Privacy policy

Passport work requires sensitive information. Our privacy design is simple: collect only what the government form needs, encrypt the sensitive parts, and destroy everything automatically once the work is done.

What we collect

The information the government application requires: identity details (including date of birth, Social Security number, and passport number where applicable), contact information, mailing addresses, your uploaded documents and photo, and order/payment records. Payment card numbers never touch our servers — they go directly to our payment processor (Stripe). When you browse our website, we also learn how it is used (see Cookies and Google Ads below).

How it's protected

In addition to storage-level encryption, sensitive fields are encrypted at the application level with per-record keys (AES-256-GCM, keys wrapped by a cloud KMS), the exact same cryptographic standard trusted by the NSA and global financial institutions. Documents are scanned for malware on upload and stored in access-logged buckets. Staff access is role-based, and every access to sensitive data is audit-logged.

How long we keep it

180 days after your order completes (or is canceled), your documents, photos, and sensitive identity fields are permanently and automatically destroyed — files deleted and encryption keys shredded, which makes the data unrecoverable. A limited transaction record (order number, amounts, dates, consent record) is retained as required for accounting and payment-dispute defense, typically 120 days for the dispute-evidence subset and up to 7 years for tax records. Applications that are started but never completed are purged 180 days after their last activity — the same 180-day clock as everything else.

Your rights (CCPA/CPRA and beyond)

Regardless of where you live, you can request a copy of your data or its deletion at /privacy-request. Requests are verified by email and answered within 30 days; deletion requests trigger the same permanent destruction described above (data tied to an order still in progress is deleted once the order completes). We do not sell personal information, and we do not use it to show you personalized advertising.

Who else sees your data

Only the vendors that help us deliver the service, each receiving the minimum necessary: Stripe (payments, with Authorize.net as a backup), SendGrid (transactional email), Smarty (address verification), our shipping carrier via EasyPost (labels and tracking), Google Cloud (infrastructure), Cloudflare (network security), Sentry (error reports from our website, with personal details removed), Google Analytics (how visitors use our website — pages viewed and application steps reached, never your application answers), and Google Ads (which of our ads led to an order — see below). And, of course, the U.S. Department of State — receiving exactly what you asked us to submit.

Cookies

We use a session identifier to keep your draft application working. We also use Google Analytics cookies to understand how visitors use our website, for example which pages are viewed and where visitors leave the application. These cookies do not contain your name, contact details or application answers, and we do not use them to show you advertising. You can opt out with Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout) or your browser's cookie settings.

Google Ads

When you come to our website from one of our ads on Google, Google Ads records that your visit came from an ad, using a cookie that lasts up to 90 days, and we keep that ad's click code with your application (it is deleted with your application). When you place an order, we tell Google Ads that the ad led to an order and the order's value, so we can see which ads work, and when your card is charged we tell Google Ads the amount charged, less government fees. With it we send a one-way scrambled code (a "hash") made from your email address; Google uses it only to match the order to the ad, and it cannot be turned back into your address. If an order is later cancelled or refunded, we tell Google Ads so the order is no longer counted. Google handles this under its restricted data processing terms, as our service provider: it is not used to build advertising audiences or to show you personalized ads. We never send your name, phone number, application answers or documents. If your browser sends a Global Privacy Control signal, we do not set the Google Ads cookie, keep the ad's click code or send the scrambled code.

Version 1.1, effective October 15, 2026. Questions: [email protected].