ImmiFlo Privacy Policy

Last updated: October 7, 2026

ImmiFlo is a web app at immiflo.ai. Because it runs in your browser, it necessarily stores the files you upload on our servers so you can come back to your case later. This policy explains what we collect, where it is stored, and how to delete it; see our Security & Data page for the full technical breakdown.

1. What we collect

When you upload a notice letter or filing document, the file itself — not just extracted text — is sent over an encrypted connection to our cloud storage and retained so you and the app can retrieve it later. We also store the case record itself (applicant name, case type/stage), the file name, size, and content type, and cached structured output from RFE analysis so reopening a case doesn't require re-running AI. See Section 3 for where this is stored and Section 6 for how to delete it.

2. USCIS Case Status Auto-Tracking (optional feature)

ImmiFlo lets you subscribe to "USCIS Case Status Auto-Tracking." When enabled, our servers periodically query the official USCIS Case Status API on your behalf and notify you by email and in-app notification whenever your case status changes.

  • What we collect: only the USCIS receipt number you enter, the associated form type, and the case status text/date returned by each query.
  • Purpose: solely to periodically check that receipt number's status with USCIS and alert you when it changes. Not used for any other purpose, and never used to train AI models.
  • Sharing: your receipt number is sent to the official USCIS Case Status API in order to perform the lookup (this is required for the feature to work). Beyond that, we do not sell or share your receipt number or status history with any other third party.
  • Retention: your receipt number and most recent status are retained for as long as tracking stays enabled. You can turn off tracking at any time from the case page; once disabled, we stop querying immediately and permanently delete the stored receipt number and status history within 30 days.
  • Requesting deletion: in addition to disabling tracking yourself in the app, you may email [email protected] to request immediate deletion. We will complete the request and confirm by email within 15 business days.
  • Account closure: if you delete your account, all USCIS tracking records under that account are permanently deleted as part of account deletion, with no separate request needed.

3. Where your data is processed and stored

Our application servers and database run on AWS (us-east-1, United States). Uploaded case files are stored in Cloudflare R2, also in our US region. Files and case records are retained for the life of your case, capped at 90 days of inactivity — after that, or when you delete a document or case yourself, the underlying file bytes are removed from storage, not just the database row. Account-level records needed to operate the service (billing history, subscription status, usage logs, and Section 2's USCIS tracking data) are kept separately from case content and are not subject to the 90-day case-inactivity cap.

4. Third-party AI providers

Depending on the feature and your account settings, requests may be routed to one or more of: DeepSeek, Alibaba Cloud DashScope (Qwen), and OpenRouter (which in turn routes to models such as OpenAI GPT or Google Gemini). Each provider processes only the text/data needed to fulfill your request and is bound by its own data handling terms. We do not opt in to having these providers train on your data.

5. Sub-processors

In addition to the AI providers in Section 4, ImmiFlo uses: AWS (application hosting, database), Cloudflare R2 (file storage), Stripe (payment processing), Resend (transactional email), and PostHog US Cloud (product analytics). None of these receive your full payment card details — that is handled entirely by Stripe.

6. Your choices

You can delete an individual document or an entire case at any time from the app — this removes the underlying file bytes from our storage, not just the database record. You can request full account deletion at any time from in-app support; after a cooling-off period, all of your case files, documents, and account data are permanently deleted, including the underlying storage objects. You may also request a copy of the account-level data we hold about you by emailing [email protected].

7. Changes to this policy

We may update this policy from time to time. If a change adds a new category of data collected or a new purpose, we will re-prompt you for consent the next time you open the affected feature before you can continue using it; continuing to use the rest of the app after other changes constitutes acceptance of the updated policy.

8. Contact

Privacy questions: