Privacy Policy

Last Updated: March 25, 2026 | Effective Date: March 25, 2026 1. Introduction Mendoza Immigration ("Company," "we," "us," or "our") operates the ImmigForge immigration case management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting your privacy and handling your data with transparency and care. Please read this policy carefully to understand our practices. 2. Information We Collect 2.1 Personal Identification Information   - Full legal name, aliases, and maiden names   - Date and place of birth   - Social Security Number (SSN)   - Alien Registration Number (A-Number)   - Passport numbers and visa information   - Driver's license and state ID numbers   - Photographs and biometric data (when required for applications) 2.2 Contact Information   - Email addresses (primary and alternate)   - Phone numbers (home, mobile, work)   - Physical addresses (current and previous)   - Emergency contact information 2.3 Financial Information   - Billing name and address   - Payment card information (processed securely by Stripe)   - Bank account information (for certain payment methods)   - Income and tax documentation   - Payment history and invoices 2.4 Immigration-Related Information   - Immigration status and history   - USCIS receipt numbers (e.g., EAC, LIN, SRC, WAC, IOE prefixed case numbers)   - Visa types and expiration dates   - Entry and exit records   - Prior immigration applications and outcomes   - Employment authorization documents USCIS Receipt Numbers: We collect and store USCIS receipt numbers as personally identifiable information (PII). Receipt numbers are used to check the status of pending immigration cases through the official USCIS Case Status API (Torch API). We periodically query the API using your receipt numbers to retrieve up-to-date status information, detect changes in your case (such as approvals, requests for evidence, or card mailings), and notify you of updates via your preferred communication channel (email, SMS, or WhatsApp). Receipt numbers are stored securely in our database and are only transmitted to USCIS for the purpose of checking case status on your behalf. 2.5 Family Information   - Spouse information   - Children's information   - Parents' information   - Siblings' information   - Marriage certificates and family documents 2.6 Medical Information   - Immigration medical examination results (when required)   - Vaccination records   - Medical waivers and related documentation 2.7 Technical and Usage Data   - IP addresses   - Geolocation data (general location for security)   - Browser type and version   - Device information   - Pages visited and features used   - Login timestamps and session data 3. How We Use Your Information We use your information for the following purposes:   - Legal Services: Processing your immigration case, preparing forms, and filing applications   - Communication: Contacting you about case updates, appointments, and required actions   - Billing: Processing payments and maintaining financial records   - Security: Protecting your account and preventing fraud   - Compliance: Meeting legal and regulatory requirements   - Improvement: Enhancing our services using aggregated, anonymized data 3.1 De-identified and Anonymized Data We may use de-identified, anonymized, or pseudonymized data for:   - Statistical analysis of immigration trends   - Service improvement and feature development   - Research and reporting (without identifying individuals) This data cannot be used to identify you personally. 4. Information Sharing 4.1 Entities We Share Data With We share your data only with the following entities:   U.S. Citizenship and Immigration Services (USCIS)   Purpose: Filing immigration applications on your behalf   U.S. Department of State   Purpose: Consular processing and visa applications   U.S. Department of Labor   Purpose: Labor certification applications   Stripe, Inc.   Purpose: Secure payment processing   Google Cloud Platform   Purpose: Secure document storage, AI-powered document analysis   Twilio   Purpose: SMS and WhatsApp messaging services   xAI (Grok) Purpose: AI-powered document analysis and form assistance 4.2 Third-Party Obligations All third parties are contractually bound to our privacy policy terms and conditions. They may only use your data for the specific purposes outlined above and must maintain appropriate security measures. 5. No Sale of Data WE DO NOT SELL YOUR DATA. We do not sell, rent, lease, or trade your personal information for profit, monetary transactions, or any other purpose. Your data is used solely for providing immigration legal services. 6. Third-Party Use Restrictions Third-party use or disclosure of your information (including de-identified, anonymized, or pseudonymized data) is strictly prohibited for any reason without your active consent. This prohibition applies to:   - Marketing or advertising purposes   - Sale or transfer to additional third parties   - Any use beyond the specific purpose for which data was shared 7. Your Data Sharing Choices You have choices about how your data is shared:   - Essential Sharing: Required for case processing (cannot be opted out while maintaining services)   - Communication Preferences: Choose email, SMS, WhatsApp, or phone preferences in settings   - Marketing: Opt out of any promotional communications 7.1 Risks, Benefits, and Limitations Benefits: Sharing data enables us to process your immigration case, file applications, and communicate important updates. Risks: Data shared with government agencies is subject to their privacy policies. Once filed, information becomes part of government records. Limitations: We cannot provide immigration services without sharing necessary information with relevant government agencies. 8. Impact on Others Immigration cases often involve information about family members and other individuals. Please be aware that:   - Family member information you provide may be filed with government agencies   - Your immigration case may affect family members' future applications   - Genetic or family history information may have implications for related individuals   - Employer information provided may be verified by government agencies By providing information about others, you confirm you have their permission or authority to do so for immigration purposes. 9. Data Breach Notification If we experience a data breach affecting your personal information, we will:   - Notify you within 72 hours of discovering the breach via email and/or SMS   - Describe the nature and scope of the breach   - Identify the types of data potentially affected   - Explain the steps we are taking to address the breach   - Provide instructions for protective actions you may take   - Offer credit monitoring or identity protection services if appropriate   - Provide contact information for questions and support 10. Data Retention We retain your data according to the following schedule: Data retention periods by data type Data Type Retention Period Active case files Duration of case + 7 years Completed case files 7 years from completion Financial/billing records 7 years Communication logs 3 years Dormant accounts 3 years of inactivity before deletion notice Security/audit logs 5 years 11. Permanent Data Deletion You may request permanent deletion of your data by:   - Emailing privacy@mendozaimmigration.com   - Using the "Request Data Deletion" feature in Account Settings   - Contacting our office directly Upon verified request, we will:   - Process your request within 30 days   - Permanently delete your data from all our systems   - Direct third-party processors to delete your data   - Provide written confirmation of deletion Exceptions: Data required for legal compliance, active litigation, or regulatory requirements may be retained until obligations are fulfilled. 12. Transfer of Ownership If our company is sold, merged, or transfers ownership:   - Notification: You will be notified at least 30 days before any transfer   - Policy Alignment: New ownership must align with our current privacy policies   - Your Options: You will be offered:     ◦ Secure download of all your health and personal information     ◦ Secure transmission of data to another provider     ◦ Secure disposal of your data   - Clear Communication: You will receive clear notification of ownership changes 13. Closing Your Account To close your account:   1 Log into your account at immigforge.com   2 Navigate to Settings > Account > Close Account   3 Follow the prompts to confirm closure Alternatively, email support@mendozaimmigration.com or call our office. Before closure, you may download your case files. Data subject to retention requirements will be securely stored and deleted upon expiration. 14. Policy Changes When we update this Privacy Policy:   - We will notify you via email at least 30 days before changes take effect   - We will provide a plain-language summary of what has changed   - Material changes require your active consent   - You will be prompted to review and accept changes upon login   - The "Last Updated" date will be revised We will obtain your active consent for any material changes to data collection, use, or sharing practices. 15. Security We protect your data with:   - AES-256-GCM encryption for sensitive data at rest   - TLS 1.3 encryption for all data in transit   - HKDF key derivation for per-client encryption isolation   - Role-based access controls limiting data access   - Regular security audits and monitoring   - SOC 2 compliant cloud infrastructure 16. State Bar Professional Conduct Compliance Our privacy practices comply with the attorney confidentiality rules of:   - Arizona ER 1.6: We make reasonable efforts to prevent inadvertent or unauthorized disclosure of, or unauthorized access to, client information   - Washington RPC 1.6: We implement reasonable measures to prevent unauthorized disclosure and comply with WSBA Advisory Opinion 202402 regarding data analytics and client information   - Oregon RPC 1.6(c): We maintain reasonable safeguards to prevent inadvertent or unauthorized disclosure of client information 17. AI and Technology Disclosure Per Arizona, Washington, and Oregon State Bar guidance on AI use:   - We use AI tools to assist with document analysis and form preparation   - AI tools are contractually bound to maintain confidentiality per RPC requirements   - All AI-generated work is verified by licensed attorneys before use (per OSB 2025-205)   - Client data is anonymized when using AI tools as required by ethics rules   - You may opt out of AI-assisted processing by contacting our office 18. State-Specific Privacy Rights Washington Clients If your case involves health-related information, we comply with the Washington My Health My Data Act (MHMDA, effective March 31, 2024). This includes obtaining explicit consent before collecting health data and providing you rights to access, correct, and delete such data. Oregon Clients We comply with the Oregon Consumer Information Protection Act (OCIPA/ORS 646A.622), which requires us to maintain a comprehensive information security program including regular employee training, vendor security requirements, and risk assessments. Arizona Clients Our practices align with Arizona Supreme Court Administrative Order 2024-33 and State Bar of Arizona Practical Guidance on Generative AI, ensuring proper safeguards for AI-assisted legal services. California Clients (CCPA) We comply with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). California residents have the right to:   - Know what personal information we collect, use, and disclose   - Request deletion of their personal information   - Opt out of the sale or sharing of personal information (we do not sell your data)   - Non-discrimination for exercising their privacy rights   - Correct inaccurate personal information   - Limit the use and disclosure of sensitive personal information To exercise your CCPA rights, contact privacy@mendozaimmigration.com or call (480) 666-5553. We will respond to verified requests within 45 days. 19. Your Rights Depending on your jurisdiction, you may have the right to:   - Access your personal data   - Correct inaccurate data   - Delete your data (subject to legal requirements)   - Port your data to another service   - Object to certain processing   - Withdraw consent where processing is based on consent   - Opt out of AI-assisted document processing To exercise these rights, contact privacy@mendozaimmigration.com. 20. Contact Us For questions about this Privacy Policy or our data practices: Mendoza Immigration Privacy Officer: privacy@mendozaimmigration.com General Inquiries: support@mendozaimmigration.com Legal Department: legal@mendozaimmigration.com