Privacy Policy

1. Overview

Professional Passport LLC, doing business as Professional Passport ("Professional Passport", "we", "us"), respects your privacy and is committed to protecting the personal information you share with us. This policy explains what we collect, how we use it, who we share it with, and the rights you have over your information.

This policy applies to information we collect on www.propassport.org, through our applications, and through related services we provide. By using our services, you agree to this policy.

2. Information we collect

To process travel document applications on your behalf, we need to collect information directly from you and, in limited cases, from third parties.

From you, directly:

• Identity & contact information: name, date of birth, sex, place of birth, citizenship status, mailing and home addresses, phone, email.
• Government identifiers: Social Security Number (optional, encrypted), passport number, driver's license number, Alien Registration Number.
• Application content: answers to government form questions, employment history, travel history, criminal-history disclosures, biometric attestations.
• Documents: photos and scans of government-issued IDs, passport photos, proof of address, parental consent forms.
• Payment information: handled directly by Stripe; we never see your full card number. We retain the last 4 digits and card brand.
• Communications: messages, emails, and chat transcripts with our support team.

Automatically:

• IP address, browser type, device type, operating system, pages viewed, referring URL, time stamps.
• Email engagement: opens, clicks, bounces, complaints (via Resend webhooks).
• Advertising & analytics technologies: our marketing pages load Google Tag Manager, which may load Google Ads conversion measurement and the Meta Pixel. These set cookies and transmit technical identifiers (IP, device, pages viewed) to those providers for conversion measurement. We honor the Global Privacy Control signal — see Section 8.

From third parties (limited):

• Stripe — transaction confirmations, refund status.
• Government agencies — application status updates, KTN/PASSID issuance, appointment confirmations.

3. How we use your information

We use your information for the following purposes:

• To process and submit your travel document applications to the appropriate government agency.
• To validate your documents using AI vision technology (we use Anthropic Claude as a service provider; see Section 6).
• To answer your service questions via our on-site AI chatbot. Conversations are stored for quality assurance, support follow-up, and abuse prevention. The AI provider is Anthropic (U.S.-based); see Section 6.
• To send you email and SMS updates about your application status.
• To process payments and refunds via Stripe.
• To provide customer support and respond to your inquiries.
• To improve our service through aggregated analytics (we never sell or share individual data for advertising).
• To comply with legal obligations and respond to lawful government requests.
• To protect our service and customers from fraud and abuse.

4. Categories of personal information (California residents)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the following categories of personal information have been collected from California residents in the past 12 months:

Sources: directly from you, automatically through cookies/analytics, and from government agencies regarding application status only.

Retention: each category is retained per the criteria and periods in Section 13 (Data retention) — application data and payment records 7 years, document uploads 90 days post-submission, communications 3 years, account data until deletion.

We disclose categories A, B, C, D, F, I, and L to the service providers listed in Section 6 for the business purposes in Section 5. We do not sell personal information for money.

5. Business purposes for collection

We collect personal information for the following business and commercial purposes:

• Performing the services you've contracted us to provide (filing your government application).
• Detecting and preventing fraud and security incidents.
• Debugging, identifying and repairing errors in our service.
• Performing internal research for technological improvement.
• Quality control and verification of our services.
• Complying with legal obligations.

6. Third parties we share data with

We share personal information only with service providers who have contractual obligations to protect your data, and only as necessary to provide our service. We do not sell personal information to advertisers or data brokers.

Our current service providers:

• Supabase (database, authentication, document storage) — Professional Passport data is stored on their U.S. infrastructure.
• Stripe (payment processing) — they receive name, email, address, and card data; we never see your full card number.
• Resend (transactional email delivery) — they receive email address and message contents.
• Anthropic (AI document validation and on-site chatbot) — when our AI checks your uploaded documents or you converse with our on-site chatbot, the document image or chat content is sent to Anthropic Claude. They do not retain or train on this data per their enterprise terms.
• Vercel (web hosting) — they receive standard web request logs.

Advertising & analytics partners:

Our marketing pages use Google (Tag Manager, Ads conversion measurement) and Meta (Pixel and server-side Conversions API) to measure which ads lead to purchases. These tools receive technical identifiers (IP address, device information, pages visited, hashed email for matching) — disclosures that may constitute "sharing" under California law. We honor opt-out signals as described in Section 8. We do not use any other advertising or session-tracking providers.

Government agencies:

To complete your application, we transmit your personal information to the relevant government agency: the U.S. Department of State (passport) or the applicable foreign government / travel-authorization authority (visa / ETA). This is required for the service.

Legal requirements:

We may disclose information when required by law, subpoena, court order, or to protect rights, property, or safety.

7. Your California privacy rights

If you are a California resident, you have the following rights under CCPA/CPRA:

• Right to know — request a copy of the personal information we have collected about you in the past 12 months.
• Right to delete — request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to correct — request that we correct inaccurate personal information.
• Right to limit use of sensitive personal information — request that we limit our use of sensitive PI to that necessary for service provision.
• Right to opt out of "sale" or "sharing" — see Section 8.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, visit our data request page or email privacy@propassport.org. We will respond within 45 days; we may extend this once by an additional 45 days if reasonably necessary.

Verification: we may need to verify your identity before fulfilling a request — typically by matching information you provide against the information in your account.

Authorized agents: you may designate an authorized agent to make a request on your behalf. We will require written authorization and may require the agent to verify your identity directly.

Opt-out preference signals: we treat the Global Privacy Control (GPC) browser signal as a valid request to opt out of "sharing" — see Section 8.

"Shine the Light" (Cal. Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes, so no list of such disclosures exists to request.

9. Sensitive personal information

We collect sensitive personal information (Social Security Number — optional, government ID numbers, citizenship status, and account credentials) only to perform the services you request, prevent fraud, and ensure security — the purposes permitted by Cal. Civ. Code §1798.121(a) and its regulations. We do not use or disclose sensitive personal information to infer characteristics about you, for advertising, or for any purpose beyond those permitted uses. SSN and government ID numbers are encrypted at rest.

10. Automated processing & AI

We use AI in two places: (1) validating that your uploaded documents and photos meet government requirements, and (2) the on-site support chatbot. AI document checks are advisory — a human specialist reviews every application before submission, and no decision producing legal or similarly significant effects about you is made solely by automated means. You can always reach a human reviewer at hello@propassport.org.

11. Financial incentives

We occasionally offer discounts (for example, a comeback discount if you return to an unfinished application, or returning-customer promotions) that involve your email address. The value of the incentive is reasonably related to the value of the data: your contact information lets us deliver the offer and provide the service. Participation is voluntary; you opt in by providing your email and may opt out at any time by unsubscribing or requesting deletion, with no penalty.

12. Data security

We use industry-standard security measures to protect your information:

• TLS/HTTPS encryption for all data in transit.
• Encryption at rest for sensitive fields (SSN, government ID numbers).
• Document storage in private, access-controlled buckets.
• Multi-factor authentication for our admin accounts.
• Automated audit logging of all admin actions involving customer data.
• Annual security review and provider audits.

No system is 100% secure. If we ever experience a data breach affecting you, we will notify you in accordance with applicable law.

13. Data retention

We retain your information for as long as it is necessary to provide our service, comply with legal obligations, resolve disputes, and enforce our agreements:

• Application data: retained for 7 years to support audits and disputes, in line with industry standards for government-document services.
• Document uploads: retained for 90 days after application submission, then deleted from our systems.
• Payment records: retained for 7 years for tax and audit compliance.
• Email and support communications: retained for 3 years.
• Account data: retained until you request deletion or close your account.

14. Children's privacy

We do not knowingly collect personal information from children under 13. We do process applications for minor passports, but the application is submitted by the minor's parent or legal guardian, who provides all required information.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. When we make material changes, we will notify you by email and post a notice on our website. The "Last updated" date at the top of this policy will be revised.

16. How to contact us

For questions about this policy or to exercise your privacy rights:

• Email: privacy@propassport.org
• Web form: www.propassport.org/data-deletion

For California-specific requests, you can also use our dedicated data request form.