How your data is processed
Last updated
The business that sent you this link uses a software provider to collect your answers and prepare and file your DS-160. This page explains how that provider handles your information. The business is responsible for it; its privacy notice, linked at the bottom of this page, says what it collects, why, and your rights.
The agreement
The provider works under a written data processing agreement with the business, as data protection law requires (Article 28 GDPR). Under it the provider:
- uses your information only on the business’s instructions, and only to prepare and file your DS-160;
- binds everyone who can reach your information to confidentiality;
- opens your application only with the business’s permission, to fix a problem;
- tells the business within 48 hours if a security breach affects your information;
- helps the business answer your requests to access, correct or delete your information, and deletes it within 30 days when the business asks;
- uses other services only under written agreements that protect your information at least as well.
How your information is protected
- Encrypted when stored: your answers, their history, your messages, the filing records and the records of each filing are encrypted (AES-256), with a key kept apart from the database and its backups.
- Encrypted in transit: every page is served over HTTPS.
- The provider’s own servers, in locked premises in the United States, run the database and the browser that files your DS-160.
- Limited access: only the provider’s team can reach the systems, and changes they make are recorded as theirs.
- Backups are kept for 7 days.
Services the provider uses
| Service | What for | Location |
|---|---|---|
| Backblaze (B2) | Storing photos, documents and filed-application PDFs | United States |
| Google (Gemini API) | Translating free-text answers into English; extracting the details on a passport scan when you or the business’s staff ask | United States |
| Amazon Web Services (SES, S3) | Sending and receiving the emails about your application | United States |
| PostHog | Measuring how these pages are used | United States |
| Google (Analytics) | Measuring how these pages are used | United States |
Each is bound by a written agreement, and transfers to them rely on the EU-U.S. Data Privacy Framework or standard contractual clauses.
Filing with the US government
Filing your DS-160 sends your answers to the US Department of State on CEAC. The Department of State receives them as the authority you are applying to, not as a service the provider uses, and the copy it holds is outside the provider’s and the business’s control.