Privacy Policy
Effective date: September 30, 2026
This Privacy Policy explains how JNC Investment Group LLC (“we,” “us”), a Florida limited liability company based in Orlando, Florida, collects, uses, shares and protects information through ImmiAce, our immigration case software (the “Service”), including the websites immiace.com and app.immiace.com and the secure links we send to clients of our customers.
1. Who this policy covers
- Firms and their staff — immigration preparers, attorneys, accredited representatives, nonprofit offices and their team members who sign up for ImmiAce (“Firms” and “Users”).
- Firms’ clients — the people whose immigration cases a Firm manages in ImmiAce, including clients who answer questions or upload documents through a secure link (“Clients”).
- Visitors to our public website.
For Client information, the Firm decides what is collected and why. The Firm is responsible for that information, and we process it on the Firm’s behalf and under its instructions. If you are a Client, please contact the Firm handling your case with questions about your information; we will help the Firm respond.
ImmiAce is software used by your Firm. We are not a law firm and do not give legal advice.
2. Information we collect
From Firms and Users
- Account and firm details: name, email, phone numbers, role, firm name, address, website, practice details, and sign-in credentials.
- Billing details: subscription plan and payment status. Card numbers are handled by our payment processor; we do not store full card numbers.
- Settings and connections, such as the cloud storage account the Firm connects.
- Communications with us and your agreement to our Terms and this policy.
Client information entered by Firms or Clients
To prepare immigration forms, Firms and Clients enter information that can be highly sensitive, including names and other names used, dates and places of birth, addresses and address history, phone numbers and email, Social Security numbers, Alien Registration Numbers (A-Numbers), USCIS account numbers, passport and travel document details, immigration and travel history, family and marriage history, employment and education history, criminal and immigration-proceedings history, biographic details, and copies of identity, civil and immigration documents.
Collected automatically
- Technical and security data: IP address, browser type, device information, pages visited, times of access and error logs.
- Essential cookies that keep you signed in and protect against misuse. We do not use advertising cookies.
3. How we use information
- To provide the Service: build questionnaires, generate client document lists, fill USCIS forms, deliver secure links, and save uploaded documents to the Firm’s chosen storage.
- To secure the Service, prevent fraud and misuse, and keep audit records.
- To provide support, send service and billing messages, and, if you opt in, product news and offers (you can opt out at any time).
- To maintain and improve the Service, using aggregated or de-identified information where possible.
- To comply with law and enforce our Terms of Service.
If a Firm turns on automated document reading, we send the selected documents to our document-processing provider only to return the extracted information to the Firm, and we do not permit that provider to keep the documents or use them to train its models.
We do not sell personal information, we do not share it for targeted advertising, and we do not use Client information to train artificial intelligence models.
4. Where documents are stored
Each Firm chooses where uploaded documents are saved: ImmiAce Secure Storage (managed by us), or the Firm’s own Google Drive, Dropbox, Box, pCloud or Microsoft OneDrive account. When a Firm connects its own account, documents are saved in a folder ImmiAce creates there (for example, ImmiAce › Clients › client name), and that provider’s own terms and privacy policy also apply to those files. For Dropbox, ImmiAce uses App Folder access and can reach only the Apps › ImmiAce folder.
We connect to those accounts through the provider’s official authorization process. We never ask for or store the Firm’s storage password. The access tokens we receive are encrypted at rest.
5. Google user data
When a Firm connects Google Drive, ImmiAce requests only the drive.file permission. This lets ImmiAce create folders and files, and access only the files it created or that the Firm opens with ImmiAce. ImmiAce cannot see or change any other file in the Firm’s Drive.
From Google we store only the connection tokens (encrypted) and the IDs and names of the folders and files ImmiAce creates. File contents pass through our servers only while they are being uploaded or retrieved and are not kept there.
We use this access only to save and retrieve the Firm’s case documents in the Service. We do not use Google user data for advertising, we do not sell it, and we do not use it to train artificial intelligence models. We transfer Google user data only as needed to provide or improve user-facing features of the Service, for security, to comply with law, or as part of a merger or sale with notice. Our personnel do not read it except with the Firm’s affirmative consent for specific files, for security purposes, or as required by law.
When a Firm disconnects Google Drive or closes its account, we delete its Google tokens and file references within 30 days. A Firm can also revoke ImmiAce’s access at any time at myaccount.google.com/permissions. The same applies to Dropbox, Box, pCloud and Microsoft connections, which can be revoked in each provider’s account settings.
ImmiAce’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The same limits apply to data we receive from Dropbox, Box, pCloud and Microsoft.
6. How we share information
We share information only as needed to run the Service, with:
- Service providers that host or support ImmiAce under confidentiality and security obligations, including Vercel (hosting), Supabase (database), Backblaze (managed storage), Stripe (payments), our email delivery provider, and, if enabled, our document-processing provider. We will update this list before adding a new provider that handles Client information.
- The storage provider the Firm connects, to save the Firm’s documents there.
- The Firm — information a Client submits through a secure link goes to the Firm that sent it.
- Authorities, when required by law, subpoena or court order, or to protect the rights, safety and security of Users, Clients or the public.
- A successor, if our business is sold or reorganized, subject to this policy.
We do not file anything with USCIS or any government agency. Firms decide what to file.
7. Security
We use encryption in transit (HTTPS), encryption of storage-connection credentials at rest, access controls that separate each Firm’s data, secure links that expire, and activity logging. No system is perfectly secure. If we learn of a security incident affecting Firm or Client information, we will notify the affected Firm without undue delay and no later than 10 days after determining the incident occurred, and will notify others as the law requires.
8. How long we keep information
We keep Firm and Client information while the Firm’s account is active. After an account ends, the Firm has 30 days to export its data; we then delete it from the Service within 90 days after the account ends (and from backups within a further 30 days), except where we must keep records for legal, tax, security or dispute reasons. Files saved in a Firm’s own cloud storage stay there under the Firm’s control; deleting the Firm’s ImmiAce account does not delete them.
9. Your choices and rights
- Users can update account details in the app and opt out of marketing messages at any time.
- A Firm can disconnect its cloud storage, export its data, or ask us to delete its account.
- Depending on where you live, you may have the right to know, access, correct or delete your personal information, or to appeal a decision about a request. Clients should first contact their Firm; others can email us at support@immiace.com. We will verify requests and respond as the law requires.
10. Children
The Service is for businesses and professionals, not children. Firms may enter information about minors who are part of an immigration case (for example, a beneficiary’s children); that information is handled as Client information under this policy and the Firm’s instructions.
11. Location of processing
The Service is operated in the United States, and information is stored and processed in the United States and wherever the Firm’s chosen storage provider keeps data.
12. Changes
We may update this policy. If we make material changes, we will notify Firms by email or in the app at least 30 days before the changes take effect. The effective date above shows when this policy was last updated.
13. Contact us
JNC Investment Group LLC
Attn: ImmiAce Privacy
Orlando, Florida
support@immiace.com