Privacy Policy

Effective date: September 16, 2026. Last updated: September 16, 2026.

Introduction

TheITINapp.com (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Individual Taxpayer Identification Number (ITIN) application assistance services.

As a service handling sensitive tax-related information for individuals from many countries, we understand the critical importance of data protection. We comply with applicable data protection laws, including the GDPR (General Data Protection Regulation) for European users and the CCPA (California Consumer Privacy Act) for California residents.

By using our services, you consent to the data practices described in this policy. If you do not agree with any part of this Privacy Policy, please do not use our services.

Information we collect

Personal information

When you use our ITIN application service, we collect:

• Full legal name (as it appears on your passport)
• Date of birth
• Country of citizenship and tax residency
• Passport number and expiration date
• Foreign address (street, city, country, postal code)
• Contact information (email address, phone number)
• US mailing address (if applicable)
• Parents’ names (if required for your application)

Tax-related information

For ITIN processing, we collect:

• Reason for ITIN application (treaty benefits, US income, etc.)
• Tax treaty country (if applicable)
• Type of US income or business activity
• Previous ITIN applications or rejections
• Supporting tax documents (W-7, 1040-NR, etc.)

Identity documents

We collect copies of:

• Passport (all pages with stamps and visas)
• National identification cards
• Birth certificates (when required)
• Proof of foreign address (utility bills, bank statements)
• Any additional documents required by the IRS

Technical information

We automatically collect:

• IP address and approximate location
• Browser type and version
• Device information (type, operating system)
• Pages visited and time spent on our site
• Referral source (how you found our website)
• Cookie data (see the Cookies and tracking section below)

How we use your information

We use your information for the following purposes.

ITIN application processing

• Prepare and submit your Form W-7 to the IRS
• Verify your identity and eligibility
• Communicate with the IRS on your behalf
• Track your application status

Service delivery

• Provide customer support and respond to inquiries
• Send application updates and notifications
• Process payments for our services
• Maintain records of your application

Legal compliance

• Comply with IRS regulations and requirements
• Respond to legal requests and court orders
• Prevent fraud and illegal activities
• Maintain required tax records

Service improvement

• Analyze usage patterns to improve our services
• Develop new features and offerings
• Conduct internal audits and quality assurance
• Generate anonymized statistics and reports

Data protection and security

We implement industry-standard security measures to protect your personal information.

Technical safeguards

• 256-bit SSL encryption for data transmission
• Encrypted storage of sensitive documents
• Regular security audits and updates
• Firewall protection and intrusion detection

Administrative safeguards

• Limited access on a need-to-know basis
• Employee confidentiality agreements
• Regular security training for staff
• Background checks for employees

Third-party services

We work with trusted third-party services to provide our services.

Payment processors

We use Stripe to process payments. Your card details are handled directly by Stripe and are never stored on our servers. See the Stripe Privacy Policy.

Cloud infrastructure

We use Cloudflare for hosting and database services. Data is stored in secure, encrypted databases with regular backups. See the Cloudflare Privacy Policy.

Analytics and advertising

We use Datafast for privacy-focused analytics to understand how people use our website. This data is anonymized and does not include personal information.

We also run a Google Ads conversion tag (gtag.js) on every page. It tells us which ads lead to applications, and Google may use it to measure and target advertising. See the Google Privacy Policy and how Google uses data from sites that use its services.

Customer support chat

Our website chat is our own. When you start a chat, we store the name, email address and messages you send, so that we can answer you and keep a record of the conversation.

Messages are sent to an AI agent that drafts and sends replies, and our team can take over a conversation at any time. The agent is given your message, your name and email address, and the page you were on. It answers general questions about ITINs and links to our guides; it does not give personal tax advice, and we ask you not to send sensitive documents through the chat. Email [email protected] instead if you’d rather not use it.

Chat transcripts are kept for 2 years and then deleted. We use Cloudflare Turnstile on the first message to block automated abuse; it checks the request, not your identity.

We do not sell, trade, or rent your personal information to third parties. We only share information as necessary to provide our services or as required by law.

International data transfer

As we serve clients from many countries, your information may be transferred to and processed in the United States.

For users in the European Union (EU/EEA)

We transfer data from the EU to the US under appropriate safeguards:

• Standard Contractual Clauses approved by the European Commission
• Your explicit consent for ITIN application processing
• Necessity for the performance of our services contract with you

Data localization

While your data may be processed in the US for ITIN application purposes, we maintain copies in secure cloud servers with geographic redundancy. We comply with local data protection laws in your country of residence where applicable.

By using our services, you acknowledge and consent to the transfer of your information to the United States for processing your ITIN application.

Your rights

Depending on your location, you may have the following rights regarding your personal information.

GDPR rights (European Union)

• Access: request a copy of your personal data
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data (subject to legal requirements)
• Portability: receive your data in a portable format
• Restriction: request limited processing of your data
• Objection: object to certain processing activities
• Automated decision-making: the right not to be subject to automated decisions

CCPA rights (California)

• Know: the right to know what personal information we collect
• Delete: request deletion of your personal information
• Opt-out: opt out of the sale of personal information (we do not sell data)
• Non-discrimination: equal service regardless of your privacy choices

How to exercise your rights

To exercise any of these rights, please contact us:

• Email: [email protected]
• Subject line: “Privacy Rights Request”
• Response time: within 30 days

Cookies and tracking

We use cookies and similar tracking technologies to improve your experience on our website.

Essential cookies

Required for the website to function properly. These cannot be disabled.

• Session management and authentication
• Security tokens and CSRF protection
• Load balancing and server assignment

Functional cookies

Enhance functionality and personalization.

• Language and region preferences
• Chat widget settings
• Form data preservation

Analytics and advertising cookies

Help us understand how visitors use our website, and measure our ads.

• Page views and navigation paths
• Time spent on pages
• Browser and device information
• Traffic sources and campaigns
• Google Ads conversion measurement (gtag.js)

Managing cookies

You can control cookies through your browser settings. However, disabling certain cookies may limit the functionality of our website. For more information about cookies, visit www.allaboutcookies.org.

Data retention

We retain your information for different periods based on the type of data and legal requirements:

After the retention period, we securely delete or anonymize your data using industry-standard methods.

Children’s privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected].

If we discover that we have collected personal information from a child under 18, we will promptly delete such information from our systems.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Updating the “Last updated” date at the top of this policy
• Sending an email notification to registered users
• Displaying a prominent notice on our website

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Data Protection Officer: [email protected]
• Website: theitinapp.com

EU representative: for GDPR matters, EU residents may also contact our EU representative at [email protected].