How applicant information is handled

Scope and role

INCOLA LLC (“incola,” “we,” “us,” or “our”) provides self-directed legal document preparation software at incolaforms.com. incola is a technology platform, not a law firm or a government agency, and we do not provide legal advice, legal representation, or official government adjudications.

This Privacy Policy describes how incola collects, uses, protects, and handles personal data when you interact with our website, complete guided questionnaires, generate legal form packages (such as USCIS Form AR-11, Form I-90, Form I-765, Form I-131 and Form I-539), and manage your applicant workspace.

For all self-directed document preparation on the platform, INCOLA LLC acts as the data controller responsible for processing your personal information.

Information we collect

incola collects only the personal information strictly necessary to authenticate your account, verify eligibility, and generate officially compliant immigration filings. We collect information across the following categories:

• Identity and Biographic Details: Full legal names, prior aliases or maiden names, residential and mailing addresses, email addresses, phone numbers, dates of birth, country of citizenship, and country of birth.
• Immigration Identifiers and History: Alien Registration Numbers (A-Numbers), USCIS Online Account Numbers, Form I-94 arrival/departure records, passport details, travel history, class of admission, and current immigration status details requested by official agency forms.
• Workspace Profile Information: Reusable applicant profile facts stored in your private workspace that you explicitly confirm for use across multiple filings.
• Case Responses and Filing Artifacts: Answers provided during guided interview sessions, uploaded supporting evidence (such as identity or fee waiver documentation), immutable draft revision logs, and compiled PDF artifact binaries.
• Account and Authentication Credentials: Account sign-in is provider-independent and managed via our secure authentication provider (Auth0). incola never inspects, receives, or stores plain-text passwords. We retain only your provider-assigned user identifier, verified email address, and authentication session timestamps.
• Technical and Security Telemetry: Standard HTTP request data including IP addresses, browser user-agent strings, system timestamps, and error codes necessary to safeguard application security and prevent abuse.

Logging Boundaries: We make reasonable efforts to exclude Social Security numbers, Alien Registration Numbers, and applicant interview declarations from application logs, crash reports, and monitoring telemetry.

Purposes of processing

We process personal information strictly to deliver reliable, deterministic software services and maintain your account. Specifically, your data is used to:

• Assemble Official Documents: Map canonical interview answers into officially compliant PDF forms and companion filings using exact field-level specifications.
• Execute Automated Validation Checks: Perform client-side and server-side mathematical and consistency checks to identify missing fields, invalid code combinations, or logical contradictions prior to filing.
• Maintain Your Document Vault: Securely preserve immutable artifact revisions, generation audit trails, and compiled packages for on-demand inspection and download.
• Propose Profile Facts Across Filings: Streamline subsequent questionnaires by suggesting previously confirmed workspace profile facts, requiring your explicit review and acceptance before assignment to a new case.
• Service Administration: Deliver essential transactional notices, such as account confirmations, password resets, and critical security notices.
• Platform Integrity: Verify cryptographic template digests (SHA-256) to guarantee that underlying legal form definitions have not been altered or corrupted.

No Artificial Intelligence Model Training: Applicant answers, case histories, and uploaded supporting evidence are never used to train public machine learning models, commercial foundation models, or third-party AI systems.

Architectural boundaries and data ownership

incola is engineered around strict architectural invariants designed to preserve data integrity and applicant control:

• Workspaces Own Reusable Knowledge: Your workspace stores permanent, reusable applicant details (such as current contact information and biographic facts) that can propose answers across multiple forms.
• Cases Own Immutable History: Individual cases own an append-only, immutable history of interview revisions and generated artifacts. Modifying a workspace profile never retroactively mutates or alters a previously finalized case or generated PDF.
• Profiles Propose; Users Confirm: Workspace data may propose answers during an interview, but no value is committed to a case without your explicit review and confirmation.
• Local Cache vs. Authoritative Storage: When you are signed in, your interview progress is also kept in your browser’s local storage as a working copy, marked as belonging to your account, so you do not lose answers if your connection drops. The application saved to your account is the record; browser storage is never treated as the permanent source of truth. Before you sign in, only your answers to the short guided questions are kept, in your browser. An interview cannot be started without an account.

Sharing, service providers, and zero data sales

incola does not sell your information. incola does not sell, rent, license, trade, or disclose applicant personal information—including your biographic facts, interview answers, uploaded documents, account credentials, or platform usage history—to anyone for monetary payment or anything else of value. We do not share your data with third parties for cross-context behavioral advertising, and we do not permit advertising networks to track you across websites.

We disclose personal information exclusively to contracted service providers who operate strictly under our instructions and are bound by stringent confidentiality and data protection obligations:

• Identity and Authentication: Auth0 (Okta) manages user identity, multi-factor authentication, and secure session tokens without exposing passwords to our application.
• Cloud Infrastructure and Storage: Certified cloud infrastructure providers host our encrypted databases, application containers, and file vaults under strict role-based access controls.
• Payment Processing: Stripe processes payments for paid services. Payment card details are entered directly into Stripe’s embedded, PCI-compliant interface. incola never handles, processes, or stores your credit or debit card numbers.

Legal Disclosures: We will only disclose applicant records to law enforcement or regulatory authorities if compelled to do so by a binding court order, valid subpoena, or applicable statutory mandate. incola will promptly notify you of any such demand unless legally prohibited from doing so.

Storage, security, and retention

We implement comprehensive technical and organizational controls to protect personal information against unauthorized access, loss, or alteration:

• Encryption in Transit: All communication between your browser and incola servers is encrypted using modern Transport Layer Security (TLS 1.2 or 1.3).
• Encryption at Rest: Sensitive identifiers—Social Security numbers, Alien Registration Numbers, USCIS Online Account Numbers, passport numbers, and I-485 receipt numbers—are encrypted on their own with AES-256-GCM under a per-workspace key. Other applicant data, and the database volume itself, are stored as ordinary text. Uploaded evidence files and generated PDF binaries are encrypted at rest using AES-256 encryption. This is a stated limit of the design, not an oversight.
• Cryptographic Template Verification: Government form definitions and PDF compilation templates are verified against pinned SHA-256 cryptographic digests to prevent template tampering.
• Fail-Closed Integrity: Form generation adapters do not populate signature fields, ensuring that legal artifacts require physical or authorized electronic execution. Document generation fails closed with explicit validation errors rather than silently truncating overflowing text.

Questions We Never Save: Our Form I-539 guided check asks a few questions about arrests and convictions, violations of your current status, security-related acts, and exchange-visitor history. We never save your answers to those guided questions: they stay in your browser only while the page is open and are not written to browser storage, so you are asked again when you start your interview. In the interview, a “Yes” to any of these questions stops the interview, and we do not save that answer. A “No” is saved with your other answers and, once saved to your account, is encrypted on its own, like your Social Security and Alien Registration numbers.

Interviews That Stop Early: If an interview saved to your account stops because your situation is outside what incola supports, we keep a record of the stop: the form, the question, your answer, your account, the date, and the email address you signed in with, if your account has one. Our team can see it and may use it to follow up with you about next steps. Only incola staff whose role allows them to view applicant information can see it. Deleting the case, or your account, removes the email address from the record; the rest is kept, so there remains a record that the stop happened. A stop on one of the Form I-539 questions described above is never recorded.

35-Day Backup Retention for Your Personal Data: incola maintains encrypted disaster recovery backups to ensure operational resilience. When you delete a case, that case’s questionnaire answers and generated documents are removed from active production storage immediately; information saved to your reusable profile is not removed by deleting a case. When you ask us to delete your entire account, we verify and review the request, and once it is approved your questionnaire answers, biographic facts, and generated documents are removed from active production storage. Encrypted backup snapshots containing that data are retained on a 35-day rolling schedule, after which they expire.

Financial Transaction Records Are Retained Separately: When you make a payment, incola keeps a permanent transaction record—the Stripe session and payment identifiers, the form purchased, the amount charged, the currency, and the transaction date. This record contains none of your personal or biographic information: no name, no email address, no card or account number. It exists solely to account for the payment itself, the way a receipt or ledger entry would, and is kept indefinitely to meet standard financial record-keeping and tax obligations. Because it holds no personal data about you, deleting your case or account does not remove it, and the 35-day backup schedule above does not apply to it.

Browser storage, cookies, and payments

incola minimizes client-side data storage and does not employ non-essential tracking technologies:

• Essential Authentication Cookies: Used exclusively to maintain your authenticated session, protect against cross-site request forgery (CSRF), and ensure secure transmission of your account tokens.
• Local Browser Storage: Your browser’s local storage holds your answers to the guided questions and, once you are signed in, a working copy of your interview progress, so you do not lose answers if your connection drops. incola does not use IndexedDB. You can clear this storage at any time in your browser settings, with **Start fresh** in the guided questions, or with **Clear saved draft** in an interview.
• Payment Integration: When purchasing a preparation tier, Stripe loads its secure payment form in your browser. Stripe may deploy necessary security cookies to authenticate transactions and detect payment fraud.
• Zero Marketing Cookies: We do not load advertising scripts, social media trackers, or cross-site analytics pixels. Our strict Content Security Policy (CSP) forbids unauthorized third-party scripts from executing within your session.

Your choices and data rights

Regardless of your geographic jurisdiction, incola provides comprehensive control over your personal data:

• Right to Access and Inspect: You may inspect your active profile, interview responses, and compiled PDF packages at any time through your Document Vault.
• Right to Correction: You may update or amend your profile facts and generate new draft revisions prior to package finalization.
• Right to Data Portability: You can download completed PDF filing packages and canonical summary records in standard formats.
• Right to Erasure: You can delete a case yourself at any time, and its answers and generated documents leave live systems immediately. To delete your entire account, email the privacy desk below. We verify and review the request, and once it is approved your personal and biographic data is removed from live systems and permanently clears disaster recovery backups within 35 days. As described above, this does not include the permanent, non-personal financial transaction record of any payment made, which is retained to meet standard financial record-keeping obligations.
• Non-Discrimination: incola will never deny services, increase prices, or degrade platform functionality because you exercised your statutory privacy rights.

To submit a privacy inquiry or exercise your data rights, email our dedicated privacy desk at privacy@incolaforms.com. We verify requests against your authenticated account and respond within 30 days of a verified request.

Children’s privacy

incola is designed for adults aged 18 and older. We do not knowingly collect personal information directly from children under 18 years of age without verified parental or guardian consent.

Where an adult applicant prepares an immigration application involving minor dependents or family members, all biographic information is supplied exclusively by the adult petitioner or parent solely to complete the official government filing.

Changes to this policy and contact

We may update this Privacy Policy periodically to reflect enhancements to our document pipeline, expanded form support, or regulatory changes. When material modifications occur, we will update the “Last Updated” date at the top of this page and display a prominent update notice in the applicant dashboard.

For questions regarding our privacy practices, technical safeguards, or regulatory compliance, contact our team:

incola Privacy

Email: privacy@incolaforms.com

Website: incolaforms.com

To learn more about our architectural safeguards and cryptographic controls, visit our Trust & Security Page.