Privacy Policy

One Big Media Company LLC ("we", "us", or "our"), the operator of FormVeritas, is committed to protecting personal information handled by FormVeritas, including information used by the USCIS Case Tracker and FOIA Request Tool.

This Privacy Policy explains what we collect, how we use it, when we share it, how long we keep it, and how you can request permanent deletion. This policy is incorporated by reference into our Terms of Service.

1. Information We Collect

We collect the information needed to provide, secure, bill, and support the Services.

• Account and profile information: name, email address, phone number, account role, authentication identifiers, team or agency membership, avatar, and account settings.
• Billing information: plan selections, billing status, Stripe customer and transaction identifiers, invoices, refund records, and payment processor metadata. Full card numbers are handled by our payment processors, not by FormVeritas.
• USCIS form audit information: uploaded source documents, extracted form fields, generated audit reports, client records, form workspace data, and audit usage history.
• Support and notification information: support ticket content, replies, notification preferences, delivery metadata, and operational alert records.
• Device, security, and operations data: IP address, browser and device characteristics, session state, referring URLs, usage events, diagnostics, error traces, abuse-prevention signals, and security logs.

2. USCIS Case Tracker and FOIA Request Tool Data

The USCIS Case Tracker and FOIA Request Tool collect and process additional immigration-related information because those features communicate with USCIS systems.

• Case tracker data: USCIS receipt numbers, linked client names and contact details, current case status, status descriptions, status history, timestamps, and raw USCIS API response payloads.
• FOIA request data: subject-of-record name, date of birth, birth country, mailing address, email address, phone numbers, A-number, receipt numbers, family-member names, requester information, representative relationship, records requested, delivery preference, consent method, request numbers, case control numbers, queue/status data, and raw USCIS API response payloads.
• FOIA files: uploaded consent, attestation, identity, death, guardianship, family-history, or other supporting documents that you choose to send to USCIS.
• Related-person data: some FOIA requests may include family history, parent/guardian information, minor-dependent information, or information about people other than the account holder. You are responsible for having the legal authority and consent needed to submit that information.

3. How We Use Information

We use personal information only for the purposes described in this policy.

• To create accounts, authenticate users, manage sessions, and enforce account permissions.
• To run document audits, generate reports, preserve user workspaces, and maintain audit balances.
• To submit FOIA requests to USCIS, pull USCIS FOIA status updates, and track USCIS case status changes when you use those features.
• To send account, billing, security, support, case status, and FOIA notifications according to your settings and applicable operational requirements.
• To process one-time payments, invoices, taxes, chargebacks, and anti-fraud checks.
• To secure the platform, troubleshoot errors, prevent abuse, meet legal obligations, and protect users.

4. Local Processing and Zero-Retention Document Security

Data isolation: We do not use your personal information, client data, uploaded immigration documents, USCIS case status data, or FOIA request data to train, improve, or fine-tune machine-learning models or to build alternative profiles.

No external extraction model disclosure: We do not transmit sensitive uploaded immigration documents to external third-party cloud extraction models such as OpenAI, Anthropic, or similar services for processing.

5. Data Controller and Processor Roles

If you use FormVeritas for your own account, we act as an independent business or controller for account, billing, support, and platform operations. If you use FormVeritas on behalf of clients, you are responsible for providing required notices, obtaining required consents, and confirming that you have authority to submit your clients' information.

For agency, law-firm, or representative accounts, FormVeritas generally acts as a processor or service provider for client workspace data, subject to the instructions needed to provide the Services. Enterprise and agency users may request a data processing agreement where required by applicable law.

6. Age Restrictions and Minor Data

The Services are restricted to users who are 18 years of age or older. We do not knowingly collect personal information online directly from children under 13. If we learn that a minor created an account or submitted their own information directly to us, we will delete that account or information.

Adult users and Agency Users may submit immigration records that include minor children or dependents. By doing so, you represent that you are the parent, legal guardian, authorized representative, or other person with lawful authority to provide that data.

7. Information Sharing and Disclosure

We share information only as needed to provide the Services, comply with law, protect users, or honor your instructions.

• USCIS and DHS systems: When you use the USCIS Case Tracker or FOIA Request Tool, we send the receipt numbers, FOIA payloads, supporting files, and related request data needed for USCIS to process or return status for that request.
• Supabase: We use Supabase for authentication, database, storage, and edge-function infrastructure.
• Stripe billing flows: We use Stripe to manage checkout, invoices, taxes, chargebacks, and billing records.
• Pushbullet: If enabled, we use Pushbullet for internal operational alerts. Support-ticket alerts are limited to brief ticket summaries and links for staff triage.
• Email, SMS, and notification providers: We may use delivery providers for account, security, support, billing, FOIA, and case-status notifications.
• Legal and safety disclosures: We may disclose information to courts, regulators, law enforcement, or governmental authorities if required by law, subpoena, court order, or to protect users or the platform.

Our subprocessors and service providers are contractually limited to using information for the services they provide to us. They may not sell, reuse, disclose, or combine user information for their own purposes, including de-identified, anonymized, or pseudonymized data, unless you give active consent or law requires it.

8. No Sale, Data Sharing Choices, and Data Sharing Impact

We do not sell personal information, client data, uploaded documents, USCIS case data, FOIA data, mobile opt-in data, or support data for profit or other monetary consideration. We do not share personal information for cross-context behavioral advertising.

You control whether to use features that send information to USCIS or DHS. If you do not want FormVeritas to send FOIA data or case tracker data to USCIS systems, do not create those requests or trackers. You may also archive trackers, change notification settings, close your account, or request permanent deletion.

Sharing FOIA data can affect other people when a request includes family history, parentage, guardianship, deceased-subject proof, minor-dependent records, or records about relatives. USCIS may redact family-member information unless the required consent and verification are included. You are responsible for telling affected people, getting required consent, and understanding that submitting data to USCIS may make it part of a government record.

9. California Privacy Rights

California residents may have rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know, access, correct, delete, limit certain sensitive-information uses, opt out of sale or sharing, and avoid discrimination for exercising privacy rights. We do not sell or share personal information as those terms are commonly used for advertising sale/share opt-outs.

To exercise California or similar privacy rights, email [email protected]. We may need to verify your identity and authority before completing a request.

10. Retention, Permanent Deletion, and Dormant Accounts

We keep information only as long as needed for the Service, legal compliance, security, billing, tax, dispute, anti-fraud, or operational purposes.

• Audit source documents: deleted automatically after audit processing completes, except for brief transient technical artifacts needed for security or troubleshooting.
• USCIS case tracker and FOIA records: retained while your account or agency workspace remains active, unless you delete the tracker/request, close the account, or ask us to delete the data sooner where legally permitted.
• Account, profile, client, support, and generated workspace records: retained while the account is active and then deleted or redacted during account hard deletion, except for limited legal or operational records described below.
• Billing, tax, anti-fraud, security, and dispute records: retained only as long as reasonably necessary for legal, tax, chargeback, fraud-prevention, security, or dispute obligations, usually no longer than seven years unless law requires longer.
• Dormant accounts: if an account has no login or paid activity for 24 months, we may treat it as dormant, notify the account email when practical, and begin deletion, deactivation, or archival unless retention is legally required.

You can request permanent deletion by using the permanent-delete control in account settings where enabled or by emailing [email protected]. We aim to complete user-requested deletion within 30 days after verifying the request. Backup, log, billing, tax, anti-fraud, security, or legal-retention copies may take up to 90 days to age out or may be retained in redacted form when required by law or legitimate security, tax, billing, dispute, or anti-fraud obligations.

11. Security and Breach Notice

We use commercially reasonable technical and organizational safeguards designed to protect personal information. No internet or storage system is perfectly secure, so you are responsible for using strong passwords, protecting devices, and reporting suspected account compromise.

If we determine that a data breach affects your personal information, we will notify you without unreasonable delay and in accordance with applicable law. The notice will describe what happened, what information was involved when known, steps we are taking, and any actions you can take to protect yourself.

If you suspect unauthorized access to your account, email [email protected].

12. International Data Transfers

FormVeritas servers, systems, and primary subprocessors are located in or serve data from the United States. By using the Services from outside the United States, or by uploading data about foreign nationals, you consent to processing and storage in the United States.

People in the EEA, UK, and similar jurisdictions may request access, correction, deletion, restriction of processing, portability, or objection where applicable by emailing [email protected].

13. SMS and Mobile Data Privacy

If you opt in to SMS notifications, we use your phone number only for account, audit, case status, FOIA, billing, support, or security communications. You can opt out of SMS messages at any time by replying STOP.

14. Affiliate Tracking and Cookies

We use affiliate tracking to attribute referrals and commissions. Affiliate tracking does not give affiliates access to your account, uploaded documents, USCIS case data, FOIA data, or audit results. See our Cookie Policy for more information.

15. Ownership Transfer or Business Closure

If FormVeritas or One Big Media Company LLC is involved in a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transfer, we will notify users of the change when practical. Any successor must either honor privacy protections that are materially consistent with this policy or give users a reasonable option, where technically feasible, to securely delete, export, download, transmit, or dispose of their information before the materially different policy applies.

If we end the Service, we will provide reasonable notice when practical and give users instructions for deleting or exporting available account data before shutdown, subject to security, legal, billing, tax, and anti-fraud obligations.

16. Policy Updates and Active Consent

When we make material changes to this Privacy Policy or our Terms of Service, we will provide a plain-language summary of the changes and require active consent before you continue using affected authenticated features. Active consent may be collected through an in-app checkbox, account modal, electronic signature, or another clear affirmative action. Prior acceptance of an older version is not treated as consent to a materially updated version.

17. Contact Us

If you have questions, comments, or data subject requests regarding this notice, you may email us or contact us by post at: