• Identifiers and Contact Information: Full name, email address, telephone number, date of birth, postal address, and account login credentials (username and password). We also collect government-issued identifiers such as Social Security Numbers (SSN) or taxpayer IDs, passport numbers, state ID numbers, immigration case numbers, and other identifiers needed for immigration forms.

• Immigration Application Data: Information you provide by answering our case questionnaires or forms, such as your country of birth and citizenship, immigration status, employment and education history, marital status and family information, and any personal details required for immigration applications (for example, prior immigration case history, travel history, or criminal background information if needed for certain visa applications). This includes physical characteristics required on immigration forms (e.g. eye color, height) and any personal details you choose to share about yourself or your situation.

• Documents and Identifying Materials: Copies of or data from personal documents you or your lawyer upload to the platform. This includes but not limited to passports, birth certificates, marriage certificates, visas, tax returns, financial statements, photographs, or other documents needed to support immigration filings. These documents may contain sensitive personal information such as identification numbers, biometric information contained in photographs, or financial and tax data.

• Sensitive Personal Data: Certain personal information we collect is considered sensitive under some laws. This includes government identification numbers (e.g., SSN), financial account or tax information, account passwords, and any biometric identifiers or data revealing racial or ethnic origin or other protected characteristics that may appear in your documentation. We collect and use this sensitive information only as necessary to provide our services (for example, to populate immigration forms) and in accordance with applicable law.

• Communications and Case Information: Any correspondence or communications you send to us or through our platform, including interactions with our AI agent or customer support. If you are an immigrant client invited by an immigration lawyer, we may collect the information you provide to your lawyer through the platform (such as answers to questions or messages) as part of your case file.

• Medical or Health Information (if provided): Immigration proceedings may require certain health-related information (for example, Form I-693, Report of Medical Examination and Vaccination Record, or other medical documents related to waivers of inadmissibility). While you or your lawyer might upload such health information to Immify as part of your case, Immify is not a health care provider and is not a “covered entity” under the Health Insurance Portability and Accountability Act (HIPAA). Our platform is not intended for the transmission or storage of protected health information, and we treat any medical information you provide as personal data for your immigration case, not as regulated health records. We strongly advise you not to upload a completed Form I-693 or any similarly sensitive medical document to the platform unless absolutely necessary.

• Other Information You Provide: Any other personal information you choose to provide directly to us. For example, if you respond to surveys, provide feedback, or participate in any interactive features (such as forums or testimonials), we will collect the information you submit.

• Usage and Device Information: When you use Immify, we receive technical information about your visit. This includes your Internet Protocol (IP) address, device type, browser type, device identifiers or advertising IDs, operating system version, and the date and time of your access. We also collect information about how you use our services, such as the pages or screens you view, the features you use, the links or buttons you click, search queries you make on the platform, and the duration and frequency of your activities. This data helps us understand user engagement and improve performance.

• Cookies and Similar Technologies: We use cookies, web beacons, and similar tracking technologies (“Technologies”) to collect information automatically. Cookies are small text files stored on your browser that remember your preferences and activity. Web beacons (pixel tags) are tiny images or code that allow us to understand browsing or email interactions. These Technologies enable features such as remaining logged in, analytics to understand usage, and personalization. We (and authorized third parties like analytics providers) may tie this information to your account or other identifiers. For more details, see Section 5 – Your Privacy Choices on how to manage cookies.

• Analytics Data: We partner with analytics providers (such as Google Analytics) that use cookies and device identifiers to help us analyze how users use Immify.AI. These tools collect information such as your navigation paths, time spent on pages, and other usage data. For instance, Google Analytics may collect your IP address and combine it with information from other sites for its purposes. We use this information to improve our services, and where required, we will obtain your consent for the use of analytics cookies. You can opt-out of Google Analytics as described in Section 5 below. We do not allow these analytics providers to use your data for their own marketing purposes unrelated to our service.

• Do Not Track Signals: Note that our website does not respond to “Do Not Track” (DNT) signals from browsers. DNT is a privacy setting that users can activate in certain web browsers, but there is currently no universal standard for how to respond. As such, we treat DNT signals like other browser requests and do not alter our data collection when we detect a DNT signal.

• Information from Your Legal Representative: If you are an immigrant client using Immify at the invitation of an immigration attorney or accredited representative, that legal professional may provide us with personal information about you to initiate or assist with your case. For example, an attorney might input your name, contact information, case type, and preliminary case notes into our system, or upload documents you provided to them, so that we can facilitate your application process.

• Service Providers and Partners: We may receive information from third-party services integrated with our platform. For example, if we offer identity verification or background check features through a trusted partner, we might receive confirmation of your identity or eligibility. Similarly, if you or your attorney choose to import information from another service (such as cloud storage of documents or form-filling services), we will receive whatever information you direct that third party to share with us.

• Public and Government Sources: Where permitted by law, we might collect information from public databases or government sources to supplement or verify your information. For instance, we could retrieve data from public immigration case status databases or sanctions lists for compliance purposes. We treat any such acquired information according to this Privacy Notice.

• Referrals and Others: If someone refers you to Immify (for example, through a referral program or invite feature), we may receive personal information such as your name and email address from the referrer so that we can send you an invitation. We will inform you of the source of your information upon request as required by law.

• Case Automation and Form Preparation: Using your information (including answers and uploaded documents) to populate immigration applications and forms on your behalf, and to assist you and your lawyer through our AI agent. For example, our system will use your personal details to fill government immigration forms accurately and our AI will help identify missing information or ask follow-up questions.

• Account Creation and Management: Creating and managing your user account, authenticating you when you log in, and remembering your settings and preferences. This includes using your contact information to send account-related communications (e.g., multi-factor authentication codes, password reset links, or important account notices).

• Communication and Collaboration: Facilitating communications between you and your immigration lawyer or our support team. For instance, if your lawyer sends you a message or request through the platform, we use your information to notify you. We may also send you service-related announcements or updates about your immigration case progress.

• Document Storage and Retrieval: Storing the personal documents and information you upload in a secure manner, and enabling you and your attorney to access and manage these documents over the multi-year immigration process. Given the lengthy nature of immigration matters, we retain your case files to allow ongoing use and compliance with record-keeping obligations.

• Customer Support: Using your information to respond to your inquiries, troubleshoot issues, and provide technical support. For example, if you contact us with a problem, we will review your account and data to assist you.

• Service Improvement: Analyzing usage and feedback to understand how our services are used and how we can improve them. This includes debugging and repairing errors, performing data analysis and testing, and developing new features. We may use information about your interactions with the platform to enhance our AI models and automation tools (for instance, to improve answer accuracy), in accordance with applicable law and any consent requirements. However, we do not use personal information from your case files to train our AI models or algorithms for product development. Any analysis of usage patterns for improving our services is performed on aggregated data or in a manner consistent with applicable law and any required consents or contractual obligations.

• Safety and Security: Monitoring, investigating, and protecting against any fraudulent, unauthorized, or illegal activity on our platform. We use personal information (such as account and log data) to detect security incidents and prevent malicious or unauthorized access to user accounts and our systems. If necessary, we may use and share information to prosecute misuse of our services.

• Legal Compliance: Using personal information to comply with applicable laws, regulations, legal processes, and government requests. For example, immigration law or practice rules may require that certain records be retained for a period of time, and we will maintain those records as needed to comply. We may also use your data to fulfill our duties under privacy laws (such as responding to verifiable consumer requests) or other legal obligations.

• Enforcing Rights and Agreements: Using data as needed to enforce our Terms of Service, agreements, and policies, and to protect the rights and safety of Immify, our users, our personnel, or others. For instance, we may use personal information to investigate potential violations of our terms or to address user complaints or disputes.

• Analytics and Research: Conducting data analytics to measure user engagement, evaluate the effectiveness of our platform, and research user needs. This helps us make informed business decisions and improve functionality. We use aggregated or de-identified data for these purposes, and we will not use any personal information for analytics or research.

• Marketing Communications: We may use your email address or other contact information to send you newsletters, product updates, event invitations, or promotional offers, only if you have an existing business relationship with us or you have provided the appropriate consent to receive such communications. For example, if you are an immigration lawyer user, we might send you tips on using the platform or inform you of new features. If you are an immigrant client, we might send you satisfaction surveys or information about additional services that may assist you, provided we have the necessary permissions.

• Opt-Out and Preferences: We will give you the ability to opt out of marketing or promotional emails at any time. If you choose to opt out, we will refrain from sending you such communications going forward (other than service-related messages that are not promotional). See Section 5 – Your Privacy Choices and Rights below on how to opt out. We do not send text message marketing unless you have expressly agreed to receive texts.

• With Your Consent or as Otherwise Permitted: Where you have expressly consented, we may use your information for additional purposes that we explain at the time of obtaining consent. For instance, with your consent, we might post client testimonials that you voluntarily provide. You have the right to withdraw any consent you have given (see Section 5). If we ever want to use your personal information for a purpose not described in this Privacy Notice, we will seek your consent or provide the necessary notice.

• Service Providers: We share personal information with third-party companies that provide services to us or act on our behalf, such as cloud hosting providers, data storage or database management services, email and communication services, identity verification services, analytics providers (like Google Analytics), customer support tools, and IT security services. These service providers are contractually required to handle personal information only for the purposes of providing their services to us and to implement appropriate security measures. For example, we may store your data on servers provided by Amazon Web Services or Google Cloud in the United States, and we may use analytics tools to understand how users interact with our platform.

• Immigration Lawyers and Authorized Representatives: If you are using Immify.AI as a client of an immigration lawyer or organization, your personal information will be accessible to that lawyer or organization and their authorized users managing your case. Immify is designed to facilitate information sharing between immigrants and their legal representatives. Thus, any information you or your lawyer enter into the platform related to your case may be disclosed to each other. Lawyers and law firms are independent data controllers in their own right, and their handling of your information may be subject to their own privacy practices or professional confidentiality obligations. We are not responsible for how your lawyer uses your information outside of our Service, but please contact us if you have an issue and we will try to assist.

• Business Partners and Integrations: In certain situations, we may share information with trusted business partners to fulfill the service you request. For example, if our platform offers integration with a courier service to deliver physical documents, or an integration with an e-signature service to sign forms, we will share the necessary information (like your name, address, or document content) with those partners to carry out your request. Similarly, if we jointly offer a service or co-sponsor a program with another organization, we might share participant information with that organization. In all such cases, we will disclose the partner’s identity to you and only share data to the extent needed. Once your information is shared with a partner, that partner’s privacy policy will also govern their use of the information.

• Affiliates: We may share your personal information with our affiliates or subsidiaries (if we have any corporate affiliates in the future) for purposes consistent with this Privacy Notice. Any such affiliate receiving your information will be bound to handle it in accordance with this Notice (for example, an affiliate assisting in providing or improving our services). At present, Immify has no corporate affiliates. If we establish affiliates or subsidiaries in the future, we will only share personal information with them as needed to assist in providing our Services, and any such affiliate will be required to handle your information in accordance with this Privacy Notice and our contractual obligations. We will not share data from an institutional client with any affiliate unless explicitly permitted by that client.

• Legal Compliance and Protection: We may disclose personal information when we believe in good faith that such disclosure is necessary to comply with a legal obligation, or to protect and defend the rights, property, or safety of Immify, our users, or others. This includes:
• Responding to lawful requests from public authorities, courts, regulators, or law enforcement (such as subpoenas, court orders, or other legal process). If, for instance, a court issues a subpoena for certain case information, we may be legally required to provide it.
• Disclosing information in connection with the establishment or exercise of legal claims or in defense against legal claims.
• Sharing information as necessary to investigate, prevent, or take action regarding suspected illegal activities, fraud, or security issues (for example, detecting fraud or security vulnerabilities and reporting them to appropriate entities).

• Business Transfers: If we are involved in a business transaction such as a merger, acquisition, reorganization, sale of assets, or transition of service to another provider, your personal information may be transferred as part of that transaction. In such event, we will ensure that the successor entity is bound to respect your personal information in a manner consistent with this Privacy Notice. If an insolvency or bankruptcy proceeding occurs, personal information may be considered an asset and could be sold or transferred to third parties as part of that process, subject to applicable law.

• With Your Consent or at Your Direction: We will share your personal information with other third parties not covered above only with your consent or at your explicit direction. For instance, if you instruct us to share your case file with another service or a family member, or you consent to our sharing of testimonial information publicly, we will do so consistent with that consent.

Please note that whenever personal information is disclosed to a third party, we ensure there is a valid legal basis for the disclosure and we only share the minimum information necessary for the purpose. We do not sell your personal information in the traditional sense (for money), and we do not share your information for targeted advertising without your consent. If in the future we ever contemplate such disclosures, we will update this Privacy Notice and provide any required opt-out or opt-in mechanisms.

• Email Communications: If you no longer wish to receive marketing or promotional emails from us, you can opt out at any time by clicking the “unsubscribe” link in the footer of such emails or by contacting us as described in Section 9 – Contact Us. Please note that you will still receive transactional or service-related emails that are necessary for our relationship, such as account notifications, case status updates, or security alerts, even if you opt out of marketing emails.

• Text Messages: If you have agreed to receive SMS or text messages from us (for example, case alerts or verification codes), and you later decide you do not want them, you may opt out by following the stop instructions in the message (such as replying “STOP” to a message) or by contacting us. Note that we will only send you text messages for marketing with your consent, and opting out of texts will not affect service communications via other channels.

• Cookies and Tracking Technologies: You have choices to manage or limit the use of cookies and similar technologies:
• Most web browsers allow you to block or delete cookies through the browser settings. You can set your browser to refuse all or some cookies or to prompt you before accepting a cookie. Please be aware that if you disable or delete cookies, some features of our services might not function properly (for example, you may need to re-enter preferences or login information each time).
• We provide a cookie consent banner on our site (where required by law) that allows you to adjust your preferences for certain categories of cookies, such as analytics cookies. You can update your preferences at any time via our website’s cookie settings tool.
• To opt out of Google Analytics, you can install the Google Analytics Opt-out Browser Add-on, or use the tools provided by Google to manage ads and data collection. For more information on how Google Analytics uses data and how to control it, see Google’s Privacy Policy.
• The online advertising industry also provides options to opt out of targeted advertising. If we ever engage in interest-based advertising on our site (e.g. through cookie-based ad networks), you can visit the Network Advertising Initiative opt-out page or the Digital Advertising Alliance opt-out page to opt out of receiving targeted ads from participating companies. These opt-outs are browser and device-specific, so you need to set them on each browser and device you use. (Currently, Immify does not serve third-party ads on its platform, but we include this for completeness.)

• “Do Not Track” Signals: As noted above, our website does not respond to Do Not Track signals from browsers. You can use the other opt-out mechanisms described here to control personalized advertising and analytics.

• Right to Know/Access: You have the right to request that we disclose what personal information we have collected, used, and disclosed about you. This includes the categories of personal information, the categories of sources, the business or commercial purposes for collection, the categories of third parties to whom we disclose personal information, and specific pieces of personal information we hold about you. Upon receiving and verifying your request, we will provide the requested information, subject to the exceptions provided by law (for example, we will not disclose sensitive identifiers like SSN or driver’s license numbers in response to an access request for security reasons).

• Right to Data Portability: Along with the right to access, you may have the right to obtain a copy of the personal information you provided to us, in a portable and readily usable format, to the extent technically feasible. This allows you to transmit your data to another service provider. We will provide the data in a common file format (such as CSV or JSON) or through other reasonable means.

• Right to Delete: You have the right to request deletion of personal information we have collected from you and retained. Once we receive a verifiable deletion request and confirm its validity, we will delete (and direct our service providers to delete) your personal information from our records, except for information we are permitted or required to retain by law. For example, we may retain certain information to complete ongoing services (like an in-progress immigration filing), to detect security incidents, to comply with legal obligations (such as record-keeping requirements or responding to government requests), or for other lawful purposes permitted by the CCPA and similar laws. If one of these exceptions applies, we will inform you in our response. If you delete your account or request deletion, note that residual copies of your information might remain in our backup systems for a brief period until those are also deleted or overwritten.

• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you. If you believe any of your information is incorrect or incomplete, you can request a correction. Upon verification, we will correct the information as you direct, taking into account the nature of the information and the purposes for which it is processed. In some cases, we may need to delete the information if correction is not feasible, or we may ask you to provide documentation to validate the correct data (for instance, official documents to correct your name or date of birth).

• Right to Opt Out of “Sale” or “Sharing”: You have the right to request that we correct inaccurate personal information that we maintain about you. If you believe any of your information is incorrect or incomplete, you can request a correction. Upon verification, we will correct the information as you direct, taking into account the nature of the information and the purposes for which it is processed. In some cases, we may need to delete the information if correction is not feasible, or we may ask you to provide documentation to validate the correct data (for instance, official documents to correct your name or date of birth).

• Right to Limit Use of Sensitive Information: Some state laws allow individuals to limit a business’s use or disclosure of “sensitive personal information” (as defined in those laws) if such use falls outside certain permitted purposes. Immify.AI only uses sensitive personal information (e.g., SSN or passport number) as necessary to provide our services or comply with law, which are generally exempt from any requirement to offer an opt-out under the CPRA. We do not use or disclose sensitive personal information for any purpose that would trigger a right to limit under CPRA regulations. Thus, we do not offer a separate opt-out for sensitive data use. If this changes, we will update our practices and honor applicable requests.

• Right to Withdraw Consent: To the extent that we rely on your consent for any processing of personal information (for example, if you consent to optional data collection, or if you are a Washington resident and consented to the collection of certain data classified as health data), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing that occurred before your withdrawal. If you withdraw consent, we will stop the processing activity that was based on consent, and, if no other legal basis justifies that processing, we will delete the relevant personal information. For instance, if you had consented to receive marketing emails or to allow us to use your data in a certain research project, you can opt out later and we will honor that choice.

• Right to Object to Processing: In certain jurisdictions (such as under the GDPR for EU users, or under some U.S. state laws for specific types of processing), you may have the right to object to or opt out of certain processing activities. This can include the right to object to processing for direct marketing or the right to object to decisions made based solely on automated processing. Immify does not make any legally significant decisions about you without human involvement (no solely automated decision-making with legal or similarly significant effects). If you believe your situation warrants an objection to any processing, please contact us and we will consider and respond to your request as required by law.

• Right to Non-Discrimination/Non-Retaliation: We will not discriminate against you or penalize you for exercising any of your data privacy rights. This means we will not deny you our services, charge you different prices, or provide a lesser quality of service just because you exercised your rights under applicable law. If you are a client of an immigration lawyer, exercising your privacy rights with Immify will not affect the legal services you receive from your lawyer.

• Right to Appeal: If we deny a request you make regarding your privacy rights (for example, if we cannot fulfill a deletion request due to an exemption), you may have the right to appeal our decision by contacting us within the time period specified by your state law (such as within 45 or 60 days). To submit an appeal, please write to us using the contact information in Section 9 – Contact Us, explaining why you believe our response was inadequate. We will re-evaluate your request and respond within the timeframe required by law (generally within 45 days of receipt of the appeal) with a decision. If your appeal is ultimately denied, we will provide you with a brief written explanation and information on how you may further complain to your state’s Attorney General or applicable regulatory authority if you so choose.

• Authorized Agent: You may designate an authorized agent to make a privacy rights request on your behalf (for residents of California and other states where this is permitted). If you choose to use an authorized agent, we will take steps to verify the authenticity of the request and the authority of the agent by, for example, requiring a signed authorization or proof of power of attorney. We may also need you to verify your identity directly with us or confirm that you provided the agent permission to submit the request. We will deny requests from agents that do not submit proof of authorization from you.

• Exercising Your Rights: To exercise the rights described above, please contact us as set forth in Section 9 – Contact Us. Provide sufficient information for us to verify your identity (and authority, if through an agent) and to understand and fulfill your request. We will respond to valid requests within the timeframes required by law (generally within 45 days, with the possibility of a reasonable extension or as otherwise permitted by law). If we need more time or cannot comply, we will inform you of the reason and any extension in writing.

• Right to Appeal: If we deny a request you make regarding your privacy rights (for example, if we cannot fulfill a deletion request due to an exemption), you may have the right to appeal our decision by contacting us within the time period specified by your state law (such as within 45 or 60 days). To submit an appeal, please write to us using the contact information in Section 9 – Contact Us, explaining why you believe our response was inadequate. We will re-evaluate your request and respond within the timeframe required by law (generally within 45 days of receipt of the appeal) with a decision. If your appeal is ultimately denied, we will provide you with a brief written explanation and information on how you may further complain to your state’s Attorney General or applicable regulatory authority if you so choose.