Privacy Policy

Draft pending attorney review. This Privacy Policy is a plain-English draft prepared for review by a licensed attorney before public reliance. Use it as a description of our practices; defer to any superseding signed policy on the same surface.

This Privacy Policy describes how ImFiled(“we”, “us”, or “our”) collects, uses, and shares information when you use our document preparation service. ImFiled is a document preparation service, not a law firm. Nothing in this policy creates an attorney-client relationship.

1. Information we collect

To prepare your USCIS filing package, we collect information you provide directly, including:

• Identity and contact information. Your legal name, email address, phone number, mailing address, and date of birth. Same for your beneficiary (the relative you are sponsoring).
• Immigration-related information.Your citizenship status, your beneficiary's current immigration status, country of birth, relationship history (marriage details, prior marriages, children), and answers to intake questions about prior immigration enforcement contact or other case-complexity factors.
• Supporting documents. Government-issued identity documents (passports, birth certificates), proof-of-relationship documents (marriage certificates, joint financial records), and similar materials uploaded through our portal.
• Payment information. Processed by our payment provider; we do not store your full card number on our systems.
• Communications with us. Emails you send us, support requests, and case-related messages.

We also collect technical information automatically when you use our site: IP address, device and browser information, pages viewed, and referral source. We use cookies and similar technologies for site functionality and for advertising measurement.

2. Why we collect it

• Service delivery. To prepare your I-130 document package, generate filing instructions, and route your package through completeness review.
• Attorney completeness review. To share your package with a licensed immigration attorney on our review network so they can confirm completeness before delivery.
• Payment processing and recordkeeping. To process your payment and maintain records for tax and accounting purposes.
• Customer communication. To send case status updates, request missing information, and respond to your questions.
• Regulatory compliance and audit trail. To maintain records required by applicable consumer-protection and document-preparation regulations.
• Site operation and improvement. To run, secure, and improve the site and to measure the effectiveness of our advertising.

3. Vendors and service providers

We share information with vendors that provide infrastructure for the Service. Each vendor receives only the information they need to provide their function. We do not sell your personal information, and we do not share immigration case information for advertising purposes.

• Stripe — payment processing. Receives your name, email, and payment details.
• Supabase — database, authentication, and document storage. Receives every case record and every document you upload.
• UploadThing — document upload binary storage. Receives your uploaded document files.
• Customer.io — customer-facing email delivery. Receives your name, email, language preference, and case status to deliver transactional and stage-progress emails.
• Resend — operational and case-specific email delivery. Receives your name and email to send confirmation, delivery, and support messages.
• Anthropic — AI-assisted document review for completeness and clarity. Receives your uploaded documents for automated completeness checks. Anthropic operates under a zero-retention API mode when used in this flow.
• Inngest — workflow orchestration for the stage-by-stage processing of your case. Receives case identifiers and event metadata.
• Vercel— application hosting and content delivery. Receives anything that flows through the application's servers.
• Reviewing attorneys. The licensed immigration attorney on our review network receives your case package, your identity and beneficiary information, and your uploaded documentsfor completeness review. The attorney does not represent you anddoes not provide legal advice.
• Marketing measurement. If you reach us via paid advertising (Google Ads, Meta), we share hashed identifiers (such as email hash, click identifiers) for conversion measurement only. We do not share immigration case information with advertising platforms.

We may also share information when required by law, subpoena, or other legal process, or to protect our rights, property, or safety. See our vendor inventory for more detail.

4. How long we keep your information

We retain information for the periods needed to provide the Service and to meet our legal and regulatory obligations:

• Case records (intake answers, attorney decisions, stage transitions): 7 years after case closure, matching the USCIS-record-retention recommendation for I-130 filings.
• Uploaded documents: 1 year after case closure, unless you request earlier deletion. Customers in active cases can request deletion of any individual document at any time.
• Payment and tax records: 7 years (governed by federal tax recordkeeping requirements).
• Communications (operational emails, support messages): 3 years.
• Marketing analytics: aggregated and anonymized after 2 years.
• Audit trail entries: retained indefinitely. The audit trail records what action was taken on a case (e.g. “status advanced to attorney_review”) without duplicating the underlying personal data.

You may request deletion of your account data at any time by contacting us. See “Your rights” below.

5. Your rights

Wherever you live, you have the following rights with respect to your personal information:

• Access — request a copy of the information we hold about you.
• Correction — request that we correct inaccurate information.
• Deletion — request that we delete your information. Some records (like tax records) we are legally required to retain.
• Portability — request a machine-readable export of your information.
• Marketing opt-out — unsubscribe from marketing emails at any time using the unsubscribe link.

To exercise any of these rights, reply to any email from us or contact us via the email address on our site. We aim to respond within 30 days; some states require shorter timelines and we will honor them where they apply (see “State-specific addenda”).

6. Security

We use industry-standard safeguards to protect your information, including encryption in transit (TLS) and encryption at rest for documents and payment metadata. Our vendors maintain their own independent security postures (we work with SOC 2 Type II-attested providers where available). Access to your case is gated by magic-link authentication tied to your email. No method of transmission or storage is completely secure, and we cannotguarantee absolute security.

7. Children

Our service is intended for adults filing on their own behalf. We do not knowingly collect personal information directly from minors. The beneficiary of an I-130 petition may be a minor (an unmarried child of a U.S. citizen petitioner); in those cases, the petitioner (the parent) provides information about the minor child, not the minor directly.

8. International transfers

ImFiled operates from the United States. The Service is currently offered only to U.S.-based petitioners. Your information is stored and processed in the United States. We are not currently designed to receive information from individuals located in the European Union, the United Kingdom, or other regions with GDPR-style cross-border-transfer regimes. If you reside outside the United States, please do not use the Service.

9. State-specific addenda

Some U.S. states confer additional rights and require additional disclosures. These apply when you are a resident of the named state.

California (CCPA and CPRA)

California residents have the right to know what personal information we collect, sell, or share; the right to delete; the right to correct; and the right to opt out of the sale or sharing of personal information (we do not sell or share for cross-context behavioral advertising). We do not knowingly collect sensitive personal information for inferences about a consumer beyond what is required to provide the Service. To exercise CCPA/CPRA rights, contact us at the email address on our site.

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA)

Residents of these states have rights similar to those above. To exercise, contact us at the email address on our site. We will respond within the timeline required by your state of residence (typically 30-45 days).

Sale of personal information

We do not sell your personal information in any state and have not done so in the prior twelve months.

10. Changes to this policy

We may update this policy from time to time. The “Effective” date at the top reflects the most recent revision. Material changes will be announced via email to customers with active cases. Continued use of the Service after an update constitutes acceptance of the revised policy.

11. Contact

Questions about this policy or your information? Reply to any email from us, or contact us at the address listed on our site. We aim to respond within 5 business days.