Privacy Policy

1. Who We Are

BaseLeaf Inc. ("BaseLeaf," "we," "us") is a technology platform that assists with immigration application preparation. We are not a law firm and do not provide legal advice. Our services do not substitute the advice of a licensed immigration attorney.

2. Information We Collect

We collect the following categories of personal information:

• Identity & Contact: Full name, email address, country of birth, country of residence.
• Professional Background: Education history, employment history, publications, awards, patents, and professional achievements.
• Uploaded Documents: CV/resume, identity documents (e.g., passport), supporting evidence such as recommendation letters, publications, and credentials.
• Recommender Information: Names, titles, organizations, email addresses, and areas of expertise of individuals you identify as recommenders.
• Payment Information: Processed securely by Stripe. We do not store credit card numbers or payment card data on our servers.
• USCIS Case Information: Receipt numbers, case status, and filing details for submitted petitions.
• Usage Data: Pages visited, form progress, and interactions with our platform, collected for service improvement.

3. How We Use Your Information

We use your personal information to:

• Assess your profile for immigration pathways (EB-2 NIW, EB-1A).
• Prepare and assemble your immigration petition documents.
• Generate petition drafts and recommendation letters for your review.
• Facilitate attorney review of your petition materials.
• Process payments and manage your account.
• Send transactional emails (evaluation reports, status updates, reminders).
• Improve our platform and services.

4. Who We Share Your Information With

We may share your information with:

• Attorneys: Licensed immigration attorneys who review your petition as part of our service.
• Service Providers: Third-party providers that help us operate the Platform, including cloud hosting, email delivery, and document processing. These providers access your data only as needed to perform services on our behalf.
• Payment Processor: Stripe processes all payments. See Stripe's Privacy Policy.

We do not sell your personal information to third parties.

5. Data Security

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: All stored data is encrypted using AES-256 encryption.
• Access controls: Users can only access their own data. Attorney access is limited to assigned cases.
• Secure authentication: Industry-standard authentication protects your account.
• Payment security: Payment card data is handled entirely by Stripe (PCI-DSS Level 1 certified) and never touches our servers.

6. Data Retention

• Active cases: Retained for the duration of service plus 3 years.
• Completed/filed cases: Retained for 7 years (legal record-keeping for immigration filings).
• Evaluation data (non-converted): Retained for 12 months, then deleted or anonymized.
• Payment records: Retained for 7 years (tax and accounting requirements).
• Uploaded documents: Retained for the duration of service plus 1 year, then deleted.

7. Your Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a portable format.
• Withdraw Consent: Withdraw consent for data processing at any time.
• Opt Out: Unsubscribe from non-essential emails at any time.

To exercise any of these rights, contact us at hello@baseleaf.co.

8. Cookies & Tracking

We use essential cookies for authentication and security (e.g., session tokens, Cloudflare Turnstile verification). We may use analytics cookies to understand how our platform is used. You can control cookie preferences through your browser settings.

9. International Data Transfers

Our services are hosted in the United States. If you access our platform from outside the US, your data will be transferred to and processed in the United States. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable regulations.

10. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of personal information. We do not sell personal information. To make a request, contact hello@baseleaf.co.

11. European Residents (GDPR)

If you are located in the EU/EEA, our lawful basis for processing your data is contract performance (preparing your immigration petition) and consent (evaluation form submissions). You have additional rights under the GDPR including the right to lodge a complaint with your local data protection authority.

12. Children’s Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top reflects the most recent revision.

14. Contact Us

For privacy-related questions or requests:

• Email: hello@baseleaf.co