Privacy Policy

One Big Media Company LLC ("we", "us", or "our"), the operator of FormVeritas, is committed to protecting personal information handled by FormVeritas, including information used by the USCIS Case Tracker and FOIA Request Tool.

This Privacy Policy explains what we collect, how we use it, when we share it, how long we keep it, and how you can request permanent deletion. This policy is incorporated by reference into our Terms of Service.

1. Information We Collect

We collect the information needed to provide, secure, bill, and support the Services.

• Account and profile information: name, email address, phone number, account role, authentication identifiers, team or agency membership, avatar, agency name and logo (for White Label Reports), and account settings.
• Billing information: plan and Audit Pack purchases, White Label Reports subscription status, billing status, Stripe customer, subscription, and transaction identifiers, invoices, refund and dispute records, and payment processor metadata. Full card numbers are handled by Stripe, not by FormVeritas.
• USCIS form audit information: the form data you enter in the Form Workspace and submit for a report, generated audit reports, client records, and audit usage history.
• Support and notification information: support ticket content, replies, notification preferences, delivery metadata, and operational alert records.
• Device, security, and operations data: IP address, browser and device characteristics, session state, referring URLs, usage events, diagnostics, error traces, abuse-prevention signals, and security logs.
• Optional analytics and advertising data: only if you choose Accept on our cookie banner, Google Analytics and Google Ads cookie identifiers, page views, and signup conversion events, as described in section 14 and our Cookie Policy.
• Website form information: the name, email address, phone number, and message you enter in forms on formveritas.com.

2. USCIS Case Tracker and FOIA Request Tool Data

The USCIS Case Tracker and FOIA Request Tool collect and process additional immigration-related information because those features communicate with USCIS systems.

• Case tracker data: USCIS receipt numbers, linked client names and contact details, current case status, status descriptions, status history, timestamps, and raw USCIS API response payloads.
• FOIA request data: subject-of-record name, date of birth, birth country, mailing address, email address, phone numbers, A-number, receipt numbers, family-member names, requester information, representative relationship, records requested, delivery preference, consent method, request numbers, case control numbers, queue/status data, and raw USCIS API response payloads.
• FOIA files: uploaded consent, attestation, identity, death, guardianship, family-history, or other supporting documents that you choose to send to USCIS.
• Related-person data: some FOIA requests may include family history, parent/guardian information, minor-dependent information, or information about people other than the account holder. You are responsible for having the legal authority and consent needed to submit that information.

3. How We Use Information

We use personal information only for the purposes described in this policy.

• To create accounts, authenticate users, manage sessions, and enforce account permissions.
• To run document audits, generate reports, preserve user workspaces, and maintain audit balances.
• To submit FOIA requests to USCIS, pull USCIS FOIA status updates, and track USCIS case status changes when you use those features.
• To send account, billing, security, support, case status, and FOIA notifications according to your settings and applicable operational requirements.
• To process one-time payments, the monthly White Label Reports subscription, invoices, taxes, refunds, chargebacks, and anti-fraud checks.
• Only if you accept optional cookies, to measure how our sites are used and whether our ads lead to signups.
• To secure the platform, troubleshoot errors, prevent abuse, meet legal obligations, and protect users.

4. Form Data Processing and Retention

No model training: We do not use your personal information, client data, uploaded immigration documents, USCIS case status data, or FOIA request data to train, improve, or fine-tune machine-learning models or to build profiles about you.

No outside extraction services: Audit form data is processed by our own audit servers. We do not send audit form data or uploaded documents to outside machine-learning or text-extraction services.

5. Data Controller and Processor Roles

If you use FormVeritas for your own account, we act as an independent business or controller for account, billing, support, and platform operations. If you use FormVeritas on behalf of clients, you are responsible for providing required notices, obtaining required consents, and confirming that you have authority to submit your clients' information.

For agency, law-firm, or representative accounts, FormVeritas generally acts as a processor or service provider for client workspace data, subject to the instructions needed to provide the Services. Enterprise and agency users may request a data processing agreement where required by applicable law.

6. Age Restrictions and Minor Data

The Services are restricted to users who are 18 years of age or older. We do not knowingly collect personal information online directly from children under 13. If we learn that a minor created an account or submitted their own information directly to us, we will delete that account or information.

Adult users and Agency Users may submit immigration records that include minor children or dependents. By doing so, you represent that you are the parent, legal guardian, authorized representative, or other person with lawful authority to provide that data.

7. Information Sharing and Service Providers

We share information only as needed to provide the Services, comply with law, protect users, or follow your instructions. These are the service providers and systems we use today:

• USCIS and DHS systems: When you use the USCIS Case Tracker or FOIA Request Tool, we send the receipt numbers, FOIA request details, supporting files, and related request data through the USCIS Case Status API and the USCIS FOIA API so that USCIS can process the request or return its status.
• Supabase: sign-in, database, file storage, and server functions for the FormVeritas app, hosted in the United States.
• Google Firebase and Google Cloud: we are moving the app's hosting, sign-in, database, file storage, and server functions to Google Firebase and Google Cloud in a United States region. As parts of the app move, Google processes that data for us.
• Audit processing servers: cloud servers in the United States that run our own form audit and PDF-filling software.
• Cloudflare: domain name service, network security, and content delivery for formveritas.com and app.formveritas.com. Traffic to our sites passes through Cloudflare.
• Stripe: checkout, the White Label Reports subscription, the billing portal, invoices, taxes, refunds, and disputes. Some earlier purchases were processed by Paddle, and we keep those billing records.
• Postmark: delivery of the emails we send you, such as account, sign-in, security, billing, and support emails, and case status or FOIA updates where you have turned them on.
• Google Workspace: our business email inboxes, including the addresses listed in section 17, so the messages you send us are stored there.
• GoHighLevel: hosts our marketing website, formveritas.com, and its contact and other forms, and serves some images used in the app. Information you enter in those forms is stored in GoHighLevel.
• Google Analytics and Google Ads: only if you choose Accept on our cookie banner. See section 14.
• Google Fonts: our legal pages and the report print view load the Inter font from Google Fonts, so Google receives your IP address and browser details when those pages load. The main app uses its own copy of the font.
• Pushbullet: internal alerts to our staff about billing events, audit activity, and support tickets. An alert contains short text such as the event type, a notification or ticket summary, and a link, and may include an account or client name. It does not include uploaded documents or form contents.
• Legal and safety disclosures: We may disclose information to courts, regulators, law enforcement, or governmental authorities if required by law, subpoena, court order, or to protect users or the platform.

Our service providers are limited to using information for the services they provide to us. They may not sell, reuse, disclose, or combine user information for their own purposes, including de-identified, anonymized, or pseudonymized data, unless you give active consent or law requires it. Google's own use of data from Google Analytics and Google Ads, when you accept those tags, is also covered by Google's terms and privacy policy.

8. No Sale, Data Sharing Choices, and Data Sharing Impact

We do not sell personal information, client data, uploaded documents, USCIS case data, FOIA data, mobile opt-in data, or support data for money or other monetary consideration.

Only if you choose Accept on our cookie banner, the signup page of the app loads the Google Ads tag, and our sites load Google Analytics. Under some state laws, such as California's, this may count as "sharing" personal information for cross-context behavioral advertising. These tags stay off until you accept, and you can refuse them by choosing Reject. Uploaded documents, form contents, USCIS case data, and FOIA data are never sent to these tags.

You control whether to use features that send information to USCIS or DHS. If you do not want FormVeritas to send FOIA data or case tracker data to USCIS systems, do not create those requests or trackers. You may also archive trackers, change notification settings, close your account, or request permanent deletion.

Sharing FOIA data can affect other people when a request includes family history, parentage, guardianship, deceased-subject proof, minor-dependent records, or records about relatives. USCIS may redact family-member information unless the required consent and verification are included. You are responsible for telling affected people, getting required consent, and understanding that submitting data to USCIS may make it part of a government record.

9. California Privacy Rights

California residents may have rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know, access, correct, delete, limit certain sensitive-information uses, opt out of sale or sharing, and avoid discrimination for exercising privacy rights. We do not sell personal information. To opt out of the "sharing" described in section 8, choose Reject on our cookie banner, or email us.

To exercise California or similar privacy rights, email [email protected]. We may need to verify your identity and authority before completing a request.

10. Retention, Permanent Deletion, and Dormant Accounts

We keep information only as long as needed for the Service, legal compliance, security, billing, tax, dispute, anti-fraud, or operational purposes.

• Audit submissions and reports: kept in your account until you delete the audit or the account, as described in section 4. Saved drafts are files on your device, not records in your account. Documents uploaded for audits in earlier versions of FormVeritas have been permanently deleted.
• USCIS case tracker and FOIA records: retained while your account or agency workspace remains active, unless you close the account or ask us to delete the data sooner where legally permitted. Archiving a tracker hides it but does not delete it.
• Account, profile, client, support, and generated workspace records: retained while the account is active and then deleted or redacted during account hard deletion, except for limited legal or operational records described below.
• Billing, tax, anti-fraud, security, and dispute records: retained only as long as reasonably necessary for legal, tax, chargeback, fraud-prevention, security, or dispute obligations, usually no longer than seven years unless law requires longer.
• Dormant accounts: if an account has no login or paid activity for 24 months, we may treat it as dormant, notify the account email when practical, and begin deletion, deactivation, or archival unless retention is legally required.

Deleting your account: where the permanent-delete control is available in account settings, you can delete your own account. Deleting an individual or agency account permanently deletes the login, profile, workspace and client data, uploaded files, generated reports, support records, and related data, including files in storage, and immediately cancels any active White Label Reports subscription. When a team member deletes their own login, shared agency workspace data stays with the agency. Deletion cannot be undone.

You can also request permanent deletion by emailing [email protected]. We aim to complete user-requested deletion within 30 days after verifying the request. Backup, log, billing, tax, anti-fraud, security, or legal-retention copies may take up to 90 days to age out or may be retained in redacted form when required by law or legitimate security, tax, billing, dispute, or anti-fraud obligations.

11. Security and Breach Notice

We use commercially reasonable technical and organizational safeguards designed to protect personal information. No internet or storage system is perfectly secure, so you are responsible for using strong passwords, protecting devices, and reporting suspected account compromise.

If we determine that a data breach affects your personal information, we will notify you without unreasonable delay and in accordance with applicable law. The notice will describe what happened, what information was involved when known, steps we are taking, and any actions you can take to protect yourself.

If you suspect unauthorized access to your account, email [email protected].

12. International Data Transfers

FormVeritas servers, systems, and primary service providers store data in the United States. Cloudflare's network may carry traffic through locations outside the United States. By using the Services from outside the United States, or by uploading data about foreign nationals, you consent to processing and storage in the United States.

People in the EEA, UK, and similar jurisdictions may request access, correction, deletion, restriction of processing, portability, or objection where applicable by emailing [email protected].

13. SMS and Mobile Data Privacy

The FormVeritas app does not currently send text messages. If we send you text messages in the future, or if you agree to receive texts through a form on formveritas.com, we will do so only after you opt in, and we will use your phone number only for account, audit, case status, FOIA, billing, support, or security communications, or for the purpose you agreed to. You can opt out of text messages at any time by replying STOP. Message and data rates may apply.

14. Cookies, Analytics, and Advertising Tags

We use essential cookies and browser storage to keep you signed in, keep accounts secure, and remember your cookie choice. Optional tags stay off until you choose Accept on our cookie banner:

• Google Analytics: in the app and on formveritas.com, to count page views and understand how our sites are used. Google signals and ad personalization are turned off, and page addresses are cleaned of form, client, record, and email values before they are sent.
• Google Ads: on the app's signup page only, to measure whether our ads lead to signups.

If you choose Reject, or close the banner without choosing, these tags do not load. See our Cookie Policy for the full list and how to change your choice.

15. Ownership Transfer or Business Closure

If FormVeritas or One Big Media Company LLC is involved in a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transfer, we will notify users of the change when practical. Any successor must either honor privacy protections that are materially consistent with this policy or give users a reasonable option, where technically feasible, to securely delete, export, download, transmit, or dispose of their information before the materially different policy applies.

If we end the Service, we will provide reasonable notice when practical and give users instructions for deleting or exporting available account data before shutdown, subject to security, legal, billing, tax, and anti-fraud obligations.

16. Policy Updates and Active Consent

When we make material changes to this Privacy Policy or our Terms of Service, we will provide a plain-language summary of the changes and require active consent before you continue using affected authenticated features. Active consent may be collected through an in-app checkbox, account modal, electronic signature, or another clear affirmative action. Prior acceptance of an older version is not treated as consent to a materially updated version.

17. Contact Us

If you have questions, comments, or data subject requests regarding this notice, you may email us or contact us by post at: