PRIVACY POLICY

Effective Date: September 22, 2026

Version: 2026.09.22

This Privacy Policy explains how MyVisa Immigration, Inc., a Delaware corporation doing business as Track My Visa™ (“Track My Visa,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you access or use our website, applications, and related services (collectively, the “Services”).

We are committed to protecting your privacy and handling your information in a transparent, responsible manner. By using the Services, you acknowledge that we collect, use, disclose, and retain information as described in this Privacy Policy. If you do not agree with the terms of this Policy, please do not use the Services.

Acknowledging this Policy is not the same as consenting to a third party using your information for its own purposes. Where this Policy requires your active consent, we ask for it separately. See Section 4.4.

If you are a resident of California, the European Economic Area (EEA), Switzerland, or the United Kingdom, additional privacy rights may apply to you. Please see Section 10 (“Your Privacy Rights”) below.

Definitions

• “Personal Information” means information that identifies, relates to, describes, or can reasonably be linked to you (directly or indirectly).
• “Receipt Number” means a USCIS receipt number (also known as a case number) used to retrieve immigration Case Data.
• “Case Data” means case status, case status history, and other case metadata returned by USCIS and any case metadata you provide in the Services.
• “Restricted Service Provider” means a company that handles information on our behalf and only to provide services to us, under the contractual restrictions described in Section 4.2.
• “External Service” means a separately operated service that you choose to use, and whose own privacy practices apply to the information you provide directly to it, as described in Section 4.3.
• “Independent Third-Party Use” means use or disclosure of user information by a third party for its own purposes rather than to provide services to us, as described in Section 4.4. Where this Policy uses statutory terms such as “service provider,” “contractor,” or “processor,” those terms carry the meaning given by the applicable law.
• “Insights” means our optional analytics product — aggregated graphs, reports, trends, and estimates — offered free with advertising or ad-free with a paid subscription, as described in Section 4.6. Insights is separate from core case tracking.
• “Pseudonymized Analytics Data” means analytics records used to generate aggregated statistics, graphs, reports, insights, and estimates. These records are derived from data that has been de-identified and pseudonymized through technical and organizational safeguards, and they do not include raw account identifiers or raw USCIS Receipt Numbers. Section 5 describes how these records are created, stored, used, and limited.

1. Information We Collect

We collect information in the following categories to operate the Services, respond to your requests, and improve performance.

1.1 Information You Provide

• Account information: Your email address and any optional profile information you choose to provide.
• Third-party sign-in information: If you create or access your account using a third-party sign-in provider, such as Google, you are choosing to use that provider’s own sign-in service. We receive basic profile information from that provider, such as your email address, name, and a provider-issued account identifier. We do not receive your password for that third-party account. See Section 4.3.
• Case inputs: USCIS receipt numbers you submit for tracking, along with labels or metadata you add.
• Support communications: Messages, feedback, or inquiries you send to our support team.
• Reviews and testimonials: Reviews of the Services are posted on outside platforms such as Trustpilot or an app store, and we may use Trustpilot to send you an invitation to leave one. If we offer a review feature within the Services, we collect the content you provide and the information needed to attribute and manage it. See Section 6.6.
• Optional linked-account information: If you choose to connect a third-party account or community profile (such as Discord), we collect the identifiers needed to maintain that connection and provide related features. If you interact with the Track My Visa Bot in a Discord server we operate, the information the Bot handles within Discord is described separately in our Discord Bot Privacy Notice.
• Subscription and billing information: When you subscribe on our website, you enter your payment information on a checkout page hosted by our payment processor. When you subscribe inside our mobile app, the purchase is completed by the Apple App Store or Google Play, and we receive confirmation of it through our mobile subscription provider. We receive and maintain limited subscription and billing information, such as subscription tier, subscription status, billing period, transaction metadata, and provider-issued customer identifiers from that processor. Track My Visa does not directly store payment card numbers. See Section 4.3.

1.2 Information Collected Automatically

When you use the Services, certain technical information is collected automatically to help us operate securely and understand how the product performs.

• Log and device information: This may include your IP address, browser and device type, timestamps, referring pages, usage events, and an approximate location derived from your IP address.
• Cookies and similar technologies: We use cookies and related technologies to maintain sessions, improve functionality, and analyze usage. We request your consent before using non-essential cookies or similar technologies, such as analytics cookies. See our Cookie Policy for details.
• Security and anti-abuse signals: Our infrastructure provider runs security tooling that checks whether a request to the Services is coming from a person rather than an automated program. It examines the technical characteristics of each request, such as the IP address it comes from, the browser or device type it reports, and the volume and pattern of requests over time. This checking happens on our servers. It does not install anything on your device, and it does not observe how you interact with a page. The signals it examines are not used to identify you as an individual. We use it only to protect accounts and prevent abuse of the Services, and it is provided by our infrastructure provider as described in Section 4.2.
• Push notification tokens: When you sign in to our mobile app, it connects to our push notification provider so that we can reach your device. Where your device allows notifications from the app, your device is issued a push token that lets us send you notifications. You can turn notifications off at any time in the app or in your device settings. See Section 4.2.
• Advertising data (only with your consent): If you turn on the free, ad-supported version of Insights, our advertising provider collects the information described in Section 4.6. If you do not, the advertising software in our apps is never initialized and collects nothing.
• Email open and engagement information: Emails we send may contain a small tracking pixel and tracked links that tell us whether and when a message was opened and whether you clicked any links in it. This applies to transactional emails sent through our email provider, such as email verification, password resets, case status notifications, and subscription or cancellation notices. It also applies to customer-support emails sent through our support tool, which lets our support team see whether a support email has been opened and whether its links were clicked. It also applies to marketing emails we send, which you can opt out of at any time (see Section 2). We use this information to confirm delivery, understand engagement, and improve our communications and support.

1.3 Information Processed by Service Providers

Some of the information described in this Section 1 is processed on our behalf by service providers, as described in Section 4. Track My Visa does not directly store payment card numbers, full billing details, or passwords.

1.4 Sensitive and excluded categories of data

Except as expressly described in this Privacy Policy or voluntarily submitted by you in a free-form communication (such as a support request), Track My Visa does not collect precise geolocation data, address-book or contact-list data, biometric data, genetic data, or medical or health information through the Services.

We do collect approximate geolocation derived from IP address, and we receive limited payment and subscription metadata from our payment processor, but we do not directly store payment card numbers.

2. How We Use Information

We use the information we collect to operate, protect, and improve the Services. Specifically, we use it to:

Provide, maintain, and improve the Services

This includes querying USCIS case status for the receipt numbers you choose to track, confirming you are authorized to track those cases, maintaining your account, and delivering core product functionality.

Communicate with you

We send transactional communications such as service updates, billing notices, and security alerts. These messages are necessary to operate your account.

Send marketing communications

We may send you marketing emails about products, features, and offers. Every marketing email includes an easy way to unsubscribe, and you can opt out at any time. Opting out of marketing does not affect the transactional communications that are necessary to operate your account. We do not share your information with third parties for their own marketing. Our rule against selling information, and against sharing it for cross-context behavioral advertising, is stated in Section 6.1.

Operate the free, ad-supported version of Insights

If you use the free, ad-supported version of Insights, we may use information we already hold — such as your subscription status, how you use the Services, and your Case Data — to decide when and how often ads appear. These decisions are made by our app and our own systems, never by our advertising provider. What our advertising provider receives and never receives, and the active consent that controls all of it, are described in Section 4.6.

Provide support and respond to requests

We use your information to respond to questions, troubleshoot issues, and improve your experience.

Protect security and prevent misuse

We use information to detect fraud, abuse, unauthorized access, and technical issues, and to maintain the integrity of the Services.

Comply with legal obligations and enforce agreements

We may use information to comply with applicable law, respond to lawful requests, and enforce our Terms of Service and policies.

Improve performance and develop new features

We use Pseudonymized Analytics Data records to understand usage trends, generate aggregated graphs, reports, and estimates. We also use Pseudonymized Analytics Data records to research, design, test, and launch new tools, features, and improvements that make the Services more useful and reliable (see Section 5 and Section 6).

3. Receipt Numbers

3.1 Collection

We collect Receipt Numbers only when you voluntarily submit them to track a case. We do not generate, guess, or obtain Receipt Numbers from third parties.

3.2 Transmission

Receipt Numbers are transmitted to our servers over HTTPS, which encrypts data in transit to protect against interception.

3.3 Storage

Receipt Numbers are securely stored in our database systems.

3.4 Use

We use Receipt Numbers solely to operate the case tracking features our Services provide. This includes:

• Querying the USCIS Case Status API to retrieve updates and update your Case Data. Status-check frequency and available features may vary by paid plan; a paid subscription may allow more frequent checks.
• Deliver personalized Services, such as case status history, and generate the estimates shown in Insights
• Send notifications, such as case status change alerts. Section 4.2 describes what push notifications do and do not contain.

How we use the Case Data retrieved with your Receipt Numbers is described in Section 2. We never use Receipt Numbers for advertising; what advertising providers can and cannot receive is described in Section 4.6.

3.5 Protection

Receipt Numbers are private to your account and are not visible to other users.

As described in Section 4.2, the push notifications we send do not include Receipt Numbers or Case Data.

We do not otherwise disclose Receipt Numbers to third parties except as necessary to operate the Services, in the situations described in Section 6.4, or as otherwise described in this Privacy Policy. Examples may include querying USCIS systems and sending you email notifications.

Work to protect the security of the Services is done by us or by the Restricted Service Providers described in Section 4.2.

4. Service Providers and Third Parties We Use

4.1 Our rule for third-party use

This is the rule that governs the rest of this section.

A company that handles user information on our behalf may use that information only to provide services to Track My Visa. Any use or disclosure of user information for a third party’s own purposes requires your active consent. Section 4.4 states that rule in full and defines active consent.

Separately from that rule, you can choose to use an outside service yourself, such as a payment checkout page or a sign-in provider. When you do, you are dealing with that service directly, and its own privacy practices apply to what you give it. Section 4.3 names those services and explains what we send and what we receive.

We describe every outside company by the role it actually plays. We use three categories:

• Restricted Service Providers handle information on our behalf and only for us. See Section 4.2.
• External Services are separate platforms that you knowingly decide to enter, such as a payment checkout page or a sign-in provider. See Section 4.3.
• Independent Third-Party Use is any use by a third party for its own purposes. We do not permit it without your active consent. See Section 4.4.

One company can fall into more than one category, depending on what it is doing. Where that happens, we describe the activity rather than giving the company a single label.

Advertising, which happens only with your active consent, is described in Section 4.6.

4.2 Restricted Service Providers

We use specialized third-party providers to operate core functions of the Services. These providers act as service processors and handle data only on our behalf and under our instructions.

All third parties that process, store, or receive customer data on our behalf are contractually required to comply with confidentiality, security, limited-use, and retention obligations that are no less protective than the material requirements described in this Privacy Policy and applicable law. They may process user information only to provide services to Track My Visa in accordance with our written instructions and may not use, disclose, sell, share, or retain it for their own independent purposes, except where disclosure is required by law.

We use the following Restricted Service Providers to operate the Services:

• Twilio / Postmark (communications): supports service-related and marketing messaging (for example, email verification, case status notifications, and product updates), including the email open and engagement tracking described in Section 1.2.
• Help Scout (customer support): powers our customer-support email and help desk, including the email open and engagement tracking described in Section 1.2.
• Amazon Web Services (AWS) (infrastructure and security): hosts and runs the Services, stores operational data, and provides the bot- and abuse-protection that guards our sign-in pages and apps, including the request-level security signals described in Section 1.2.
• Google Analytics (analytics): helps us understand how users interact with the Services so we can improve performance and usability. See Section 4.5 for how we configure this service.
• Sentry (error monitoring): helps us detect, diagnose, and fix application crashes and technical errors so we can improve the reliability of the Services. It receives crash and error reports, along with basic diagnostic information about app sessions, such as the app version and device type. We configure this service not to collect IP addresses, request contents, screenshots, or session recordings. Receipt Numbers, email addresses, and similar identifiers are removed from crash reports on your device, and again by the service before a report is stored.
• RevenueCat (mobile subscriptions): manages subscriptions bought inside our mobile app. It validates the store receipt with Apple or Google and tells us which subscription an account holds. We identify your account to RevenueCat with an internal account identifier only, a random string. We do not send it your email address, Receipt Numbers, or Case Data.
• Google Firebase Cloud Messaging (push notifications): delivers push notifications to your device when your device allows them. It receives your device push token and the notification we ask it to deliver. Those notifications do not contain your Receipt Numbers or Case Data. They tell your device that something has changed, and the app then retrieves the details from us over its own secure connection. On iPhone and iPad, delivery also passes through Apple’s push notification service.
• Trustpilot (review invitations): sends review invitations to you on our behalf. We supply only the limited contact information needed to send an invitation. We do not send Receipt Numbers or Case Data for this purpose. See Section 6.6.

We run authentication for Track My Visa accounts ourselves, and we do not use an outside identity provider for it. If you choose to sign in with Google instead, see Section 4.3.

4.3 External Services you choose to use

Some features work by sending you to an External Service that you knowingly choose to use. When that happens, you provide information directly to that service, and its own privacy practices apply to what you give it. We tell you where you are going before you leave, so that you can decide whether to continue.

We share as little as we can with these External Services. Where we send information ourselves, we send only what the feature needs in order to work. Where one of them also uses information for its own purposes, we say so below, so that you can decide whether to use the feature.

• Stripe (payments and checkout): When you subscribe, we direct you to a checkout page hosted by Stripe, and you choose whether to continue to it. Before you get there, we send Stripe two things: your email address, so that it is filled in for you, and an internal account identifier, a random string we use to match your subscription to your account. We send nothing else, and we never send Receipt Numbers or Case Data. You enter your payment information directly with Stripe. Stripe handles that information under its own privacy practices, including for its own fraud prevention, compliance, and platform purposes. For the payment and subscription processing that Stripe carries out at our direction, Stripe acts as a Restricted Service Provider and is bound by the restrictions in Section 4.2. We receive only the limited subscription and billing information described in Section 1.1, and we do not receive your full payment card number.
• Google Sign-In (authentication): If you choose to sign in with Google, you are choosing to use Google’s own authentication service, and Google’s privacy practices apply to your interaction with Google. We receive only the limited profile information described in Section 1.1, such as your email address, name, and a Google-issued account identifier. We do not receive your Google password.
• Apple App Store and Google Play (in-app purchases): If you subscribe inside our mobile app, Apple or Google completes the purchase in its own payment sheet, under its own privacy practices. We never receive your payment card details. We learn that the subscription exists through RevenueCat, as described in Section 4.2.
• Trustpilot and app store review platforms (reviews): If you follow a review invitation, or otherwise choose to review the Services on Trustpilot, the Apple App Store, or Google Play, you post that review on the outside platform. That platform’s own privacy practices and terms govern your review. We do not control it, and deleting your Track My Visa account does not remove it. See Section 6.6.
• Discord (optional community features): If you choose to connect a Discord account or to use a Discord server we operate, you are interacting with Discord under its own privacy practices. What our Discord Bot handles inside Discord is described in our Discord Bot Privacy Notice.

4.4 Independent Third-Party Use requires your active consent

Third-party use or disclosure of user information, including de-identified, anonymized, or pseudonymized data, for any purpose other than providing services to Track My Visa is prohibited unless the user has provided active consent to that use or disclosure. A third party’s own purposes include, for example, improving its own products, training models, advertising, profiling, benchmarking, and commercializing the information.

Active consent means a specific, informed choice that you make about that particular use or disclosure. We must ask you before the use or disclosure happens, and we must tell you who the third party is and what it will do with the information.

Accepting this Privacy Policy is not active consent to an independent third-party use, and neither is continuing to use the Services. Where this Policy requires active consent, we will ask you for it separately. Section 13 explains how we ask for your active consent when this Policy itself changes.

4.5 Provider and configuration notes

We keep the list of Restricted Service Providers in Section 4.2 current. If a provider changes what it may do with user information, we review that change before we allow it, and we update this Policy if the provider’s role changes.

Some services can be configured in ways that would let the provider use information for its own purposes. Where that is true, keeping the privacy-protective setting is part of how we meet the rule in Section 4.4. For Google Analytics, we do not enable the data-sharing settings that would let Google use our analytics data to improve Google’s own products and services.

4.6 Advertising and Insights

Insights is our optional analytics product: aggregated graphs, reports, trends, and estimates. It is separate from core case tracking. Core case tracking — submitting Receipt Numbers, receiving status updates and history, and getting notifications — never shows ads and never requires advertising consent.

You can get Insights in two ways:

• Free, with ads. The free version of Insights is supported by advertising served by Google AdMob. It is available only if you give the advertising consent described below.
• Ad-free, with a paid subscription. Subscribers see no ads, and their use of the Services generates no advertising traffic at all.

If you decline or withdraw advertising consent, the free version of Insights is unavailable. You can subscribe instead, or simply not use Insights. Your account, case tracking, and notifications are not affected either way.

Advertising requires your active consent. Google AdMob is the only advertising network we integrate today, and it is an independent third party under Section 4.4. Google is an independent controller of the information it receives for advertising, and its own privacy policy and terms — not this Policy — govern that information. Google works with its own advertising partners to fill and measure ads. What those partners receive from Google is governed by Google’s terms and, in the EEA, UK, and Switzerland, shown in the Google consent prompt described below. We ask for your consent in the app before any advertising software runs. The consent prompt names Google, describes what is sent and what is never sent, explains the purposes, and explains how to withdraw. Accepting this Privacy Policy or our Terms of Service is not that consent (see Section 4.4).

Consent controls the software, not just the ads. The AdMob software in our app is initialized only after you consent. If you decline, it is never initialized and nothing is sent to Google — not even for non-personalized ads.

What is sent with your consent: your device’s advertising identifier (where the device provides one), your IP address, general device and app information, your consent choices, and ad events, such as which ads were shown or tapped. Nothing else.

What is never sent to an advertising partner: your email address, account identifiers, Receipt Numbers, case status, immigration category, filing history, case metadata, or anything derived from your case information. The advertising software receives no device-location permission, and no precise geolocation is used to select or time ads.

Withdrawing consent. You can withdraw advertising consent at any time in the app’s settings. Withdrawal stops transfers to Google going forward. If the advertising software was already running when you withdrew, the app will ask you to close and reopen it to finish turning it off. Withdrawal cannot reach information Google already received while your consent was in effect; Google handles that information under its own privacy policy. After withdrawal, you can subscribe for the ad-free version of Insights or stop using Insights.

Apple’s App Tracking Transparency. On iPhone and iPad, Apple shows its own tracking permission. That permission is separate from our consent and never affects what you get: if you allow ads but decline Apple’s tracking permission, the free version of Insights still works, and the ads are simply less personalized.

In the EEA, UK, and Switzerland, your consent is the legal basis for this processing, and you will also see a Google-certified consent prompt that meets Google’s EU User Consent Policy. That prompt is in addition to ours, never a replacement. Withdrawing consent ends the free version of Insights only.

If you tap an ad, you leave our Services for the advertiser’s page. That is an External Service you choose to enter, as described in Section 4.3.

Retention. The information our app uses to decide when ads appear stays on your device and is cleared when you sign out or delete your account. We also keep a minimal record of each consent you gave or withdrew, including any Google consent prompt you answered, as proof of what was asked and answered. Section 8.3 describes that record and how long we keep it.

California residents: Section 10.1 describes how this consent relates to your rights, including your right to opt out of sharing and our notice of financial incentive.

5. Pseudonymized Analytics Data

To generate aggregated statistics, reports, graphs, insights, and estimates, we maintain a separate analytics system that contains Pseudonymized Analytics Data records. These records are derived from data that has been de-identified and pseudonymized before entering the analytics system.

The analytics records:

• do not include names or email addresses
• do not include raw USCIS receipt numbers or account identifiers
• do not contain information that directly identifies an individual
• are designed to reduce the ability of analytics systems and personnel to directly associate records with a specific user or USCIS case

Before any data enters this analytics system, identifiers and receipt numbers are transformed using one-way cryptographic hashing. Pseudonymized Analytics Data records are stored separately from user accounts, primary account systems, and operational systems.

Although this data is designed to reduce direct identifiability, it is not fully anonymous. In limited circumstances, it may still be capable of being associated with a particular user or case by authorized personnel using additional information available in other systems.

The analytics system is used only to produce aggregated statistics and trends and is not used to make decisions about individual users or cases.

We retain limited internal technical controls designed only to prevent duplicate counting in aggregate statistics. These controls are designed to reduce duplicate counting and are not intended to be used to identify a particular individual or USCIS case. They are not accessible to analytics, reporting, or research systems.

We do not use Pseudonymized Analytics Data to directly identify individuals or USCIS cases except as necessary for deletion-request handling, security, fraud prevention, debugging, compliance, or other permitted internal purposes. We prohibit use of this data for unauthorized identification attempts.

6. Sharing and Disclosure of Information

We share information only as necessary to operate the Services and in the situations described in Section 6.4, such as where the law requires disclosure.

6.1 We do not sell user data

Track My Visa does not sell, rent, lease, license, trade, or otherwise exchange for money or other valuable consideration any Personal Information, Receipt Numbers, Case Data, or de-identified, anonymized, or pseudonymized data. We share Personal Information for cross-context behavioral advertising only with your active consent, if you turn on the free, ad-supported version of Insights, as described in Section 4.6 — and never without it. Section 10.1 describes your right to opt out of that sharing at any time.

6.2 Restricted Service Providers

We share Personal Information with Restricted Service Providers that perform services on our behalf, such as communications, infrastructure hosting, analytics, error monitoring, review invitations, and the payment and subscription processing carried out at our direction.

These providers:

• receive only the information necessary to perform their functions
• may process data only to provide services to us

Examples of provider functions include messaging delivery, hosting infrastructure, system analytics, crash diagnostics, review invitations, and payment processing.

Some services are External Services that you choose to enter yourself, such as the Stripe checkout page or Google Sign-In. Those are described in Section 4.3, and their own privacy practices apply to the information you provide directly to them.

6.3 Aggregated analytics and reports

We may use Pseudonymized Analytics Data to produce aggregated statistics, reports, trends, and insights about immigration case activity and processing patterns.

These materials:

• do not identify individual users
• do not reveal specific Receipt Numbers
• are generated from de-identified records as described in Section 5

6.4 Legal, protective, and emergency disclosures

We disclose information outside the categories described in Section 4 only in the situations described below.

Where the law requires it. That includes a subpoena, court order, warrant, or other valid legal process, and any other legal obligation that compels disclosure.

Protecting our rights, our users, and the Services. We may disclose information where we believe in good faith that disclosure is reasonably necessary to enforce our Terms of Service and policies, or to establish, exercise, or defend legal claims. The same applies where disclosure is reasonably necessary to investigate or stop fraud, abuse, or a security threat, or to protect the rights, property, or safety of Track My Visa, our users, or others. We limit any such disclosure to the information reasonably needed for that purpose. Routine security and fraud-prevention work is still done by us or by the Restricted Service Providers described in Section 4.2.

Emergencies involving a risk to life. We may disclose information to emergency services, such as police, fire, or medical responders, where we believe in good faith that doing so is necessary to prevent an imminent risk of death or serious physical harm to you or to another person. We limit any such disclosure to the information reasonably needed to address the emergency, and we make it only to the responding authority.

None of these disclosures permits the recipient to use your information for its own independent purposes. Section 4.4 continues to apply.

6.5 Your data-sharing choices; risks, benefits, and limitations

Your choices. You control whether you submit Receipt Numbers and what case metadata you add. You may request account deletion at any time as described in Section 8, which includes a required choice about your associated data (see Section 8.4).

Benefits. Sharing Case Data with the Services can help you monitor status changes, view your case history in one place, and, through Insights, access graphs, reports, and estimates generated from aggregated analytics.

Risks. Submitting Receipt Numbers and Case Data to any online service carries privacy and security risk. While we use reasonable safeguards, no system can guarantee complete security. If your device allows notifications from our mobile app, a notification about your case may appear on your device screen, including while the device is locked, where someone else holding your device could see it. You can turn notifications off at any time in the app or in your device settings.

Limitations. Graphs, reports, and estimates are informational and may be incomplete or inaccurate.

Impact on others. Case Data may relate to other people (for example, an applicant, petitioner, beneficiary, spouse, child, or sponsor). Entering or tracking a Receipt Number without authorization may violate their privacy and applicable law. You should only share and track Case Data you are authorized to share and track.

6.6 Reviews and testimonials

Reviews on outside platforms. Reviews of the Services are posted on outside review platforms, such as Trustpilot, the Apple App Store, or Google Play. If you post a review on one of those platforms, you are interacting with that platform directly. Its own privacy practices and terms govern your review and any account you hold with it.

We do not control reviews hosted on those platforms. We cannot edit or remove them, and deleting your Track My Visa account does not delete them. To change or remove a review you posted on an outside platform, use that platform’s own tools or contact it directly.

Review invitations. We may invite you to review the Services. We use Trustpilot to send some of these invitations on our behalf, and we supply only the limited contact information needed to send an invitation. We do not send Receipt Numbers or Case Data for this purpose. For the invitation itself, Trustpilot acts as a Restricted Service Provider, as described in Section 4.2. If you follow the invitation and post a review, you are then using Trustpilot as an outside platform, as described in Section 4.3.

If we offer reviews within the Services. We may offer a review feature within the Services. If you submit a review through such a feature, we collect the content you provide, such as a star rating and any written feedback, along with information associated with your account so we can attribute and manage the review.

We may publish, display, reproduce, and share those reviews to operate and promote the Services, including on our website, within the product, and in marketing materials. A review may be displayed publicly with or without a name or display name. We will make clear, at the time you submit a review, how it may be displayed.

Because a review may be displayed publicly, please do not include sensitive personal information or immigration case details that you do not want to be made public, such as Receipt Numbers, full names, contact information, or specifics about your case. This applies to reviews you post on outside platforms as well as to any review you submit within the Services.

We may decline to publish, edit for length or formatting, or remove any review that we host at any time and for any reason. This includes, for example, reviews that we believe contain profanity or offensive content, are inappropriate, infringe the rights of others, are misleading or inaccurate, misrepresent the Services, are spam or fraudulent, or are otherwise objectionable.

If you believe a review that we host is abusive, inaccurate, or otherwise inappropriate, you can report it by emailing us at support@trackmyvisa.com. For a review on an outside platform, use that platform’s own reporting tools.

Retention and deletion. We keep reviews you submitted within the Services indefinitely, and they may remain even after your account is closed. If your account is deleted for inactivity (see Section 7.1), those reviews are retained. They are removed only if you delete your account and also choose to delete all of your associated data — the “delete everything” option described in Section 8.4. If you delete your account but choose to retain that data, they remain and may continue to be displayed, stored separately from your deleted account.

You may also ask us to delete a review you submitted within the Services without deleting your account. To do so, email us at support@trackmyvisa.com and request deletion of your review.

None of the deletion choices described above reach a review you posted on an outside platform. Those reviews stay under that platform’s control.

7. Data Retention

We retain Personal Information only for as long as necessary to operate the Services and fulfill the purposes described in this Policy. In general, Personal Information is retained:

• while your account is active or you maintain an Active Subscription
• as reasonably necessary to provide the Services
• to resolve disputes and enforce agreements
• to detect and prevent fraud, abuse, or security incidents

Diagnostic and operational logs — technical logs we generate to run, secure, and troubleshoot the Services, which may incidentally include identifiers such as IP addresses or user IDs — are retained only for a limited period and then automatically deleted.

Specific details on how to delete your account and deletion timelines are described in Section 8.

7.1 Inactivity deletion (5 years)

Accounts that remain inactive for more than five (5) years are automatically deleted. This deletion removes or de-identifies the account and its associated Personal Information from our active systems, subject to the limited exceptions described in this Privacy Policy. The account’s Pseudonymized Analytics Data records are also deleted as part of this process. Any reviews you submitted within the Services are not deleted by inactivity deletion; they are retained, separated from the deleted account, as described in Section 6.6. Reviews you posted on an outside platform are not affected by this deletion.

8. Data Deletion and Account Closure

You may request deletion of your account and Personal Information:

• through our in-service self-service account deletion feature, or
• by emailing support@trackmyvisa.com from the email associated with your account

We may request information necessary to verify your identity before processing deletion.

8.1 How to delete your account from our in-service self-service deletion feature

When deleting your account through our in-service self-service deletion feature, you may choose either to delete your Pseudonymized Analytics Data along with your account data or to allow us to retain that Pseudonymized Analytics Data as described in this Privacy Policy.

Choosing to retain your Pseudonymized Analytics Data allows us to help other USCIS applicants get more accurate insights. Pseudonymized Analytics Data is described in Section 5. To delete your account from our in-service self-service deletion feature you must:

• Navigate to your account settings
• Select delete account
• Confirm that you wish to proceed with account deletion
• Choose between deleting everything, including your Pseudonymized Analytics Data and any reviews you submitted within the Services, or deleting your account data while allowing us to retain your Pseudonymized Analytics Data and those reviews (see Section 8.4)

8.2 Deletion timing

We will complete account deletion within approximately 72 hours of a verified request, unless we are required to retain certain information for legal compliance, fraud prevention, security, or dispute resolution.

8.3 What deletion removes

Account deletion removes or de-identifies personal information associated with your account from our active systems, subject to limited exceptions for legal compliance, fraud prevention, security, dispute resolution, tax and accounting obligations, and the technical limitations of certain service providers. This includes, to the extent applicable:

• Personal Information (email, linked identifiers such as Discord ID if provided)
• Authentication profile and sign-in records in our systems
• Stripe customer/billing profile (to the extent supported by Stripe’s systems and legal retention rules)
• Mobile subscription records held by our mobile subscription provider (to the extent supported by that provider’s systems and legal retention rules)
• Push notification tokens for your devices
• Subscription history in our systems
• Receipt Numbers and associated Case Data in our systems
• User-provided case metadata
• Advertising consent state in our systems
• Optionally, the Pseudonymized Analytics Data records and any reviews, ratings, or testimonials you submitted within the Services will also be deleted if you choose to delete everything (see Sections 6.6 and 8.4)

Deletion is irreversible once completed.

If you interact with the Track My Visa Bot in a Discord server we operate, the information the Bot collects within Discord is described in, and governed by, our Discord Bot Privacy Notice, not this section. In particular, deleting your Track My Visa account does not automatically delete community-safety records the Bot keeps for abuse prevention, such as records of moderation actions (for example, warnings or bans). These records are limited, do not include general message content, are kept separately from your account, and are retained only as long as needed to prevent spam, scams, harassment, and ban evasion.

We may maintain a deletion record with a one-way cryptographic hash of your email address in order to prevent fraud and demonstrate compliance. If you ever used the ad-supported version of Insights, we also keep a minimal record of each advertising consent you gave or withdrew. The record shows the time and the version of the consent prompt you saw. If you answered a Google consent prompt, it also shows what that prompt recorded, and the app version and platform you answered it on. These records are limited to what shows that a consent was asked for and given or withdrawn. They are kept apart from your account under a one-way cryptographic identifier, and they contain no Case Data. We keep them for three (3) years after your account is deleted, after which they are automatically deleted. Deletion cannot reach information Google already received while your consent was in effect (see Section 4.6).

8.4 Required deletion choice: what happens to Pseudonymized Analytics Data records and reviews

When requesting account deletion, you will be asked to choose whether your associated data — your Pseudonymized Analytics Data records and any reviews you submitted within the Services — should also be deleted. You must select “YES” or “NO” (in plain-English terms) before submitting deletion.

If you choose deletion, those analytics records will be permanently removed. If you choose to retain them, the records will remain in pseudonymized form, stored separately from your deleted account data, and used only as described in this Privacy Policy.

The same choice applies to reviews you submitted within the Services, with the outcomes described in Section 6.6.

This choice does not reach reviews you posted on an outside platform (see Section 6.6).

Where Pseudonymized Analytics Data is retained following account deletion, it remains separated from deleted account data and is no longer maintained in a manner intended to support routine association with your deleted account.

8.5 Free trial or abuse prevention

If you use a free trial or are blocked from using the Services, we may retain records containing one-way cryptographic hashes of your email address and of your Receipt Number to prevent repeated abuse and protect the Services. We retain these records for up to three (3) years, after which they are automatically deleted.

9. Security and Data Breach Notification

We use reasonable administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, and alteration.

If we become aware of a data breach that compromises the security, confidentiality, or integrity of your Personal Information, we will notify affected users through email and provide instructions for actions you may take.

The notification will describe, to the extent known:

• the nature of the incident
• the types of information involved
• the measures we have taken or plan to take to address the incident
• recommended steps you may take to protect yourself

We will provide reasonable support and guidance following a breach and may update users as additional information becomes available.

10. Your Privacy Rights

10.1 California (CCPA/CPRA)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights include the following:

• Know what Personal Information we collect about you. This includes the categories of Personal Information collected and the categories of sources it comes from. It also includes the business or commercial purposes for collecting, using, and disclosing it, the categories of third parties we disclose it to, and the specific pieces of Personal Information we have collected about you (see Sections 1 and 11.1).
• Delete personal information collected from you
• Opt out of the sale or sharing of your personal information
• Correct inaccurate personal information
• Limit the use of sensitive personal information to certain permitted purposes
• Receive notice about data collection practices at or before the time your information is collected
• Be free from discrimination for exercising your privacy rights

We do not sell Personal Information. We share Personal Information for cross-context behavioral advertising only with your active consent, if you turn on the free, ad-supported version of Insights (see Section 4.6). We do not discriminate against users for exercising applicable privacy rights. The Services are limited to users 18 or older, and we do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

In the preceding 12 months, we have disclosed categories of Personal Information to service providers and contractors for business purposes. Those disclosures are described in Section 11.1. For each category, Section 11.1 also identifies what we collected, the sources it came from, and why we collected and disclosed it. It identifies the service providers or contractors who received it, whether it was sold or shared, and the applicable retention period or retention criteria.

We do not use or disclose Sensitive Personal Information for purposes other than those permitted by the CCPA and its regulations.

10.1.1 What is considered personal information and sensitive personal information under the CCPA?

Under California law, personal information is information that identifies, relates to, or can reasonably be linked to you or your household. This can include things like your name, email address, purchase records, internet activity, location data, and inferences about your preferences.

Sensitive personal information is a narrower category that includes highly private data such as government identifiers, financial account credentials, precise geolocation, message contents, biometric or genetic data, and information about health, sexual orientation, race, religion, or union membership. California consumers have the right to limit how businesses use and disclose sensitive personal information.

Publicly available information is not considered personal information under the CCPA.

10.1.2 How to exercise your rights as a California consumer

California consumers may exercise their privacy rights by emailing support@trackmyvisa.com. Where available, consumers may also submit requests through in-service account tools or any online privacy request form or portal we make available through the Services.

To protect your Personal Information and prevent fraud, we may verify requests to know, delete, and correct. We do this by asking for information such as your name, email address, account details, or information related to recent account activity. What we ask for depends on the nature of the request, how sensitive the information at issue is, and the risk of harm from an unauthorized disclosure, deletion, or correction.

Do Not Sell or Share My Personal Information. The advertising control in the app’s settings is our “Do Not Sell or Share My Personal Information” mechanism: turning advertising off withdraws your consent and stops the sharing described in Section 4.6. You may also make this request by emailing support@trackmyvisa.com. We do not require identity verification for an opt-out of sharing, though we may take reasonable steps to confirm the request relates to your account. Offering this combined control is not an admission that we sell Personal Information. Opting out ends the free, ad-supported version of Insights; it does not affect your account, case tracking, notifications, or any subscription price.

An authorized agent may submit a request on behalf of a California consumer by contacting us at support@trackmyvisa.com. The agent must provide proof of authorization to act on the consumer’s behalf, such as written permission signed by the consumer, unless another form of authority is permitted by applicable law. We may also ask the consumer to verify their own identity directly with us, or to confirm that they authorized the agent to act on their behalf.

10.1.3 California Notice at Collection

California consumers are entitled to notice, at or before the point of collection, of what we collect and why. That notice covers the categories of Personal Information and Sensitive Personal Information we collect, the purposes for which we collect or use that information, whether we sell or share it, and the retention period or retention criteria for each category. The information required for that notice is provided in Section 11.1 of this Privacy Policy, together with the plain-language summary in Section 1 and any supplemental notice presented at or before collection.

10.1.4 Notice of financial incentive

The free, ad-supported version of Insights is a financial incentive program under the CCPA: you receive Insights at no charge in exchange for consenting to the advertising sharing described in Section 4.6. The material terms of the program — what is shared, with whom, and for what purposes — are in Section 4.6. You opt in through the in-app advertising consent prompt, and you can withdraw at any time as described there.

We estimate, in good faith, that the value of a participating user’s shared information is approximately US$4.80 per year for a daily active user. That estimate is based on roughly two ad impressions per active day at a blended average rate of about US$6.58 per thousand impressions, and we review it against actual results. Actual ad frequency and revenue vary, and this estimate does not limit either.

That value is reasonably related to the value of what you receive: the advertising revenue is what pays for offering Insights without charge. Declining or withdrawing consent does not change any price we charge. It means only that the free, ad-supported version of Insights is unavailable; you can subscribe instead or not use Insights, and your account, case tracking, and notifications are unaffected.

10.2 EEA / UK / Switzerland

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process Personal Information in accordance with applicable data protection laws. You may have rights to:

• access your Personal Information
• correct inaccurate or incomplete Personal Information
• request deletion of your Personal Information
• restrict certain processing
• object to certain processing
• receive a portable copy of certain Personal Information
• withdraw consent at any time, where processing is based on consent
• lodge a complaint with your local supervisory authority or, in the United Kingdom, the Information Commissioner’s Office

Providing certain Personal Information, such as your email address and Receipt Numbers, is necessary for us to create your account and provide the requested Services. If you do not provide this information, we may be unable to provide some or all of the Services.

Legal Bases for Processing

If you are located in the EEA, United Kingdom, or Switzerland, we process Personal Information under one or more of the following legal bases, depending on the context:

Performance of a contract: to create and maintain your account, provide case tracking and notifications, process subscriptions, respond to your requests, and otherwise provide the Services you request.

Legitimate interests: to secure and administer the Services, prevent fraud and abuse, maintain system integrity, troubleshoot issues, improve performance and usability, develop and test features, maintain internal records, generate aggregated analytics and reports, and send marketing communications to existing users subject to your right to opt out, provided that our interests are not overridden by your rights and freedoms.

Legal obligation: to comply with applicable laws, regulations, lawful requests, tax and accounting obligations, dispute-resolution obligations, and enforcement obligations.

Consent: where required by law, such as for certain cookies or similar technologies, or where we otherwise specifically request your consent.

International Transfers

Personal Information may be processed in the United States and other countries where we or our service providers operate. Where required by applicable law, we rely on appropriate safeguards for international transfers, such as adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum, or other lawful transfer mechanisms. You may contact us for more information about these safeguards.

Personal Data Obtained from Other Sources

In some cases, we may process Personal Information that we do not collect directly from the individual concerned. For example, this may include Case Data returned by USCIS systems in response to a query you direct us to make, case-related information you submit that relates to another person, or basic profile information from a third-party sign-in provider, such as Google, when you use it to access your account.

In those cases, the categories of Personal Information may include Receipt Numbers, Case Data, case-related labels or metadata, and related account or support information. The sources of that information may include you, USCIS systems, third-party sign-in providers, and our service providers acting on our behalf.

We use that information to provide the Services, maintain account functionality, protect the Services, respond to support requests, comply with law, and otherwise as described in this Privacy Policy.

Automated Decision-Making

Track My Visa does not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on you. Our estimates, analytics, graphs, and reports are informational tools and are not used to make legal, immigration, employment, credit, housing, insurance, or similarly significant decisions about you.

10.2.1 How to exercise your rights as an EEA / UK / Switzerland consumer

EEA / UK / Switzerland consumers may exercise their privacy rights by emailing support@trackmyvisa.com.

Once we respond to a request, we may ask for information we consider necessary to verify your identity and prevent fraud. This may include your name, contact information, and information related to your account. The specific information requested may vary depending on the nature of your request and is used only for verification and security purposes.

11. Supplemental Explanations and Cross-References

The primary categories of Personal Information we collect are described in Section 1. Additional category-specific explanations appear in Section 3 (Receipt Numbers), Section 4.6 (advertising and Insights), Section 5 (Pseudonymized Analytics Data), Section 6.6 (Reviews and testimonials), Section 8 (deletion-related records and limited retained records for compliance, fraud prevention, and abuse prevention), and Section 10.2 (Personal Data Obtained from Other Sources).

Section 11.1 provides the category-level California disclosures for the preceding 12 months. For each category, it lists the information collected, the sources, the purposes, the recipients, whether information was sold or shared, and the retention period or retention criteria.

11.1 California category disclosures (preceding 12 months)

The section below covers the preceding 12 months. For each category of Personal Information and Sensitive Personal Information we have collected, it describes:

• what we collected;
• the categories of sources it came from;
• the business or commercial purposes for which we collected and disclosed it;
• the categories of service providers or contractors to whom it was disclosed for a business purpose;
• whether it was sold or shared; and
• our retention period or retention criteria.

12. Change of Ownership or End of Business

If Track My Visa undergoes a merger, acquisition, reorganization, bankruptcy, sale of assets, or other change of ownership or control, your Personal Information may be transferred only to a successor that agrees to be bound by privacy and security protections at least as protective as those described in this Privacy Policy. We will not transfer your Personal Information to a successor that will not accept those protections.

Before any such transfer becomes effective, we will notify affected users by email and through an in-product notice, provide a plain-language summary of the change, and give users a reasonable opportunity to close their account and request permanent deletion of their Personal Information, except to the extent we must retain certain information by law.

A change of ownership does not by itself authorize any new use of your information. If a successor wants to use or disclose your information in a way this Privacy Policy does not permit, it must obtain your active consent first, in the manner described in Section 4.4. The rule in Section 4.4 applies to a successor in the same way it applies to us.

If Track My Visa ceases operations and no successor will continue the Services, we will securely delete or de-identify Personal Information in accordance with this Privacy Policy and applicable law.

13. Policy Changes and Active Consent

We may update this Privacy Policy from time to time. When we do, we will maintain a record of prior versions and provide a summary of material changes in plain language.

If we make any changes to this Privacy Policy, we will request your active consent of the updated Privacy Policy through a clear in-product prompt. Until you accept the updated Privacy Policy, your access to certain features may be limited or suspended.

Accepting an updated Privacy Policy is consent to that Policy. It is not consent to a particular Independent Third-Party Use of your information. Where we need your active consent for such a use, we will ask you for it separately, at or before the time of that use, and we will tell you which third party is involved and what it will do. See Section 4.4.

If you do not agree to the updated Privacy Policy, you must stop using the Services. You may request deletion of your account and data in accordance with this Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at support@trackmyvisa.com.