Privacy Policy

Verified Letters (operated by Jifu LLC, "we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal information when you use the Site or our document facilitation services. By using the Site, you agree to the practices described here.

Questions about this policy or your data? Contact us at [email protected].

1. Information We Collect

We collect only the information you voluntarily provide or that is necessary to deliver our service:

• Lead form submissions — name, email address, letter type requested, destination country, nationality, target embassy, and details of your situation (including, where relevant, medical treatment information you choose to share).
• Case data — once you become a client, information needed to draft your letter: passport-style details, treatment or sponsor information, and the letter text itself. This data is stored in a separate, access-controlled case database.
• Email correspondence — when you email [email protected], we receive your address, message content, and standard headers.
• Technical data — standard web logs (IP address, browser type, pages visited, timestamps) and Google Analytics 4 usage data.

2. How We Use Your Information

• Service delivery — to quote, draft, verify, and deliver your letter; to coordinate with licensed partner institutions on your behalf.
• Verification — to operate the document verification portal (embassies and officials may check letter authenticity using the reference code you receive).
• Responding to inquiries — to reply to questions and requests submitted through the form or email.
• Improvement — to understand client needs and improve service quality.
• Legal compliance — to comply with applicable laws (including Thailand's Personal Data Protection Act B.E. 2562) and legal requests.

We do not use your data for automated decision-making or profiling.

3. Sensitive Data & Legal Basis

Some of our letters relate to medical treatment, which Thai PDPA and EU GDPR classify as sensitive personal data. Where you provide such information:

• We collect it only with your explicit consent, given when you submit the form or otherwise share it with us.
• It is used only for the specific purpose of drafting your requested letter and is never used for marketing.
• Your consent can be withdrawn at any time by emailing [email protected] — withdrawal does not affect processing already completed with your consent.

4. Data Storage & Retention

• Storage location — data is stored on secure servers managed by our hosting providers (primarily data centers in Europe and Singapore), contractually bound to maintain industry-standard security.
• Retention — we retain lead form submissions for up to 24 months after last contact. Case records are retained for as long as needed to support your letter's verification, plus any period required by law, after which they are deleted or anonymized. Access logs are retained for up to 30 days.
• Deletion — you may request deletion of your personal data at any time (subject to legal obligations to retain certain records).

5. Third-Party Sharing & Cross-Border Transfer

We do not sell, rent, trade, or share your personal information with third parties for their marketing purposes.

We may share information only in these limited circumstances:

• Partner institutions — with the licensed institution that issues your letter, only to the extent needed to issue it (e.g., confirming your treatment or appointment details).
• Service providers — with trusted providers who help operate the Site and deliver services (hosting, email delivery, payment processing, analytics). They are contractually prohibited from using your data for any other purpose.
• AI processing — letter drafts are prepared with the assistance of AI language models. Where the model provider processes data outside Thailand, we rely on appropriate safeguards and your consent under PDPA S.28.
• Legal obligations — we may disclose information if required by law or in good-faith belief that such action is necessary to comply with legal obligations or protect the rights, property, or safety of Jifu LLC, our users, or others.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction; we will notify you of any change in ownership or control.

6. Cookies & Analytics

Our Site uses cookies and similar technologies to improve your experience and understand how visitors use it.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help sites remember preferences and understand how visitors interact with the site.

Cookies We Use

• Essential cookies — necessary for the Site to function (e.g., form anti-abuse timers, session handling).
• Analytics cookies — Google Analytics 4 (property G-4537116077) collects anonymized usage data: which pages are visited, how users navigate, what devices they use. This helps us improve the Site.

You can block or delete cookies through your browser settings. Blocking essential cookies may prevent the lead form from working.

7. Your Rights (PDPA / GDPR)

If you are in Thailand, the EU, or otherwise covered by PDPA or GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest or for direct marketing.
• Withdraw consent — withdraw consent at any time for processing based on consent.

To exercise any of these rights, email [email protected]. We respond to verified requests within 30 days. If you are in Thailand, you may also lodge a complaint with the Office of the Personal Data Protection Committee (PDPC) at pdpc.or.th.

8. Security Measures

We implement reasonable technical and organizational measures to protect your data: encryption in transit (TLS 1.2+), access controls on the case database and verification portal, rate limiting on public endpoints, spam/bot suppression, and regular security reviews. However, no method of transmission over the internet is 100% secure — we cannot guarantee absolute security.

9. Children's Privacy

The Site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. Changes are posted on this page with an updated revision date. Material changes will be highlighted on the Site or notified by email where we have your address.

Entity: Jifu LLC · Contact: [email protected] · This policy is a service notice, not legal advice. For formal legal guidance, consult a qualified attorney.