Privacy
Policy

We use information you send to respond to inquiries, answer questions, handle collaboration requests, communicate with partners, respond to institutional or government inquiries, and improve support and communication.

The website includes Vercel Web Analytics and Speed Insights to understand general usage and improve performance. When enabled on the live website, they process page URLs and views, visit times, approximate country or region, referrers, browser and device information, operating system, network speed and page performance measurements. Reports provide aggregate statistics and do not show us full IP addresses. See the privacy information for Vercel Web Analytics and Vercel Speed Insights. VAFI interaction records are separate from these aggregate reports.

Visit Afghanistan does not set its own advertising or non-essential tracking cookies. Vercel Web Analytics operates without cookies. Browser storage keeps the active VAFI conversation and visitor identifier, caches exchange rates and helps return you to a selected search result. A VAFI browser-session identifier uses sessionStorage. Embedded maps, videos and security services may process device information or use cookies or similar technology under their providers’ policies. Clearing site storage removes local VAFI data but does not delete server records.

VAFI uses OpenAI, an external AI provider, to moderate messages and generate answers. Up to eight recent eligible messages, including your questions and earlier answers, are sent through our server to OpenAI for context and safety checks. Questions are limited to 1,500 characters. Usage limits are 10 requests per 10 minutes and 50 per 24 hours, applied to both the visitor identifier and IP address; starting a new chat does not reset them.Our server receives random visitor, browser-session and conversation identifiers, the selected language and topic, a message count and recent message text. Firestore interaction records store those identifiers, the latest question in full, an answer preview of up to 160 characters (plus an ellipsis when shortened), server time, language, topic, message count, token usage when available, request outcome and approximate country/region from the hosting platform when available. A feedback field is currently left empty. Records can also cover blocked, rate-limited or failed requests after validation.This usage information helps us understand popular questions, detect abuse, assess answer quality and improve VAFI’s accuracy and services. We are not developing or training our own large language model (LLM) using visitor conversations. Random identifiers do not make conversations anonymous: questions and answer previews may contain personal information you provide. Avoid entering sensitive personal information or information about others.

Visit Afghanistan does not sell visitors’ personal information to advertisers.

Visit Afghanistan links to news publishers, government websites, embassies, tour operators, hotels, restaurants, Instagram, YouTube, TikTok, Snapchat and other third-party websites. Following a link takes you to a provider that controls its own data practices. Embedded maps, videos, remote images and the exchange-rate tool can connect your browser to external providers, which may receive your IP address, browser information and referrer. We do not control external websites’ collection or processing. Review their privacy policies before using their services.

The seven-day inactivity rule applies only to the local VAFI conversation, as explained below. Firestore interaction records have no automatic deletion period implemented in the application. No fixed retention period for these records, contact emails or direct correspondence is currently published. They are not automatically deleted when you start a new chat or clear browser storage.Firestore protection records contain expiry timestamps for usage windows and request or duplicate locks. An expired limit or lock stops being enforced, but this does not by itself delete the stored document. No database TTL deletion policies were enabled when checked for this update. Automatic TTL cleanup requires a separately configured policy; no automatic deletion deadline is currently confirmed. Provider logs, mailboxes and backups may have separate retention under their settings and terms. Contact us about retention or deletion; applicable requirements may affect what can be removed.

We use server-side validation, request-size and origin checks, hidden-field and fill-time spam checks, Cloudflare Turnstile and shared Firestore rate limits and duplicate detection. Contact submissions are limited to 3 per 10 minutes and 10 per 24 hours per IP bucket; matching email/message combinations are normally blocked for 24 hours after sending. SMTP delivery requires TLS encryption. No website or communication method can guarantee absolute security.Contact protection collections store keyed hashes derived from IP addresses (IPv6 grouped by network) and normalized email/message combinations, along with attempt times, expiry times and delivery-lock metadata. The contact backend does not save the submitted name, email or message as plaintext in Firestore; the delivered email contains the submission. VAFI protection collections store keyed hashes derived from visitor IDs, IP addresses and conversation IDs, request timestamps and lock/expiry metadata. These hashes support abuse prevention and should not be treated as anonymous data.

Email contact@lets-visit-afghanistan.com to ask about personal data, request access or correction, or request deletion where applicable. This includes contact correspondence and personal information in VAFI questions or answer previews. Give enough context to locate the record, such as an approximate date, the email used or a conversation identifier if available; do not send unnecessary sensitive data. Depending on applicable law, you may also have rights to object, restrict processing, receive a portable copy or complain to a relevant data protection authority. We may need to verify the request, and legal requirements may affect what we can provide or delete. Clearing your browser does not submit a server deletion request.

We may update this Privacy Policy as the website evolves, new services are introduced or data practices change. Please revisit this page for the current policy. Last updated: 19 October 2026.

For privacy questions or requests about information processed by Visit Afghanistan, please email contact@lets-visit-afghanistan.com.

When browser storage is available, localStorage keeps one active conversation: messages, replies, recommended page IDs, language and topic, identifiers and the last-activity time. It survives refreshes, navigation and browser reopening. A separate visitor identifier persists locally, while sessionStorage holds the browser-session identifier. Starting a new chat replaces the active conversation and conversation identifier, while retaining the visitor identifier.After more than seven days without chat activity, VAFI resets the local conversation when the page checks inactivity, such as on reopening or regaining focus. Sending a message, receiving a reply or starting a new chat updates activity; reopening alone does not. A closed browser cannot run cleanup, and the visitor identifier has no seven-day expiry. You can clear site storage using your browser controls. Neither local reset nor clearing storage deletes Firestore records, emails or provider-held data.

Sanity CMS stores editorial articles, translations, sources and media. Our server fetches published content for readers. The AI-assisted editorial workflow sends public news titles, excerpts, publisher/date information and image candidate descriptions to OpenAI to help select stories, draft headlines and summaries in three languages, and select suitable images. Drafts are saved in Sanity for editorial review before publication. This workflow does not send readers’ VAFI conversations or contact submissions to the editorial AI.Browsing Blog & Stories does not submit reader comments, account details or form data to Sanity in this implementation. General website analytics and hosting processing still apply. Images may come from Sanity’s CDN, including licensed Wikimedia Commons images copied into Sanity. Media may embed YouTube (including youtube-nocookie.com), Vimeo or other approved media hosts, which receive connection information when loaded and apply their own policies. External news and image-credit links lead to independent websites.