Your documents stay between you, us, and the IRS.

We only ask for what the IRS or our service requires. Depending on the stage of your case this includes:

• Identity details: legal name, date and place of birth, citizenship, foreign and U.S. addresses.
• Passport image and, where applicable, visa, entry stamps, or a national ID used as secondary evidence.
• Reason-for-ITIN evidence: U.S. tax return, withholding statements, LLC or platform records, bank letters.
• Contact details and the messages you exchange with our support team.
• Video-call recordings of the CAA verification session, which the IRS requires us to keep on file.
• Technical data: IP address, device type, pages viewed, referral source, and cookie identifiers.

Card numbers never reach our servers. Payment is handled by Stripe, and we receive only a confirmation, the last four digits, and the billing name.

• To assess eligibility, prepare Form W-7, certify your identity documents, and mail the package to the IRS.
• To meet the record-keeping and audit duties the IRS imposes on Certifying Acceptance Agents.
• To send case updates, appointment reminders, and forward IRS correspondence such as the CP565 notice.
• To take payment, issue receipts, and handle refunds.
• To keep the site secure, detect fraud, and understand which pages help applicants most.

We do not sell or rent personal information. Data leaves our systems only in these cases:

• The IRS ITIN Operation, which receives your W-7 package and certificate of accuracy.
• Service providers that run our infrastructure: cloud hosting, email delivery, encrypted file storage, video conferencing, and Stripe for payments. Each is bound by a contract limiting use to our instructions.
• Postal carriers, who receive only the name and address needed to deliver your package.
• Government authorities or courts when a valid legal request requires disclosure.

The site sets a small number of cookies to remember preferences, keep checkout sessions working, and measure traffic in aggregate. You can block cookies in your browser; the application form and checkout may then not function. We do not use cookies for cross-site advertising.

Retention follows the purpose the data was collected for:

• CAA case files, including document copies and verification recordings: at least 3 years after the IRS decision, as required for CAA compliance reviews.
• Payment and invoice records: 7 years for tax and accounting purposes.
• Support correspondence: 2 years after the last message.
• Analytics data: 14 months, then deleted or anonymised.

Enquiries that never become a paid case are deleted 90 days after the last contact.

Documents are transferred over TLS, stored encrypted at rest, and accessible only to staff working on your case under individual logins with two-factor authentication. Verification calls take place on a dedicated, access-controlled account. No method is perfect; if we learn of a breach affecting your data we will notify you without undue delay.

Our team and servers are located in the United States. If you apply from outside the U.S., your information is transferred to and processed in the U.S. in order to deliver the service you requested. Where a stricter law applies to you, such as the GDPR or UK GDPR, we rely on your request for the service and contractual safeguards with our providers as the basis for that transfer.

You can ask us at any time to:

• Show you the personal information we hold about you.
• Correct details that are wrong or out of date.
• Delete information we are not legally required to keep.
• Stop marketing messages, which are opt-in only and never contain case details.

Because IRS rules oblige us to retain CAA case files for a fixed period, deletion requests for submitted cases are fulfilled once that period ends. We answer every request within 30 days.

We prepare ITIN applications for dependents and children only through a parent or legal guardian, who supplies the information and consents on the child's behalf. We do not knowingly collect information directly from anyone under 18.

We may revise this policy as our services or the law change; the date at the top shows the current version. Questions, access requests, or complaints go to support@itin.expert or by post to the address on this page.