Effective Date: October 8, 2026

Last Updated: September 23, 2026

Quick Summary

This is a short summary for convenience. The full policy below controls.

• We collect account details, immigration case data, billing information, and basic usage data.
• We never sell your personal information or immigration data.
• We protect immigration data with encryption, role-based access, and audit logs.
• You can access, correct, get a copy of, or delete your data, and close your account, at any time.
• To make a request or ask a question, email icmregistrations@mirausa.net.

1. Introduction

MIRA USA, INC. (“MIRA USA,” “we,” “us,” or “our”) is a nonprofit organization recognized by the U.S. Department of Justice (DOJ) to provide immigration legal services through qualified DOJ Accredited Representatives.

MIRA USA, INC. operates the MIRA USA ICM Platform, an immigration case management platform that supports the delivery of our immigration legal services. This Privacy Policy explains how we collect, use, share, store, and protect personal information when people interact with MIRA USA, INC., use the MIRA USA ICM Platform, or use websites, forms, and online services related to MIRA USA, INC. (together, the “Services”).

By using the Services, you acknowledge that we handle your personal information as described here. If you do not agree, please do not use the Services. This Policy is available in English and Spanish. If the two versions differ, the English version prevails.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, phone number, organization name, role, and physical address.

2.2 Immigration Case Data

To provide case management, we process immigration information that you or your clients submit. This includes USCIS form data (for example, I-130, N-400, I-485), case reference numbers, e-filing receipt and request numbers, case statuses, supporting documents, and beneficiary information. This data may include personal identifiers, such as the Alien Registration Number (A-Number), Social Security number, passport or other identity and travel document numbers, and date and place of birth, as well as the immigration, travel, employment, and other history that the forms require. It may also include sensitive information, such as medical information (for example, Form I-693 records) and information about family members. We treat this data with the heightened protections in Section 5.

2.3 Financial Information

We collect billing and payment information, including invoice details, payment method, transaction records, and fee-waiver documents. We do not store full credit card numbers on our servers. Payment processing is handled by third-party processors.

2.4 Usage Data

We automatically collect information about how you use the Service, including IP address, browser type, device information, pages visited, and timestamps. We use essential cookies for sign-in and session security. We do not use advertising or cross-site tracking cookies, and our analytics do not use cookies to track you.

2.5 Communications

We collect information you send when you contact us, request a demo, or send messages through the Platform, including your name, email, organization, and message content.

2.6 What We Do Not Collect

We do not collect precise (GPS-level) geolocation; an IP address may indicate only an approximate region. We do not access your device’s contacts, and we do not collect biometric data.

2.7 Information We Obtain from USCIS

Some Platform features query USCIS APIs to obtain information about the cases you manage, such as case status, receipt number, and case update history. We only query cases that an authorized user registers on the Platform.

We use this information only to show it to the case’s authorized users and to keep the case file up to date. We do not sell it, we do not use it for marketing or profiling, and we do not share it with third parties, except with the providers that help us operate the Service or when the law requires it. USCIS keeps the official record of every case.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Process and manage immigration cases for you
• Create invoices, track payments, and manage billing
• Schedule and manage appointments
• Send notifications, reminders, and service messages
• Create reports and analytics for your organization
• Respond to your questions and support requests
• Detect, prevent, and fix technical and security problems
• Meet our legal obligations

When we create reports or analytics, we use de-identified, anonymized, or aggregated data that does not identify individuals. We do not use immigration case data for marketing, advertising, or profiling.

4. How We Share Your Information

We do not sell your personal information or immigration data, for profit or in any other monetary transaction.

We may share your information with these categories of third parties:

4.1 Service Providers

• Kinde: sign-in and identity management
• Amazon Web Services (AWS S3): secure document and file storage
• Resend: transactional email delivery
• MongoDB: database hosting
• OVHCloud: website and Platform hosting

These providers process data only on our behalf. They are contractually required to protect your information and to follow this Privacy Policy. They may not use your data for their own purposes.

4.2 No Third-Party Use Without Consent

Third parties may not use or disclose your information, including any de-identified, anonymized, or pseudonymized data, for any purpose without your active consent. Every third party that processes data for us is bound by this Privacy Policy.

4.3 Legal Requirements

We may disclose your information if the law, a regulation, a legal process, or a government request requires it.

4.4 Business Transfers

If MIRA USA, INC. is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the new entity. Any new entity must protect your information under terms at least as protective as this Privacy Policy. We will notify you by email or with a clear notice in the Service before your information is transferred and becomes subject to a different privacy policy. Before any transfer, you can ask for a copy of your data, ask us to send it to someone you choose, or ask us to delete it, as described in Sections 8 and 10.

Immigration case information will be transferred only in a way that is consistent with the Department of Justice rules for Recognized Organizations and Accredited Representatives, and with our confidentiality duties to each client. DOJ recognition does not transfer automatically to another entity. For that reason, representation in your case will continue only with an authorized organization or professional and with your consent, and MIRA USA, INC. will notify the DOJ of these changes when its rules require it.

4.5 Collection of Past-Due Payments

If a payment is past due and after we notify you in writing, we may share with collection agencies or credit reporting agencies only the data needed for collection: your name, your contact information, and the amount and date of the debt. We never share immigration case data with them.

5. Extra Protections for Immigration Data

Immigration case data is very sensitive. We give extra protection to key details. These include immigration status, USCIS filings, case numbers, supporting documents, medical records, and beneficiary details:

• We encrypt immigration data in transit (TLS 1.2+) and at rest (AES-256)
• Access is limited to authorized users in your organization, based on role-based access controls
• We never use immigration data for marketing, advertising, or profiling
• We never share immigration data with third parties, except as needed to run the Service (for example, document storage) or as the law requires
• Coordinators and program directors see only aggregated, de-identified data, never individual personal information
• Full audit trails record all access to immigration case data

6. Your Sharing Choices and the Effect on Others

You choose what information you submit. You may limit what you provide, though some information is needed to run the Service, and leaving it out may limit features. You may withdraw consent, request deletion, or close your account as described in this policy.

Because immigration matters involve other people, sharing information affects them too. For example, family, relationship, medical, or dependent information may reveal details about relatives, minors, or sponsors. Submit only information you are allowed to share, and get consent from those people where required. We reduce the risks of sharing through encryption, role-based access, and the third-party limits in Section 4.2. No system, however, can remove every risk.

7. How Long We Keep Data

We keep your information while your account is active or as needed to run the Service. Specific retention periods:

• Active accounts: we keep data while the account is active
• Closed accounts: we delete data within 90 days of closure, unless the law requires us to keep it
• Dormant accounts: if an account is inactive for 24 months, we send a notice; if we get no reply within 30 days, we schedule the account and its data for deletion
• Billing records: we keep these for 7 years, as tax and financial rules require
• Audit logs: we keep these for 3 years for compliance

If the law or the rules that apply to MIRA USA, INC. as a DOJ Recognized Organization require us to keep case files longer, we will keep them only for that period and then delete them.

8. Deleting Your Data and Closing Your Account

You may ask us to permanently delete your personal data at any time, and you may close your account at any time. To do so, email icmregistrations@mirausa.net or use your account settings. A deletion request is completed within 30 days of verification. If you close your account instead, deletion may take up to 90 days, which includes a 30-day period for you to request a copy of your data (see Sections 14 and 15 of the Terms of Service).

When we receive a verified deletion request, we will:

• Acknowledge the request within 5 business days
• Complete deletion within 30 days of verification
• Notify you when deletion is complete
• Tell all third-party providers to delete your data
• Delete your data from backups within 35 days, as those backups are replaced, unless the law requires us to keep it longer. Until then, backups stay encrypted and are not used for any other purpose

We may keep certain data past the deletion period if the law requires it (for example, billing records for tax rules). We will tell you about any such exception.

9. Data Security

We use appropriate technical and organizational measures to protect your information:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls with 10 or more user roles
• Multi-factor authentication through Kinde
• Regular security assessments
• Secure cloud infrastructure (AWS)
• Full audit trails for all data access and changes

Where Data Is Stored and Who Can Access It

We store data on servers located in the United States.

Data Breach Notice

If a data breach affects your personal information, we will notify affected users within 72 hours of learning about it. The notice will explain the nature of the breach, the data affected, the steps we are taking, and actions you can take.

10. Your Rights

You have the right to:

• Access: ask for a copy of the personal data we hold about you
• Correction: ask us to fix inaccurate or incomplete data
• Deletion: ask us to permanently delete your data (see Section 8)
• Portability: request your data in a machine-readable format (CSV or Excel)
• Opt out: opt out of non-essential communications at any time
• Withdraw consent: where we rely on consent, withdraw it at any time

To use any of these rights, email icmregistrations@mirausa.net. Before we respond, we may ask for information to verify your identity. We will respond within 30 days.

If we deny your request in whole or in part, we will explain why. You may appeal that decision by emailing the same address, with the subject line “Appeal,” within 30 days. We will decide the appeal within 45 days.

Requests About Deceased Persons

If a client dies, we will release their information only to someone who shows legal authority to receive it, such as the personal representative of their estate, with the documents listed in Section 20 of the Terms of Service. Family members without that authority will receive only general information, unless the client authorized otherwise in writing during their lifetime.

11. U.S. State Privacy Rights

MIRA USA is based in Florida and serves people across the United States. Depending on your state and applicable law, you may have certain rights about your personal information.

These rights may include the right to:

• Ask for access to, or information about, the personal information we keep about you
• Ask us to correct inaccurate personal information
• Ask us to delete certain personal information, subject to legal, regulatory, case-management, and record-keeping rules
• Learn how your personal information is collected, used, or shared
• Get a copy of certain personal information, where the law requires
• Opt out of certain uses or sharing of personal information, where applicable
• Name an authorized agent to make a request for you, where the law allows

MIRA USA does not sell personal information. Residents of some states, including California, may have added rights under their state privacy laws. We handle privacy requests under applicable federal and state laws.

Some information may be exempt from a request. We may also need to keep some information for legal reasons. These reasons include meeting legal or regulatory duties, following immigration case-management and record-keeping rules, preventing fraud or misuse, defending legal rights, or meeting our duties as a DOJ Recognized Organization. We will not unlawfully treat anyone differently for using privacy rights available under the law.

To make a request under your state’s privacy law, email icmregistrations@mirausa.net. You may appeal our response as explained in Section 10.

12. Children’s Privacy

You must be at least 18 years old to create an account on the Service. The Service is not directed to minors, and we do not knowingly collect personal information directly from minors. Immigration case data submitted by adult users may include information about minor beneficiaries; we handle that information under the extra protections in Section 5. If you believe a minor gave us personal information directly, please contact us and we will take steps to delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Email you, or post a clear notice on the Service, at least 30 days before the changes take effect
• Give you a plain-language summary of what changed and why
• Get your active consent before changes that materially affect how we process your data

For non-material changes, continuing to use the Service after the effective date means you accept the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or want to use your rights, contact us:

MIRA USA Inc.

Address: 8333 W McNab Road, Suite 210, Tamarac, FL 33321

Email: icmregistrations@mirausa.net

Website: https://www.mirausa.net