ALVVA

1. PERSONAL INFORMATION WE COLLECT

1.1 How We Obtain Your Personal Information

We collect personal information about you in a variety of ways, including information you provide to us directly, information we collect about your use of our website and services, and information we obtain from third parties.

Source	Type of Information Collected
Directly from you	This includes financial information, medical information, as well as basic identifying information related to your USCIS application(s). This includes Personally Identifiable Information (PII) in the form of receipt numbers. We also collect information you voluntarily provide such as name, email address, phone number, mailing address, and account information.
From your browser or device	We automatically collect certain information about your visits to our website and use of our services, including IP address, browser type and version, operating system, referring URLs, pages you view, and the date and time of your activities.
From third parties	We may obtain information about you from third-party service providers, data brokers, and public records to verify information you provide and to enhance our understanding of our users.
From cookies and tracking technologies	We use cookies, web beacons, and other tracking technologies to collect information about your browsing behavior and interaction with our website and services.

1.2 How We Use Your Personal Information

We use your personal information for the following purposes:

1.3 Who We Share Your Personal Information With

We may share your personal information with third parties in the following circumstances:

1.4 Categories of Personal Information We Collect

We collect the following categories of personal information:

Category	Description	Examples
Identifiers	Information that can be used to identify an individual	Name, email address, phone number, mailing address, social security number, passport number, driver's license number, USCIS receipt numbers
Financial Information	Information related to your financial status and transactions	Bank account information, credit card information, income information, tax returns, financial account numbers
Health and Medical Information	Information related to your health status and medical history	Medical history, health conditions, prescriptions, medical appointments, vaccination records, health insurance information
Immigration-Related Information	Information related to your immigration status and applications	Visa status, green card information, work authorization, USCIS receipt numbers, case status, immigration history
Internet or Network Activity	Information about your interaction with our services	Browsing history, IP address, browser type, pages visited, links clicked, time spent on pages, referral sources
Telecommunications Data	Information related to your communication with us	Phone call records, email messages, SMS messages, chat communications, support tickets

1.5 Sale of Personal Information

We do not sell your personal information. We do not sell, rent, lease, or otherwise disclose your personal information to third parties for monetary or other valuable consideration. Under the California Consumer Privacy Act (CCPA) and similar privacy laws, you have the right to know whether we sell your personal information, and you have the right to opt out of any sale. Since we do not sell your personal information, this right does not apply to Alvva. However, if we ever decide to sell personal information in the future, we will provide you with notice and an opportunity to opt out as required by law.

1.6 SMS Messaging Data Collection and Use

If you opt in to receive SMS (Short Message Service) text messages from us, we will collect and use your mobile phone number for the purpose of sending you text messages related to your account, services, and updates. Your phone number will be stored securely in our system.

Your consent to receive SMS messages is voluntary. You can opt out of SMS communications at any time by:

• Replying "STOP" to any SMS message we send you
• Contacting us at the phone number or email address provided in Section 8

We will not charge you for SMS messages you receive from us, but standard message and data rates may apply depending on your mobile service provider. Message frequency may vary. We do not sell or share your phone number for marketing purposes beyond sending service-related messages from Alvva.

2. YOUR RIGHTS UNDER THE CALIFORNIA CONSUMER PRIVACY ACT OF 2018 (CCPA)

2.1 Right to Know

You have the right to know what personal information we collect, use, and disclose about you. You can submit a request to know by contacting us using the information in Section 8. We will verify your identity before responding to your request and will provide you with the specific pieces of personal information we have collected about you in the past 12 months, the sources of that information, the purposes for using it, and the categories of third parties with whom we share it.

2.2 Right to Delete

You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions. To request deletion, please contact us using the information in Section 8. We will verify your identity before processing your deletion request. We may deny your deletion request if we need to retain your information to complete the transaction for which we collected it, to comply with legal obligations, or for other lawful purposes described in the CCPA.

2.3 Right to Opt-Out of the Sale of Personal Information

As mentioned in Section 1.5, we do not sell your personal information. However, you have the right to opt out of any future sale of your personal information. If we ever engage in the sale of personal information, we will provide you with a prominent link allowing you to opt out of such sales.

2.4 Right to Opt-Out of Sharing for Cross-Context Behavioral Advertising

If we share your personal information for cross-context behavioral advertising purposes, you have the right to opt out of this activity. To exercise this right, please contact us using the information in Section 8.

2.5 Right to Correction

You have the right to request that we correct inaccurate personal information we have collected about you. To request a correction, please contact us using the information in Section 8. We will verify your identity and the inaccuracy of the information before making corrections.

2.6 Right to Limit Use and Disclosure

You have the right to limit our use and disclosure of sensitive personal information (such as social security numbers, financial account information, and health information) to what is necessary to provide the services or goods you requested. To limit use and disclosure, please contact us using the information in Section 8.

2.7 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide you with a different quality of service based on your exercise of your privacy rights under the CCPA. However, we may offer financial incentives that are reasonably related to the value of your personal information to encourage you to allow us to collect and use your personal information.

2.8 Right to Authorized Agent

You may authorize an agent to make requests on your behalf. To authorize an agent, you must provide written authorization signed by you. Your authorized agent must contact us with your authorization, and we may verify the agent's authority and your identity before processing the request.

2A. USCIS CASE STATUS API AND RECEIPT NUMBER USAGE

Overview

Alvva collects and uses USCIS receipt numbers as an essential part of providing immigration case status tracking services. This section explains how we collect, store, use, and protect receipt numbers and the data obtained through the USCIS Case Status API.

Receipt Number Collection

Receipt numbers are classified as Personally Identifiable Information (PII) under this Privacy Policy and are treated with the highest level of protection. You voluntarily provide receipt numbers to Alvva to enable our services. Providing receipt numbers is entirely voluntary—you are not required to do so to use other features of our platform, but it is necessary if you wish to receive USCIS case status updates through our service.

Purpose of Receipt Number Usage

Receipt numbers are used SOLELY to query the USCIS Case Status API to retrieve and display immigration case status updates directly to you. The receipt number enables us to:

• Retrieve your current USCIS case status from official USCIS records
• Display status information in an easy-to-read format within your Alvva account
• Provide you with timely notifications when your case status changes
• Help you track multiple applications simultaneously if you have multiple receipt numbers

Security and Encryption

Receipt numbers are treated as sensitive PII and are protected through multiple security measures:

• Encryption at Rest: All receipt numbers are encrypted using industry-standard encryption protocols when stored in our database
• Encryption in Transit: Receipt numbers are encrypted when transmitted between your device and our servers using secure HTTPS/TLS protocols
• Access Controls: Only authorized Alvva personnel and systems have access to decrypt and view receipt numbers
• Secure Infrastructure: Receipt numbers are stored on secure servers with physical and digital security measures

Third-Party Sharing

We do not share receipt numbers with third parties except as strictly necessary to query the USCIS Case Status API. Receipt numbers are transmitted only to USCIS through official API channels to retrieve your case status. We do not sell, share, or disclose receipt numbers to any other third parties for any purpose.

Data Retention

Receipt numbers are retained in our system for as long as your account is active and you continue to use our case status tracking services. Once you request deletion of a receipt number, or if your account is terminated, we will delete the receipt number from our active systems within 30 days, except where we are required to retain it for legal compliance or other lawful purposes.

Your Control Over Receipt Numbers

You have complete control over your receipt numbers:

• View: You can view any receipt numbers associated with your account at any time
• Add: You can add new receipt numbers to track additional cases
• Delete: You can request deletion of any receipt number from our system at any time by contacting us
• Update: You can update or correct receipt numbers if you entered them incorrectly

To request deletion of a receipt number or for questions about how your receipt numbers are used, please contact us using the information in Section 8.

GDPR Compliance (for Users in the European Union)

If you are located in the European Union, the United Kingdom, or other jurisdictions with equivalent privacy laws, we process receipt numbers as personal data under the General Data Protection Regulation (GDPR). Your receipt number is processed with your explicit consent, and you have the right to access, correct, delete, or port your personal data. For more information about your rights, please see Section 6A regarding international data transfers.

2B. ARTIFICIAL INTELLIGENCE AND MACHINE LEARNING

Overview

Alvva may use artificial intelligence (AI) and machine learning (ML) technologies to improve our services, enhance user experience, and provide more accurate and helpful features. This section explains how we use AI/ML and what protections are in place to protect your privacy.

AI/ML Applications

We may use AI and machine learning for the following purposes:

• Document Processing: Automatic analysis and processing of documents you upload, including immigration forms, support documents, and communications
• Automated Assistance: Providing intelligent recommendations, automated responses to common questions, and guided assistance with application processes
• Service Quality Improvement: Analyzing service usage patterns to identify areas for improvement, enhance features, and optimize user workflows
• Case Status Analysis: Analyzing case status data to provide predictions or insights about typical processing timelines and potential outcomes
• Communication Enhancement: Improving our ability to understand and respond to your communications with better accuracy and relevance

No Automated Legal Decisions

Important: We do not use AI or machine learning to make automated decisions that produce legal effects or significantly affect your rights under immigration law or other regulations. Any major decisions regarding your case remain under human review and your control. AI and ML are used only to provide assistance and recommendations, not to make binding legal determinations.

Privacy Protections for AI/ML

When we use AI and machine learning technologies, we implement the following privacy protections:

• Data De-identification: Where possible, personal information used for AI/ML improvements is de-identified or anonymized to prevent identification of individuals
• Minimal Data Usage: We use only the minimum personal information necessary to train and improve our AI/ML models
• Aggregation: When analyzing patterns, we typically aggregate data across many users to prevent identifying individuals
• Regular Audits: We regularly audit our AI/ML systems to ensure they comply with privacy regulations and do not discriminate or violate user rights
• Transparency: We are transparent about when AI/ML is being used to assist you and how it works

Opt-Out of AI/ML Processing

You have the right to opt out of AI and machine learning processing of your personal information. If you wish to opt out, please contact us using the information in Section 8. Please note that opting out may limit the functionality of certain features that rely on AI/ML assistance, but will not prevent you from accessing core services.

GDPR and Automated Decision Making

If you are located in the European Union or United Kingdom, you have specific rights regarding automated decision-making under the GDPR. You have the right to obtain human review of any automated decisions that significantly affect you. If you wish to exercise this right, please contact us immediately using the information in Section 8.

3. COOKIES AND WEBSITE TRACKERS

3.1 What Are Cookies?

Cookies are small files that are stored on your device when you visit a website. Cookies can be used to recognize your device, remember your preferences, track your activity, and provide personalized content. Cookies can be "persistent" (stored on your device until you delete them or they expire) or "session-based" (deleted when you close your browser).

3.2 How We Use Cookies

3.2.1 Essential Cookies

We use essential cookies to enable basic functionality of our website and services, including authentication, security, and user preferences. These cookies are necessary for our website to function properly and cannot be disabled without affecting site functionality.

3.2.2 Analytics Cookies

We use analytics cookies to understand how visitors use our website and services. These cookies collect information about the pages you visit, the links you click, the time you spend on our site, and other usage patterns. This information helps us improve our website design, functionality, and user experience. We use tools like Google Analytics to collect and analyze this information.

3.2.3 Marketing Cookies

We may use marketing cookies to track your visits to our website and your interaction with our advertisements. These cookies allow us to deliver targeted advertisements and track the effectiveness of our marketing campaigns. You can manage your preferences for marketing cookies through your browser settings or by contacting us.

3.2.4 Third-Party Cookies

Third-party service providers, advertising networks, and other partners may place cookies on your device when you visit our website. These cookies may be used for analytics, advertising, or other purposes. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies.

3.3 Managing Cookies

You can control how cookies are used on your device through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. You can also delete cookies stored on your device. Please note that disabling certain cookies may affect the functionality of our website and your ability to access certain features.

4. THIRD PARTY DATA PROCESSING

4.1 Plaid Integration

We use Plaid, a third-party financial data aggregator, to securely connect to your financial institutions. If you choose to link your financial accounts through Plaid, Plaid will collect your bank login credentials and financial account information. Plaid processes this information on our behalf under a data processing agreement. Plaid is committed to protecting your information and is certified under SOC 2. You can review Plaid's privacy policy at www.plaid.com/legal.

4.2 Other Third-Party Processors

We may use other third-party service providers to process personal information on our behalf, including cloud storage providers, payment processors, analytics providers, communication services, and customer support platforms. All third-party processors are contractually obligated to use your information only to provide services to Alvva and to maintain the confidentiality and security of your information.

4.3 Data Processing Agreements

We have data processing agreements in place with all third-party processors that require them to implement appropriate security measures and to process your information only as instructed by Alvva.

5. DO NOT CALL POLICY

We respect the National Do Not Call (DNC) Registry. If you have registered your telephone number with the National DNC Registry, we will not contact you via telemarketing calls. However, we may contact you via phone for service-related purposes (such as responding to your inquiry, providing account updates, or confirming transactions) even if your number is on the DNC Registry. We may also contact you if you have provided your explicit written consent to receive calls from us.

If you would like to be added to our internal do-not-call list or if you believe we have contacted you in violation of the DNC policy, please contact us using the information in Section 8.

6. MARKETING COMMUNICATIONS OPT-OUT

We may send you marketing communications about new features, special offers, updates, and other information about our services. You have the right to opt out of these marketing communications at any time.

To opt out of marketing emails, you can:

• Click the "unsubscribe" link at the bottom of any marketing email we send you
• Log into your Alvva account and adjust your communication preferences
• Contact us using the information provided in Section 8

To opt out of SMS marketing messages, you can:

• Reply "STOP" to any SMS message we send you
• Contact us using the information provided in Section 8

Please note that even if you opt out of marketing communications, we may still send you service-related announcements, account notifications, and other non-promotional messages necessary for your account or our services.

6A. INTERNATIONAL DATA TRANSFERS

Overview

Alvva is based in the United States and operates primarily from the United States. If you are located outside the United States, your personal information will be transferred to, stored in, and processed in the United States.

Data Processing in the United States

By using Alvva's services, you acknowledge and consent to the transfer of your personal information to the United States. The United States may have data protection laws that are different from those in your home country. The U.S. does not have comprehensive federal privacy legislation equivalent to the GDPR or other international privacy standards.

For Users in the European Union and United Kingdom

If you are located in the European Union, United Kingdom, or other jurisdictions with privacy laws similar to the GDPR, you should be aware that:

• Your personal information will be transferred to and processed in the United States
• The United States is not recognized as having an adequate level of data protection equivalent to the GDPR
• We rely on appropriate safeguards (such as Standard Contractual Clauses) to ensure your information is protected during international transfers
• You have the right to request information about the safeguards we use for international transfers
• You have the right to object to international transfers of your personal information

Your Rights

If you have questions or concerns about how your information is transferred and processed internationally, please contact us using the information in Section 8. We are committed to protecting your privacy regardless of where your information is processed.

7. CHANGES TO OUR PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Privacy Policy on our website with a new "Last Updated" date. If we make material changes to this Privacy Policy, we will notify you by email to the address associated with your account or by other means of communication if we do not have your email address on file.

Your continued use of our website and services following the posting of changes to this Privacy Policy constitutes your acceptance of those changes. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.

8. HOW TO CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy, your personal information, or our privacy practices, please contact us using the information below:

We will respond to your request within the timeframe required by applicable law. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority, particularly if you are located in the European Union or United Kingdom.