Privacy Policy

Last updated: September 24, 2026

1. What we collect

We never store card numbers. Payments are handled entirely by our payment provider (Stripe); card details never reach our servers.

2. Who can see your documents

No document sits on a public URL. Every download passes an identity and permission check and is written to the audit log:

• You — always, for your own documents.
• Our staff — for review; every access is logged.
• An employer — only under an explicit, time-limited, revocable grant, normally after you are shortlisted. Viewing your profile does not give them your passport.
• A legal partner — only if your case is assigned to them.
• Nobody else.

3. What we do not do

• We do not sell your personal data.
• We do not use your data for third-party advertising.
• We do not share your full name or contact details with an employer before you are shortlisted — until then they see only an anonymous code.
• We do not make automated employment or immigration decisions.

4. Retention

• Account data: for as long as the account is active.
• Documents: until you delete them, or 24 months after last activity.
• Financial and audit records: 7 years, as accounting and compliance rules require.

5. Your rights

You have the right to access, correct, delete and export your data, and to withdraw consent. To exercise any of these: privacy@dreambridgeusa.com — we respond within the period required by applicable law, and ordinarily within 30 days where no shorter period applies.

6. Security

Passwords are stored with scrypt (they cannot be recovered). Documents are stored outside the web root under random names with restricted permissions. Sessions can be revoked immediately. Every sensitive action is written to an append-only audit log.

7. International transfers

By the nature of the service, your data is transferred to the United States to be presented to employers, universities and the competent authorities. Where required, we obtain the consent or other lawful basis required for the transfer. You should review this policy before submitting an application.

8. Sensitive personal information

Some of what you upload is classed as "sensitive personal information" under several state laws: your passport, your immigration-status documents, and any medical record in a travel file. We treat it as such:

• It is used only to deliver the service you uploaded it for — not to infer anything about you, and not for any secondary purpose.
• It reaches an employer only under an explicit, time-limited, revocable grant. An employer reading your profile does not thereby see your passport.
• Every access to it is written to an append-only audit log — including access by our own staff.
• You may ask us to limit its use at any time.

9. Rights of U.S. state residents

If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, or any state with a comprehensive privacy law, you have — in addition to section 5 — the following rights:

• To know: which categories of your data we collected, from where, why, and to whom we disclosed them.
• Access and portability: a copy of your data in a machine-readable format.
• Correction: to fix anything inaccurate.
• Deletion: of your data, except what we are legally required to keep (financial and audit records).
• To limit the use of sensitive data, as in section 8.
• Non-discrimination: we do not deny you a service or change its price because you exercised one of these rights.
• Human review: we make no automated decision producing a legal effect on you. The match score is advisory; a hiring decision is always human.

Sale and sharing: we do not sell your personal information and we do not share it for cross-context behavioural advertising — in any of the senses those laws give the words. We receive no consideration for any personal data.

How to exercise a right: write to privacy@dreambridgeusa.com, or use your account. We verify you through your registered account email, and answer within 45 days, extendable once by a further 45 with notice of the reason. An authorised agent may act for you with written permission. If your request is refused, you may appeal at the same address.

Global Privacy Control (GPC): we do not sell or share your data in the first place, so there is nothing for the signal to switch off — we nonetheless honour it rather than ignore it.

10. Retention, in detail

11. Contact

privacy@dreambridgeusa.com — and for the detailed U.S. terms: United States Terms