PRIVACY POLICY

Effective Date: March 19, 2026

Version: 2026.03.19

This Privacy Policy explains how MyVisa Immigration, Inc., a Delaware corporation doing business as Track My Visa (“Track My Visa,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you access or use our website, applications, and related services (collectively, the “Services”).

We are committed to protecting your privacy and handling your information in a transparent, responsible manner. By using the Services, you acknowledge that we collect, use, disclose, and retain information as described in this Privacy Policy. If you do not agree with the terms of this Policy, please do not use the Services.

If you are a resident of California, the European Economic Area (EEA), Switzerland, or the United Kingdom, additional privacy rights may apply to you. Please see Section 10 (“Your Privacy Rights”) below.

Definitions

• “Personal Information” means information that identifies, relates to, describes, or can reasonably be linked to you (directly or indirectly).
• “Receipt Number” means a USCIS receipt number (also known as a case number) used to retrieve immigration Case Data.
• “Case Data” means case status, case status history, and other case metadata returned by USCIS and any case metadata you provide in the Services.
• “Pseudonymized Analytics Data” means analytics records used to generate aggregated statistics, graphs, reports, insights, and estimates. These records are derived from data that has been de-identified and pseudonymized through technical and organizational safeguards, including cryptographic hashing of identifiers and separation from primary account and operational systems. Pseudonymized Analytics Data does not include raw account identifiers or raw USCIS Receipt Numbers. Although this data is designed to reduce direct identifiability, it is not fully anonymous and, in limited circumstances, may still be capable of being associated with a particular user or case by authorized personnel using additional information available in other systems. Pseudonymized Analytics Data is stored separately from user accounts and operational systems and is used only as described in Sections 5 and 6.

1. Information We Collect

We collect information in the following categories to operate the Services, respond to your requests, and improve performance.

1.1 Information You Provide

• Account information: Your email address and any optional profile information you choose to provide.
• Case inputs: USCIS receipt numbers you submit for tracking, along with labels or metadata you add.
• Support communications: Messages, feedback, or inquiries you send to our support team.
• Optional linked-account information: If you choose to connect a third-party account or community profile (such as Discord), we collect the identifiers needed to maintain that connection and provide related features.
• Subscription and billing information: We receive and maintain limited subscription and billing information, such as subscription tier, subscription status, billing period, transaction metadata, and provider-issued customer identifiers from our payment processor. Track My Visa does not directly store payment card numbers.

1.2 Information Collected Automatically

When you use the Services, certain technical information is collected automatically to help us operate securely and understand how the product performs.

• Log and device information: This may include your IP address, browser and device type, timestamps, referring pages, usage events, and an approximate location derived from your IP address.
• Cookies and similar technologies: We use cookies and related technologies to maintain sessions, improve functionality, and analyze usage. We request your consent before using non-essential cookies or similar technologies, such as analytics cookies. See our Cookie Policy for details.

1.3 Information Processed by Service Providers

Some of the information described in this Section 1 is processed on our behalf by service providers, as described in Section 4. Track My Visa does not directly store payment card numbers, full billing details, or passwords.

1.4 Sensitive and excluded categories of data

Except as expressly described in this Privacy Policy or voluntarily submitted by you in a free-form communication (such as a support request), Track My Visa does not collect precise geolocation data, address-book or contact-list data, biometric data, genetic data, or medical or health information through the Services.

We do collect approximate geolocation derived from IP address, and we receive limited payment and subscription metadata from our payment processor, but we do not directly store payment card numbers.

2. How We Use Information

We use the information we collect to operate, protect, and improve the Services. Specifically, we use it to:

Provide, maintain, and improve the Services
This includes querying USCIS case status for the receipt numbers you choose to track, confirming you are authorized to track those cases, maintaining your account, and delivering core product functionality.

Communicate with you
We send transactional communications such as service updates, billing notices, and security alerts. These messages are necessary to operate your account.

Provide support and respond to requests
We use your information to respond to questions, troubleshoot issues, and improve your experience.

Protect security and prevent misuse
We use information to detect fraud, abuse, unauthorized access, and technical issues, and to maintain the integrity of the Services.

Comply with legal obligations and enforce agreements
We may use information to comply with applicable law, respond to lawful requests, and enforce our Terms of Service and policies.

Improve performance and develop new features
We use Pseudonymized Analytics Data records to understand usage trends, generate aggregated graphs, reports, and estimates. We also use Pseudonymized Analytics Data records to research, design, test, and launch new tools, features, and improvements that make the Services more useful and reliable (see Section 5 and Section 6).

3. Receipt Numbers

3.1 Collection

We collect Receipt Numbers only when you voluntarily submit them to track a case. We do not generate, guess, or obtain Receipt Numbers from third parties.

3.2 Transmission

Receipt Numbers are transmitted to our servers over HTTPS, which encrypts data in transit to protect against interception.

3.3 Storage

Receipt Numbers are securely stored in our database systems.

3.4 Use

We use Receipt Numbers solely to operate the case tracking features our Services provide. This includes:

• Querying the USCIS Case Status API to retrieve updates and update your Case Data. Status-check frequency and available features may vary by paid plan; a paid subscription may allow more frequent checks.
• Deliver personalized Services, such as case status history and estimates
• Send notifications, such as case status change alerts

3.5 Protection

Receipt Numbers are private to your account and are not visible to other users.

We do not disclose Receipt Numbers to third parties except as necessary to operate the Services, comply with law, protect the Services, or as otherwise described in this Privacy Policy. Examples may include querying USCIS systems and sending you email notifications.

4. Service Providers and Third Parties We Use

We use specialized third-party providers to operate core functions of the Services. These providers act as service processors and handle data only on our behalf and under our instructions.

We use the following third parties to operate the Services:

• Auth0 (authentication): provides account login and identity management.
• Stripe (payments): processes payments and subscription billing.
• Twilio / Postmark (communications): supports service-related messaging (for example, email verification and case status notifications).
• Amazon Web Services (AWS) (infrastructure): hosts and runs the Services and stores operational data.
• Google Analytics (analytics): helps us understand how users interact with the Services so we can improve performance and usability.

All third parties that process, store, or receive customer data on our behalf are contractually required to comply with confidentiality, security, limited-use, and retention obligations that are no less protective than the material requirements described in this Privacy Policy and applicable law. They may process user information only to provide services to Track My Visa in accordance with our written instructions and may not use, disclose, sell, share, or retain it for their own independent purposes, except where disclosure is required by law.

Third-party use or disclosure of user information, including de-identified, anonymized, or pseudonymized data, for any purpose other than providing services to Track My Visa is prohibited unless the user has provided active consent to that use or disclosure.

5. Pseudonymized Analytics Data

To generate aggregated statistics, reports, graphs, insights, and estimates, we maintain a separate analytics system that contains Pseudonymized Analytics Data records. These records are derived from data that has been de-identified and pseudonymized before entering the analytics system.

The analytics records:

• do not include names, email addresses
• do not include raw USCIS receipt numbers or account identifiers
• do not contain information that directly identifies an individual
• are designed to reduce the ability of analytics systems and personnel to directly associate records with a specific user or USCIS case

Before any data enters this analytics system, identifiers and receipt numbers are transformed using one-way cryptographic hashing and stored separately from primary account and operational systems. Pseudonymized Analytics Data records are stored separately from user accounts and operational systems.

The analytics system is used only to produce aggregated statistics and trends and is not used to make decisions about individual users or cases.

We retain limited internal technical controls designed only to prevent duplicate counting in aggregate statistics. These controls are designed to reduce duplicate counting and are not intended to be used to identify a particular individual or USCIS case. They are not accessible to analytics, reporting, or research systems.

We do not use Pseudonymized Analytics Data to directly identify individuals or USCIS cases except as necessary for deletion-request handling, security, fraud prevention, debugging, compliance, or other permitted internal purposes. We prohibit use of this data for unauthorized identification attempts.

6. Sharing and Disclosure of Information

We share information only as necessary to operate the Services, comply with the law, and protect the safety and integrity of our platform. We do not sell Personal Information.

6.1 We do not sell user data

Track My Visa does not sell, rent, lease, license, trade, or otherwise exchange for money or other valuable consideration any Personal Information, Receipt Numbers, Case Data, or de-identified, anonymized, or pseudonymized data. We also do not share Personal Information for cross-context behavioral advertising.

6.2 Service providers (processors)

We share Personal Information with trusted service providers that perform services on our behalf, such as authentication, payments, communications, infrastructure hosting, and analytics.

These providers:

• receive only the information necessary to perform their functions
• may process data only to provide services to us

Examples of provider functions include identity management, payment processing, messaging delivery, hosting infrastructure, and system analytics.

6.3 Aggregated analytics and reports

We may use Pseudonymized Analytics Data to produce aggregated statistics, reports, trends, and insights about immigration case activity and processing patterns.

These materials:

• do not identify individual users
• do not reveal specific Receipt Numbers
• are generated from de-identified records as described in Section 5

6.4 Legal and safety disclosures

We may disclose information when required by law, subpoena, court order, or legal process, or when we believe disclosure is reasonably necessary to:

• comply with legal obligations
• enforce our agreements and policies
• protect our rights, safety, or security

6.5 Your data-sharing choices; risks, benefits, and limitations

Your choices. You control whether you submit Receipt Numbers and what case metadata you add. You may request account deletion at any time as described in Section 8. During deletion, you must choose whether your Pseudonymized Analytics Data records are also deleted.

Benefits. Sharing Case Data with the Services can help you monitor status changes, view your case history in one place, and access graphs, reports, and estimates generated from aggregated analytics.

Risks. Submitting Receipt Numbers and Case Data to any online service carries privacy and security risk. While we use reasonable safeguards, no system can guarantee complete security.

Limitations. Graphs, reports, and estimates are informational and may be incomplete or inaccurate.

Impact on others. Case Data may relate to other people (for example, an applicant, petitioner, beneficiary, spouse, child, or sponsor). Entering or tracking a Receipt Number without authorization may violate their privacy and applicable law. You should only share and track Case Data you are authorized to share and track.

7. Data Retention

We retain Personal Information only for as long as necessary to operate the Services and fulfill the purposes described in this Policy. In general, Personal Information is retained:

• while your account is active or you maintain an Active Subscription
• as reasonably necessary to provide the Services
• to resolve disputes and enforce agreements
• to detect and prevent fraud, abuse, or security incidents

Specific details on how to delete your account and deletion timelines are described in Section 8.

7.1 Inactivity deletion (5 years)

Accounts that remain inactive for more than five (5) years are automatically deleted. This deletion removes or de-identifies the account and its associated Personal Information from our active systems, subject to the limited exceptions described in this Privacy Policy. The account’s Pseudonymized Analytics Data records are also deleted as part of this process.

8. Data Deletion and Account Closure

You may request deletion of your account and Personal Information:

• through our in-service self-service account deletion feature, or
• by emailing support@trackmyvisanow.com from the email associated with your account

We may request information necessary to verify your identity before processing deletion.

8.1 How to delete your account from our in-service self-service deletion feature

When deleting your account through our in-service self-service deletion feature, you may choose either to delete your Pseudonymized Analytics Data along with your account data or to allow us to retain that Pseudonymized Analytics Data as described in this Privacy Policy.

Choosing to retain your Pseudonymized Analytics Data allows us to help other USCIS applicants get more accurate insights. Pseudonymized Analytics Data is described in Section 5. To delete your account from our in-service self-service deletion feature you must:

1. Navigate to your account settings
2. Select delete account
3. Confirm that you wish to proceed with account deletion
4. Choose between deleting everything, including your Pseudonymized Analytics Data, or deleting your account data while allowing us to retain your Pseudonymized Analytics Data (see Section 8.4)

8.2 Deletion timing

We will complete account deletion within approximately 72 hours of a verified request, unless we are required to retain certain information for legal compliance, fraud prevention, security, or dispute resolution.

8.3 What deletion removes

Account deletion removes or de-identifies personal information associated with your account from our active systems, subject to limited exceptions for legal compliance, fraud prevention, security, dispute resolution, tax and accounting obligations, and the technical limitations of certain service providers. This includes, to the extent applicable:

• Personal Information (email, linked identifiers such as Discord ID if provided)
• Authentication profile (via our auth provider)
• Stripe customer/billing profile (to the extent supported by Stripe’s systems and legal retention rules)
• Subscription history in our systems
• Receipt Numbers and associated Case Data in our systems
• User-provided case metadata
• Optionally, the Pseudonymized Analytics Data records will also be deleted (see Section 8.4)

Deletion is irreversible once completed.

We may maintain a deletion record with a one-way cryptographic hash of your email address in order to prevent fraud and demonstrate compliance.

8.4 Required deletion choice: what happens to Pseudonymized Analytics Data records

When requesting account deletion, you will be asked to choose whether your associated Pseudonymized Analytics Data records should also be deleted. You must select “YES” or “NO” (in plain-English terms) before submitting deletion.

If you choose deletion, those analytics records will be permanently removed. If you choose to retain them, the records will remain in pseudonymized form, stored separately from your deleted account data, and used only as described in this Privacy Policy.

Where Pseudonymized Analytics Data is retained following account deletion, it remains separated from deleted account data and is no longer maintained in a manner intended to support routine association with your deleted account.

8.5 Free trial or abuse prevention

If you use a free trial or are blocked from using the Services, we may retain records containing a one-way cryptographic hash of your email and your Receipt Number to prevent repeated abuse and protect the Services. We retain these records for up to three (3) years, after which they are automatically deleted.

9. Security and Data Breach Notification

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, and alteration.

If we become aware of a data breach that compromises the security, confidentiality, or integrity of your Personal Information, we will notify affected users through email and provide instructions for actions you may take.

The notification will describe, to the extent known:

• the nature of the incident
• the types of information involved
• the measures we have taken or plan to take to address the incident
• recommended steps you may take to protect yourself

We will provide reasonable support and guidance following a breach and may update users as additional information becomes available.

10. Your Privacy Rights

10.1 California (CCPA/CPRA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights include the following:

• Know what Personal Information we collect about you, including the categories of Personal Information collected, the categories of sources from which it is collected, the business or commercial purposes for collecting, using, and disclosing it, the categories of third parties to whom it is disclosed, and the specific pieces of Personal Information we have collected about you (see Sections 1 and 11.1).
• Delete personal information collected from you
• Opt out of the sale or sharing of your personal information
• Correct inaccurate personal information
• Limit the use of sensitive personal information to certain permitted purposes
• Receive notice about data collection practices at or before the time your information is collected
• Be free from discrimination for exercising your privacy rights

We do not sell Personal Information or share Personal Information for cross-context behavioral advertising, and we do not discriminate against users for exercising applicable privacy rights. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

In the preceding 12 months, we have disclosed categories of Personal Information to service providers and contractors for business purposes as described in Section 11.1, which also identifies the categories of Personal Information collected, the categories of sources from which it was collected, the business or commercial purposes for collecting and disclosing it, the categories of service providers or contractors to whom it was disclosed, whether it was sold or shared, and the applicable retention period or retention criteria for each category.

We do not use or disclose Sensitive Personal Information for purposes other than those permitted by the CCPA and its regulations.

10.1.1 What is considered personal information and sensitive personal information under the CCPA?

Under California law, personal information is information that identifies, relates to, or can reasonably be linked to you or your household. This can include things like your name, email address, purchase records, internet activity, location data, and inferences about your preferences.

Sensitive personal information is a narrower category that includes highly private data such as government identifiers, financial account credentials, precise geolocation, message contents, biometric or genetic data, and information about health, sexual orientation, race, religion, or union membership. California consumers have the right to limit how businesses use and disclose sensitive personal information.

Publicly available information is not considered personal information under the CCPA.

10.1.2 How to exercise your rights as a California consumer

California consumers may exercise their privacy rights by emailing support@trackmyvisanow.com. Where available, consumers may also submit requests through in-service account tools or any online privacy request form or portal we make available through the Services.

To protect your Personal Information and prevent fraud, we may verify requests to know, delete, and correct by asking for information such as your name, email address, account details, or information related to recent account activity. The information we request for verification will depend on the nature of the request, the sensitivity of the information at issue, and the risk of harm from unauthorized disclosure, deletion, or correction.

Authorized agents may submit requests on behalf of a California consumer by contacting us at support@trackmyvisanow.com and providing proof of authorization to act on the consumer’s behalf, such as written permission signed by the consumer, unless another form of authority is permitted by applicable law. We may also ask the consumer to verify their own identity directly with us or to confirm that they authorized the agent to act on their behalf.

10.1.3 California Notice at Collection

At or before the point of collection, California consumers are entitled to notice of the categories of Personal Information and Sensitive Personal Information we collect, the purposes for which we collect or use that information, whether we sell or share it, and the retention period or retention criteria for each category. The information required for that notice is provided in Section 11.1 of this Privacy Policy, together with the plain-language summary in Section 1 and any supplemental notice presented at or before collection.

10.2 EEA / UK / Switzerland

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process Personal Information in accordance with applicable data protection laws. You may have rights to:

• access your Personal Information
• correct inaccurate or incomplete Personal Information
• request deletion of your Personal Information
• restrict certain processing
• object to certain processing
• receive a portable copy of certain Personal Information
• withdraw consent at any time, where processing is based on consent
• lodge a complaint with your local supervisory authority or, in the United Kingdom, the Information Commissioner’s Office

Providing certain Personal Information, such as your email address and Receipt Numbers, is necessary for us to create your account and provide the requested Services. If you do not provide this information, we may be unable to provide some or all of the Services.

Legal Bases for Processing

If you are located in the EEA, United Kingdom, or Switzerland, we process Personal Information under one or more of the following legal bases, depending on the context:

Performance of a contract: to create and maintain your account, provide case tracking and notifications, process subscriptions, respond to your requests, and otherwise provide the Services you request.

Legitimate interests: to secure and administer the Services, prevent fraud and abuse, maintain system integrity, troubleshoot issues, improve performance and usability, develop and test features, maintain internal records, and generate aggregated analytics and reports, provided that our interests are not overridden by your rights and freedoms.

Legal obligation: to comply with applicable laws, regulations, lawful requests, tax and accounting obligations, dispute-resolution obligations, and enforcement obligations.

Consent: where required by law, such as for certain cookies or similar technologies, or where we otherwise specifically request your consent.

International Transfers

Personal Information may be processed in the United States and other countries where we or our service providers operate. Where required by applicable law, we rely on appropriate safeguards for international transfers, such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum, or other lawful transfer mechanisms. You may contact us for more information about these safeguards.

Personal Data Obtained from Other Sources

In some cases, we may process Personal Information that we do not collect directly from the individual concerned. For example, this may include Case Data returned by USCIS systems in response to a query you direct us to make, or case-related information you submit that relates to another person. In those cases, the categories of Personal Information may include Receipt Numbers, Case Data, case-related labels or metadata, and related account or support information. The sources of that information may include you, USCIS systems, and our service providers acting on our behalf. We use that information to provide the Services, maintain account functionality, protect the Services, respond to support requests, comply with law, and otherwise as described in this Privacy Policy.

Automated Decision-Making

Track My Visa does not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you. Our estimates, analytics, graphs, and reports are informational tools and are not used to make legal, immigration, employment, credit, housing, insurance, or similarly significant decisions about you.

10.2.1 How to exercise your rights as an EEA / UK / Switzerland consumer

EEA / UK / Switzerland consumers may exercise their privacy rights by emailing support@trackmyvisanow.com.

Once we respond to a request, we may ask for information we consider necessary to verify your identity and prevent fraud. This may include your name, contact information, and information related to your account. The specific information requested may vary depending on the nature of your request and is used only for verification and security purposes.

11. Supplemental Explanations and Cross-References

The primary categories of Personal Information we collect are described in Section 1. Additional category-specific explanations appear in Section 3 (Receipt Numbers), Section 5 (Pseudonymized Analytics Data), Section 8 (deletion-related records and limited retained records for compliance, fraud prevention, and abuse prevention), and Section 10.2 (Personal Data Obtained from Other Sources).

Section 11.1 provides the category-level California disclosures for the preceding 12 months, including the categories of Personal Information and Sensitive Personal Information collected, categories of sources, business or commercial purposes, categories of service providers or contractors to whom information was disclosed for a business purpose, whether information was sold or shared, and the applicable retention period or retention criteria for each category.

11.1 California category disclosures (preceding 12 months)

The section below describes the categories of Personal Information and Sensitive Personal Information we have collected in the preceding 12 months, the categories of sources from which we collected it, the business or commercial purposes for which we collected and disclosed it, the categories of service providers or contractors to whom it was disclosed for a business purpose, whether it was sold or shared in the preceding 12 months, and our retention period or retention criteria for each category.

12. Change of Ownership or End of Business

If Track My Visa undergoes a merger, acquisition, reorganization, bankruptcy, sale of assets, or other change of ownership or control, your Personal Information may be transferred only subject to privacy and security protections that are at least as protective as those described in this Privacy Policy, unless we first provide clear notice and obtain any consent required by applicable law.

Before any such transfer becomes effective, we will notify affected users by email and through an in-product notice, provide a plain-language summary of the change, and give users a reasonable opportunity to close their account and request permanent deletion of their Personal Information, except to the extent we must retain certain information by law.

If Track My Visa ceases operations and no successor will continue the Services, we will securely delete or de-identify Personal Information in accordance with this Privacy Policy and applicable law.

13. Policy Changes and Active Consent

We may update this Privacy Policy from time to time. When we do, we will maintain a record of prior versions and provide a summary of material changes in plain language.

If we make any changes to this Privacy Policy, we will request your active consent of the updated Privacy Policy through a clear in-product prompt. Until you accept the updated Privacy Policy, your access to certain features may be limited or suspended.

If you do not agree to the updated Privacy Policy, you must stop using the Services. You may request deletion of your account and data in accordance with this Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at support@trackmyvisanow.com.