Legal

Privacy policy

Last updated: October 13, 2026

The short version

  • We read only what is public on the profiles you enter, plus a web search for your name if you leave it on. We never log in to your accounts or ask for passwords.
  • Your report, the profiles in it and your email are deleted 30 days after the scan.
  • We don't sell your data, we don't post or contact anyone, and we don't give your report to any government unless the law forces us to.
  • We use analytics and advertising cookies (Google, Meta, TikTok). Visitors from the EEA, UK and Switzerland are asked first, everyone can change their choice under Cookie settings, and Global Privacy Control turns the advertising ones off.
  • Email deniz@spacerunners.com to delete your data at any time.

Who we are

Visa Social Check (visasocialcheck.com) is an independent tool that shows visa applicants what is publicly visible on their own social media. It is operated by Space Runners Inc., which is responsible for your data under this policy (the "controller"). We are not affiliated with any government. For anything in this policy, contact us at deniz@spacerunners.com.

What we collect

What you give us

  • For a scan: your visa type, the links to your social media profiles and, if you choose, your email address.
  • Optional questions while the scan runs (for example, when your interview is). The answers are stored in your browser and also recorded as an analytics event (for example, "interview within a month").
  • Contact form: your email, your message and the page you wrote from.
  • Payment: handled by Stripe on its own checkout page. We receive the payment status, amount and your email, never your card details.

What we gather from public sources to build your report

  • Public information from the profiles you enter: name, username, bio, headline, follower and post counts, profile picture link, and recent public posts. For a private profile we keep only the basic details the platform shows publicly.
  • If web search is on: public web results about your name and usernames, such as news, professional pages and public records.
  • What we find, the explanation of each item and your checklist.

What is collected automatically

  • Your IP address, browser and device, the pages you view (including your report link), and how you use them. This is collected by our analytics and advertising providers (see below).
  • Ad-click identifiers when you arrive from an ad, so the advertiser can see whether the ad worked.

How we use it

  • To run the scan and show you your report.
  • To email you, if you gave your address: the link to your report when it is ready, and at most two reminders about that report (one if you haven't unlocked it, one a few days before it is deleted). No newsletters. Every email has a one-click unsubscribe, which removes your address from the report.
  • To take payment and give refunds.
  • To understand how the site is used and improve it.
  • To measure our advertising (whether an ad led to a scan or a purchase).
  • To prevent abuse and keep the service secure, and to meet legal obligations.

Where the GDPR or UK GDPR applies, we rely on performing the service you asked for (scan, report, emails you requested, payment), our legitimate interests (security, improving the service, measuring advertising) and legal obligations. You can object to processing based on legitimate interests.

Who processes your data

We don't sell personal information. These kinds of providers process it on our behalf to run the service:

Hosting and database providers · Running the site and storing reports

Every request to the site, including IP address, and the reports, findings, profile data and email stored for them. Server logs can contain the profile links and email submitted for a scan; they are kept for about a day.

Stripe · Payments (hosted checkout)

Your email and payment details are entered on Stripe, not on our site; we never see your card. We pass Stripe the report ID, plus your IP address, browser and ad-click identifiers so the purchase can be credited to the ad you came from.

Public-data collection providers · Fetching public profile pages and feeds

The profile links and usernames you enter. They load the public, logged-out version of those pages and feeds.

Search, AI research and translation providers · The web search part of the scan

Your name, usernames, profile links and the job, employer, location and education shown on your public profiles, to search news, court records and other public sources and to translate non-English results. Also anything you type into "Find my profile".

Internet Archive · Archive check in your report

Your browser (not our server) asks the Wayback Machine whether your profile links were archived.

Email delivery provider · Sending the emails described below

Your email address and the content of those emails.

Product analytics provider · Analytics and session replay

Pages viewed, clicks, device and browser, approximate location, and recordings of how the page is used. Everything typed into form fields, and the profile results we show you, are masked in recordings.

Google (Analytics and Ads) · Analytics and ad measurement

Pages viewed (including your report link), funnel events such as starting a scan or paying, and ad-click identifiers. The server also sends Google Analytics the purchase.

Meta (Facebook/Instagram) Pixel and Conversions API · Ad measurement

Pages viewed and funnel events from your browser. When you pay, our server sends Meta the purchase with a hashed (SHA-256) copy of your email, your IP address, browser and Meta cookie identifiers.

TikTok Pixel and Events API · Ad measurement

Pages viewed and funnel events from your browser. When you pay, our server sends TikTok the purchase with a hashed copy of your email, IP address and browser.

Several of these providers are in the United States, so your data may be processed outside your country. Where required, transfers rely on the providers' standard contractual clauses or equivalent safeguards. We may disclose information if a valid legal order requires it.

Cookies and pixels

We use cookies and similar technologies for analytics (Google Analytics and a product analytics provider) and advertising measurement (Google Ads, Meta, TikTok). We also store small items in your browser to remember your progress, such as the items you marked as handled in a report and the answers to the optional questions, and a cookie that remembers your cookie choice. These stay on your device.

If you visit from the EEA, the UK or Switzerland, we ask first. Until you click Accept, the analytics and advertising cookies aren't set, the Meta and TikTok pixels don't load, session recording is off, and we don't send your purchase to any ad platform. Google's tags run in Consent Mode and may send limited signals without cookies, which Google uses for aggregate measurement.

Everyone can accept or reject at any time with Cookie settings at the bottom of every page. If your browser sends Global Privacy Control, the Google Ads, Meta and TikTok pixels don't load and we don't send your purchase to Meta or TikTok. You can also block or delete cookies in your browser, or use Google's ad settings and Meta's ad preferences.

How long we keep it

  • Your report, the profile data, findings and checklist in it, and your email: deleted 30 days after the scan. A free re-check is a new report with its own 30 days.
  • Unsubscribing removes your email from the report immediately.
  • Payment record: we keep the date, amount, visa type and the Stripe payment reference, with no profile data, for accounting and refunds. Stripe keeps its own payment records as the law requires.
  • Contact messages: deleted after 12 months.
  • Temporary copies of public pages and search results, kept to avoid fetching the same page twice: deleted within two days.
  • Server logs: about a day. Analytics and advertising data: kept by those providers under their own retention settings.

Your choices and rights

  • Email deniz@spacerunners.com with your report link to have the report and your email deleted now, rather than after 30 days.
  • Depending on where you live (for example under the GDPR, UK GDPR or California law), you can ask to access, correct, delete or receive a copy of your data, to restrict or object to processing, and to opt out of the "sharing" of data for advertising. We answer within 30 days and won't treat you differently for asking.
  • You can also complain to your local data protection authority.

Security

Data is encrypted in transit and access to our systems is restricted. Your report has no login: anyone with its link can open it, so treat the link like a password and share it only with people you trust.

Children

The service is for visa applicants and is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

When we change how we handle data, we update this page and the date at the top.