receive it in a portable format;
• withdraw consent for optional analytics cookies.

Write to contact@ds160easy.com from the email on the account where there is one. Applicants whose form lives in an agency workspace should contact that agency first.

You may also have the right to complain to a data protection authority where you live or work.

Children

DS160 Easy accounts are for adults. A parent, guardian, or authorised agency may prepare a DS-160 for a child and is responsible for providing that child’s data.

Changes

When this policy changes, the date at the top changes with it. If a change affects how we use data we already have, we will email account holders before it takes effect.

Contact

Questions about this policy or about personal data: contact@ds160easy.com.