Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to immigrantio.com and its related services (the "Platform"), operated by Immigrantio ("Immigrantio", "we", "us") and describes how we handle personal information.

It covers everyone who uses the Platform — visitors, Clients looking for legal help, and Lawyers and law firms who list on it. This Policy is a notice that describes our practices; where the law requires your consent for a specific use (for example, marketing emails or non-essential cookies), we ask for it separately.

Data controller: for the purposes of the EU and UK General Data Protection Regulation (GDPR), the data controller responsible for your personal information is Immigrantio the operator of the Platform. You can reach us about any privacy matter at [email protected].

2. Our role — and the Lawyers' role — with your information

Immigrantio is an online marketplace: independent Lawyers and law firms publish their profiles, and Clients can discover them, communicate with them, and book consultations. This shapes how personal information flows.

For the information processed to run the Platform itself (accounts, bookings, payments, platform messages, analytics), Immigrantio is the data controller and this Policy applies.

When you share information with a Lawyer — in a booking request, in messages, during a consultation, or in any engagement that follows — that Lawyer receives and processes it as an independent professional (an independent data controller), under their own legal and professional obligations, including the duty of confidentiality that attaches to prospective and actual clients. Lawyers are not Immigrantio's employees or agents, and this Policy does not govern what a Lawyer does with information you give them.

Immigrantio is not responsible for a Lawyer's use, storage, retention, or disclosure of information you share with them. If you have a concern about how a Lawyer handled your information, raise it with the Lawyer directly; professional-conduct concerns can also be raised with the bar to which the Lawyer is admitted. The same applies in reverse: information a Lawyer shares with a Client is handled by that Client, not by Immigrantio.

Lawyers who receive Client information through the Platform agree to use it only in connection with the Client's inquiry or matter and in line with their professional obligations — not for unsolicited marketing or any unrelated purpose.

3. Information we collect

• Account information: your name, email address, password (stored only as a secure hash), and optionally your phone number and state of residence.
• Lawyer profile information: full name, bar number and state(s) of admission, year admitted, practice areas, languages, biography, education, professional experience, awards, contact email and phone, and profile photo.
• Booking and consultation information: the Lawyer booked, date and time, consultation type, attendance status, and the fee amount and payment status.
• Messages exchanged between Clients and Lawyers through the Platform's messaging feature.
• Payment information: when you make a payment, our payment processor Stripe collects and processes your card details. We receive only limited information such as card brand, the last four digits, and billing postal code — never your full card number.
• Reviews and other content you choose to submit. Reviews are published publicly on the Platform — do not include information in a review that you would not want public.
• Technical and usage information: IP address, device and browser type, pages visited, and search queries, collected to operate, secure, and improve the Platform.
• Consent and agreement records: the date, time, and version of the Terms of Service and Privacy Policy you accepted when you created your account, kept so we can demonstrate the consent you gave.

A note on sensitive information. Immigration matters often involve sensitive facts — immigration status, family circumstances, health, or criminal history. The Platform does not ask you to enter such details anywhere except, at your choice, in your private communications with a Lawyer. Anything you choose to include in a message or booking note is transmitted to the recipient you selected and is then governed by Section 2. Please do not put sensitive details in public areas such as reviews or profile text.

4. Information we do not collect or store

• We do not store immigration case documents, evidence, or files exchanged between Clients and Lawyers.
• We do not record audio or video of consultations.
• We do not collect full Social Security numbers or full bank account numbers from Clients. (Lawyers who receive payouts provide payout details, which are handled securely.)
• We do not intentionally collect special categories of personal data (such as health, biometric, or precise geolocation data) and do not ask you to provide them outside your private communications with a Lawyer.
• We do not track your activity on other websites.

5. How we use your information

We use personal information to:

• create and manage your account;
• operate the marketplace — helping Clients find Lawyers and book consultations;
• process payments for consultations, subscriptions, and promotional placements through Stripe;
• enable messaging between Clients and Lawyers;
• send transactional messages such as booking confirmations, reminders, receipts, and security notices;
• provide customer support;
• maintain the security and integrity of the Platform and prevent fraud and abuse;
• improve the Platform using aggregated and de-identified analytics; and
• comply with our legal, tax, and regulatory obligations.

6. Legal bases for processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal information only where we have a legal basis to do so. The bases we rely on are:

• Performance of a contract: to create and manage your account, operate the marketplace, process bookings, enable messaging, and provide customer support — i.e. to deliver the service you signed up for.
• Legitimate interests: to secure the Platform, prevent fraud and abuse, improve our services using aggregated and de-identified analytics, and (for our own non-marketing communications) keep you informed about your account. We balance these interests against your rights and only rely on this basis where your interests do not override them.
• Consent: for optional marketing emails and any non-essential cookies. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation: to comply with tax, accounting, anti-fraud, and other laws that require us to keep certain records.

Where processing is based on consent, you may withdraw it at any time (see "Your privacy rights" below). Withdrawing consent for marketing does not affect the transactional messages required to operate your account.

7. Payment processing

Payments on the Platform are processed by Stripe, Inc. Stripe handles your card data under its own privacy policy and the PCI-DSS security standard.

We do not store full card numbers on our servers. We retain only non-sensitive payment metadata — such as card brand and the last four digits — needed to display your billing history and to support refunds and disputes.

8. How we share information

We share personal information only as follows:

• With a Lawyer you book: when you book a consultation, we share the information needed to provide it — your name, contact details, and the intake information you submit. From that point the Lawyer processes it as an independent controller, as described in Section 2.
• With service providers (processors): we use trusted third parties to operate the Platform. They process personal data only on our instructions and under appropriate confidentiality and data-protection terms. They include: Stripe, Inc. (payment processing); Google LLC and Meta Platforms, Inc. (optional "Sign in with Google" / "Sign in with Facebook" authentication, used only if you choose social login); our email-delivery provider (transactional and, where you have opted in, marketing email); and our hosting and infrastructure providers.
• For legal reasons: we may disclose information to comply with a valid legal request (such as a subpoena or court order), to enforce our Terms, or to protect the rights, safety, and security of users, the public, or Immigrantio.
• In a business transfer: if Immigrantio is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

9. What we never do

• We never sell or rent your personal information.
• We never share your personal information with third parties for their own advertising.
• We do not use the content of your private messages to train artificial-intelligence models.
• We do not share your information with immigration enforcement or other authorities except in response to a legally valid request, and we notify you where we are legally permitted to do so.

10. Cookies and tracking

We use cookies that are strictly necessary for the Platform to function — for example, the session cookie that keeps you signed in. These do not require consent because the Platform cannot work without them.

We also use third-party analytics and measurement tools — Google Analytics, Google Tag Manager (both operated by Google LLC) and the Meta Pixel (operated by Meta Platforms, Inc.) — to understand how visitors use the Platform in aggregate, measure traffic and the effectiveness of our marketing, and improve our services. These providers may set cookies and process information including a truncated IP address, device and browser information, pages viewed, referring URLs, and (for the Meta Pixel) interaction events linked to a Meta account where you are signed in to one. Where required by law (including in the EEA and the UK), these scripts only load after you give your consent through our cookie banner; you can withdraw consent at any time by re-opening the banner from the link in the footer.

Information collected by these tools may be transferred to and processed in the United States and other countries where Google and Meta operate. Google and Meta act as data processors for us and as controllers for their own purposes; see policies.google.com/privacy and facebook.com/privacy/policy for their respective policies. You can install Google's official opt-out browser add-on at tools.google.com/dlpage/gaoptout, and manage Meta's off-Facebook activity settings at accountscenter.facebook.com.

We do not use advertising cookies or cross-site advertising trackers. If this changes, we will ask for your consent first where the law requires it.

You can control cookies through your browser settings. Disabling the strictly necessary cookies may stop you from signing in.

Do Not Track and Global Privacy Control: because we do not sell or "share" personal information for cross-context behavioral advertising, there is no sale or sharing to opt out of. Where the law treats a Global Privacy Control (GPC) signal as a valid opt-out request, we honor it.

11. Data retention

We keep personal information for as long as your account is active and as needed to provide the Platform.

When you close your account, we delete or de-identify your personal information within a reasonable period, except where we must retain certain records to comply with legal obligations (for example, payment and tax records, which may be retained for up to 7 years).

Technical sign-in logs that include your IP address and device/browser information are retained for a limited period (typically up to 12 months) for security and fraud-prevention purposes, then deleted or de-identified.

Aggregated or de-identified data, which cannot reasonably be used to identify you, may be retained for analytics.

Reviews you published may remain visible after you close your account, attributed to the display name they carried; you can ask us to remove your reviews by emailing [email protected].

Information you shared directly with a Lawyer is retained by that Lawyer under their own professional retention obligations (see Section 2); deleting your Immigrantio account does not delete what a Lawyer holds.

12. International data transfers

Immigrantio is operated from the United States, and our service providers may process personal information in the United States and other countries.

If you are in the EEA or the UK, this means your personal information may be transferred outside your home country. Where we transfer personal data internationally, we rely on appropriate safeguards recognised under GDPR — such as the European Commission's Standard Contractual Clauses (and the UK Addendum) — or another lawful transfer mechanism. You can request a copy of the relevant safeguard by emailing [email protected].

13. Security

We use technical and organizational safeguards to protect personal information, including encryption in transit, encryption at rest for sensitive data, hashed passwords, and access controls.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

14. Your privacy rights (EEA and UK)

If you are in the EEA or the UK, you have the following rights over your personal information under GDPR:

• Right of access: obtain confirmation of whether we process your personal information and a copy of it.
• Right to rectification: correct inaccurate or incomplete information — much of which you can edit directly in your dashboard.
• Right to erasure ("right to be forgotten"): ask us to delete your personal information, subject to legal retention requirements. You can also close your account from your dashboard at any time.
• Right to data portability: receive the personal information you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Right to restriction of processing: ask us to limit how we use your information in certain circumstances.
• Right to object: object to processing based on our legitimate interests, and object to direct marketing at any time.
• Right to withdraw consent: where we rely on your consent (for example, marketing emails or non-essential cookies), withdraw it at any time.
• Rights related to automated decision-making: we do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

How to exercise your rights: you can edit your profile and manage your marketing preferences directly in your dashboard, and you can delete your account from your account settings. For any other request — including access, portability, restriction, objection, or erasure — email us at [email protected]. We will verify your identity and respond within one month, as required by GDPR (we may extend this by two further months for complex requests and will tell you if so). Exercising your rights is free unless a request is manifestly unfounded or excessive.

Right to lodge a complaint: if you believe we have mishandled your personal information, you have the right to complain to your local data-protection supervisory authority. In the EEA this is the authority in your country of residence, work, or where the issue occurred; in the UK it is the Information Commissioner's Office (ICO) at ico.org.uk. We would, however, appreciate the chance to address your concern first.

15. US state privacy rights (California and others)

If you live in California or another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, or Texas), you may have the rights to know/access, correct, and delete the personal information we hold about you, to receive it in a portable format, and not to be discriminated against for exercising these rights.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA). We have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that California law gives you a right to limit.

The categories of personal information we collect, the purposes, and the categories of recipients are described in Sections 3, 5, and 8 of this Policy. We retain each category as described in Section 11.

To exercise your rights, email [email protected] or use the tools in your dashboard (profile editing, marketing preferences, account deletion). We will verify your request — usually by confirming control of the email on the account — and respond within the time required by your state's law. You may use an authorized agent; we will ask the agent for proof of authorization and may still verify your identity directly.

If we deny a request, you may appeal by replying to our decision; where your state provides it, you may also contact your state attorney general.

16. Children

The Platform is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with information, email [email protected] and we will delete it.

17. Changes to this Policy

We may update this Privacy Policy from time to time. For material changes we will provide notice — for example, by email or through the Platform — before they take effect. The "Last updated" date on this page shows when the Policy was last revised.

18. Contact us

Questions about this Privacy Policy or your personal information? Email us at [email protected]. If you are in the EEA or the UK and have a concern we cannot resolve, you may also contact your local data-protection supervisory authority.