IMMIGRATION ADVOCACY LAW GROUP
Privacy Policy
Effective 10/06/2026
Immigration Advocacy Law Group is a law practice. This policy explains what personal information the Firm holds, how it is used and protected, and the rights available to the individuals it concerns.
1. Scope
This policy applies to this website and to the internal systems the Firm uses to manage and monitor client immigration matters.
Those systems are operated solely for the Firm’s own professional use. They are not products. They are not sold, licensed, or made available to the public, and no member of the public can register for an account.
2. Whose information this concerns
This policy addresses two groups.
- Clients of the Firm. Information relating to a client’s immigration matter is held in the Firm’s internal systems. Clients are not users of those systems, but the information concerns them, and this policy governs its treatment.
- Firm personnel. Attorneys and staff who access those systems in the course of their duties.
3. Information the Firm collects
The Firm limits what it holds to what representation requires.
Relating to clients
- Name
- The receipt number assigned by U.S. Citizenship and Immigration Services to a matter the Firm has filed. The agency treats receipt numbers as Personally Identifiable Information and so does the Firm; section 4 describes their handling in full.
- The alien registration number (A-Number), where the client has one and it appears in the Firm’s records. It is held only to identify the client within the Firm’s file and is never transmitted to the agency through the systems described here.
- The form type associated with that matter
- The case status published by U.S. Citizenship and Immigration Services for that receipt number, together with its associated dates
- Internal notes recorded by Firm personnel concerning the matter
Relating to Firm personnel
- Work name and work email address, as maintained in the Firm’s directory
- A record of activity within the systems, including records accessed, together with date, time, and network address
Information the Firm does not collect
The Firm states these exclusions expressly.
- Location or geolocation data
- Financial or payment information
- Medical or health information
- Genetic information or family health history
- Contacts, photographs, or files from any individual’s device
- Advertising identifiers, and no tracking across other websites
Because the Firm does not collect genetic or family health information, its systems cannot disclose information about a person’s relatives in the manner such data can.
4. Receipt numbers and other client identifiers
U.S. Citizenship and Immigration Services treats case receipt numbers as Personally Identifiable Information. The Firm treats them the same way and applies to them every protection described in this policy.
The Firm extends the same treatment to the two other items that identify a client in its systems: the client’s name and, where held, the alien registration number. In this section, “client identifiers” means those three items.
How the Firm obtains them
A receipt number is issued by the agency when a matter is filed. The Firm obtains receipt numbers from the notices issued in matters it has filed on behalf of its clients, and from clients who provide a notice they have received.
The Firm does not collect receipt numbers from members of the public. No receipt number can be submitted through this website, and the Firm’s internal systems are not accessible outside the Firm.
How they are used
A receipt number is used for a single purpose: to query the official Case Status interface operated by U.S. Citizenship and Immigration Services and obtain the current status of that matter.
The receipt number is the only item transmitted to the agency. No name, no date of birth, no alien registration number, and no other identifying information accompanies the query. The agency returns a status description, which the Firm records against the matter.
Receipt numbers are not used for any other purpose. They are not used for advertising or marketing, are not used to construct profiles of individuals, and are not used to train machine learning models.
How they are stored
Client identifiers are held in the Firm’s case database, on servers located in the United States, and are transmitted only over encrypted connections.
Each client identifier is encrypted by the Firm’s application before it is written to the database, using AES-256-GCM, an authenticated encryption standard. The database, its backups, and any copy made of them therefore contain the identifier only in encrypted form. Any alteration of an encrypted value is detected and the value is rejected rather than read.
The encryption keys are held apart from the database, as protected configuration available only to authorized administrators, with a separate set of keys for each environment. A copy of the keys is kept outside the hosting provider so that the information is not lost if the provider fails. Keys can be replaced without loss of information, and are replaced if their exposure is suspected.
So that a record can be found without decrypting the database, the Firm stores alongside each identifier a keyed one-way code derived from it. The code cannot be reversed into the identifier, and cannot be reproduced without a separate secret key. For receipt numbers, the final four digits are also stored unencrypted, to allow staff to recognize and search for a matter by its ending; the remaining digits stay encrypted.
When the Firm imports a client list from a spreadsheet, the file itself is not kept. Its rows are held in encrypted form only until the import is completed, and are then deleted. An import that is never completed is deleted in full after seven days.
A receipt number cannot be altered once recorded. That restriction is enforced by the database itself rather than left to application rules. Correcting a receipt number entered in error requires superseding the record, so that the history of the matter remains intact.
How they are safeguarded
- Access requires authenticated sign-in through the Firm’s identity provider. Permissions assigned by role are verified on the Firm’s servers for every request; what a screen does or does not display is not relied upon as a control.
- Client identifiers are never written to system logs. Where a receipt number appears in the Firm’s access records, it is masked so that only the final digits remain. Client names and alien registration numbers do not appear in access records at all.
- The agency’s status descriptions sometimes repeat the receipt number. The Firm stores those descriptions with all but the final four digits of the receipt number masked.
- Personnel may export case lists only through the systems themselves, and every export is recorded. An exported file is outside the protections of the systems, and personnel are bound by the Firm’s terms to handle it accordingly.
- Searches are transmitted within the body of a request rather than in a web address, so that a receipt number does not appear in server access records, browser history, or referral headers.
- Responses containing case information are marked not to be cached.
- Credentials for the agency interface are held as protected configuration, are not stored in source code, and are available only to authorized administrators.
Protection against unauthorized access or disclosure
The Firm records every access to a case record, not only every change. The reason is specific. Receipt numbers in certain series are close to sequential, which means a person holding legitimate access could in principle attempt to view matters belonging to clients other than those assigned to them. Without a record of what was read, such an attempt would leave no trace. The Firm’s access records make it detectable.
Those access records cannot be altered or erased by the systems that write them.
Receipt numbers are disclosed to U.S. Citizenship and Immigration Services for the purpose described above. They are not disclosed to any other third party except as representation requires or as law compels. They are never sold and never exchanged for anything of value.
Should a receipt number be exposed without authorization, the Firm will provide notice as described in section 11.
5. Purpose of use
Information is used for a single purpose: to establish the current status of client matters so that the Firm can represent its clients properly.
Immigration determinations frequently carry legal deadlines. A Request for Evidence, for example, must be answered by a date the agency sets. The Firm’s systems monitor case status on a schedule so that a deadline is identified when it arises.
The Firm does not use this information for advertising or marketing, does not use it to construct profiles of individuals, and does not use it to train machine learning models.
6. Disclosure to others
The Firm discloses information to the following recipients, and to no others.
- U.S. Citizenship and Immigration Services. The Firm submits a receipt number to the agency’s official Case Status interface and receives the status of that matter in return. No client name and no other client information is transmitted to the agency through this interface.
- Microsoft Corporation. Provides the identity service through which Firm personnel sign in, and verifies that a person signing in is an employee of the Firm. Microsoft receives no client information.
- Railway Corporation. Provides the hosting on which the Firm’s systems operate, and stores data on the Firm’s behalf on servers located in the United States. Client identifiers reach Railway’s storage only in encrypted form, as described in section 4. Railway has no right to access or use the information for any purpose of its own.
These are the only third parties to which the Firm discloses this information. Should the Firm engage a different provider, this policy will be amended to name it, and individuals will be notified in accordance with section 13.
Each provider is bound by contract to the protections set out in this policy. A provider may use information only to deliver its service to the Firm. No provider may use, disclose, or share that information for any other reason. This restriction applies equally to information that has been de-identified, anonymized, or pseudonymized: no third party may use or disclose such information for any purpose without the active consent of the individual concerned.
No sale of personal information
The Firm does not sell personal information and has never done so. It does not sell personal information for money, and it does not exchange personal information for any other thing of value. The Firm does not provide personal information to marketers, data brokers, advertisers, or commercial partners.
Disclosures in the course of representation
Separately from the systems described above, the Firm may disclose information as representation requires, such as in a filing with a government agency, or where law or court order compels disclosure. The Firm will notify the client where it is permitted to do so.
7. Choices available to clients
Because clients are not users of the Firm’s internal systems, no in-application consent is requested of them. Information is held as an incident of the Firm’s representation.
A client may instruct the Firm at any time to discontinue monitoring a particular matter. The Firm notes the consequence: monitoring will cease, the Firm will no longer receive automatic notice of a change in that matter, and a deadline may therefore be identified later than it otherwise would be. The benefit of monitoring is earlier notice. Its limitation is that agency case status is at times delayed or incomplete, and for that reason the Firm verifies status through additional means.
8. Retention
Client information is retained for the duration of the representation, and thereafter for the period required of client files by the Georgia Rules of Professional Conduct and by any other law that applies to the matter. Once that period has elapsed, the information is securely destroyed.
Within the case-monitoring system, a matter is retained for five years after the Firm closes it, unless the rules above require a longer period for that matter. Monitoring of a matter ends when the Firm closes it. At the end of that period the matter, its status history, and the client identifiers associated with it are deleted from the system automatically, and the deletion is recorded without the client’s name or receipt number. Deleted information remains in the system’s encrypted backups only until those backups expire, no more than [N] days later.
A client may ask the Firm at any time how long their file will be kept and the date on which it becomes eligible for destruction. The Firm will answer in writing.
Personnel accounts are removed upon separation from the Firm. An account that remains unused for twelve months is disabled. Records of activity within the Firm’s systems are retained for a defined internal period and are then deleted.
9. Deletion of information
An individual may request that the Firm permanently delete the information it holds concerning them. Requests may be sent to info@htlweb.com or to the address below. No reason need be given and no form is required.
The Firm will acknowledge a request within ten business days and complete deletion within thirty calendar days. Copies held in encrypted backups are removed as those backups expire, as described in section 8.
Within the case-monitoring system, a deletion removes every matter held for the individual, the status history of each, and the individual’s name and alien registration number. It is carried out by an administrator and recorded in the Firm’s access records without the individual’s name or receipt number, so that the record of the deletion does not itself retain what was deleted.
One limitation applies. Where law or the professional rules governing attorneys require the Firm to retain a portion of a client file for a prescribed period, that portion cannot be deleted until the period expires. Where this applies, the Firm will identify precisely what must be retained, the reason, and the date on which it may be deleted. All information not subject to that requirement is deleted within the thirty days.
Firm personnel may close an account by request to an administrator; accounts are closed automatically upon separation.
10. California residents
Residents of California hold rights under the California Consumer Privacy Act to know what personal information the Firm holds, to obtain a copy of it, to request its deletion, and to request its correction. They also hold the right not to receive different treatment for exercising those rights.
The Firm does not sell personal information and does not share personal information for cross-context behavioral advertising. There is accordingly no opt-out to exercise. To exercise any right described here, contact the Firm at info@htlweb.com.
11. Notification of a data breach
Should information concerning an individual be exposed without authorization, the Firm will notify that individual directly, by email or by mail, without unreasonable delay.
The notice will state what information was involved, when the exposure occurred, what the Firm has done in response, and what steps the individual may take. Where any action on the individual’s part would be useful, the notice will state precisely what it is. The Firm will also notify the relevant authorities where law requires.
12. Change of ownership
Should the Firm merge, be acquired, or cease practice, information will be handled in one of the following ways.
- The successor adopts this policy, affording protections no less strong than those described here. The Firm will provide written notice before the change takes effect.
- Alternatively, at the individual’s direction, the Firm will securely destroy the information, or transmit it to the individual or to another attorney of their choosing. A copy in a usable format will be provided on request.
The Firm will notify individuals of any change in ownership. The Firm will not transfer information to a successor that has not accepted these protections.
13. Changes to this policy
The amended policy will be published here bearing a new effective date.
Contact
Immigration Advocacy Law Group
6855 Jimmy Carter Blvd #2150
Norcross, GA 30071
info@htlweb.com
(770) 650-7200
