Privacy Policy

1. Who we are

ViRein is an immigration tools application published by Rathee Law Firm P.C., a New York professional corporation located at 501 Fifth Avenue, Suite 1408, New York, NY 10017. In this Policy, "we," "us," and "ViRein" refer to Rathee Law Firm P.C. and its ViRein product. ViRein is distributed on the Apple App Store and Google Play, and on the web at virein.app and getvirein.com.

2. What information we collect

We collect only the categories of information described below.

• Information you provide: name, email address, phone number, and free-text questions or case details you choose to send us.
• USCIS receipt numbers you enter to look up case status. Receipt numbers are sent to the USCIS Case Status API for the sole purpose of returning a status, and are not stored on our servers in association with your identity.
• Device and usage information collected through Google Analytics 4: pages viewed, time on page, approximate region (derived from IP), device type, and referral source. We do not collect precise geolocation.
• Push-notification tokens, only if you opt in to push notifications.
• Account information, only if you create an account or are invited to our client portal at app.ratheelawfirm.com.

We do not knowingly collect information from children under 13. The app is rated 4+ but is intended for adults navigating immigration matters.

3. How we use information

We use the information we collect for these purposes only:

• To respond to your inquiry and provide the tools you request.
• To look up the case status you ask for, by transmitting your USCIS receipt number to the USCIS Case Status API and showing you the response.
• To improve the application, in aggregate and de-identified form. We may use de-identified, non-re-identifiable analytics to understand which pages and tools are most useful. De-identified data is not associated with any user and is treated as non-personal.
• To send push notifications you have opted into (for example, visa-bulletin updates).
• To meet legal, regulatory, and bar-rule obligations.

We do not use your information for behavioral advertising and do not allow our analytics provider to do so.

4. Sale of personal information

We do not sell your personal information, and we have not sold personal information in the preceding 12 months. We do not share personal information for cross-context behavioral advertising.

5. Third parties we share information with

We share information only with the third parties listed below, and only to the extent each of them needs to perform a service for us. Each is contractually bound by a written data processing agreement or equivalent terms requiring them to protect your information, process it only on our instructions, and adhere to standards no less protective than this Policy.

• USCIS (via the USCIS Torch Case Status API) — receives the receipt numbers you submit, in order to return case status. Receipt numbers are not associated with your name, email, or device on our servers.
• Google Analytics 4 — receives de-identified usage data. IP anonymization is enabled.
• Vercel — hosts the application and processes request logs incidental to delivering the service.
• Apple and Google — receive push-notification tokens (only if you opt in) so that we can send notifications.
• Cal.com — schedules consultations you request.
• ImmigrationOS / app.ratheelawfirm.com — our case management system, used only if you become a client.

We do not permit any of these third parties to use your information for their own purposes. Any new use of your information by a third party requires your active, affirmative consent. If we ever need to add a new category of recipient, we will update this Policy and seek your active consent before sharing.

We may also disclose information if required by law, valid legal process, or to protect the rights, property, or safety of any person.

6. Impact of data sharing

Data sharing is limited to what is needed to provide the function you request. For example, when you look up case status, your receipt number leaves our environment and is sent to USCIS. When you opt in to push notifications, your device token is sent to Apple or Google. We do not transfer information to data brokers, advertisers, or analytics partners that profile individual users. The categories of information we share, the recipients, and the purposes are limited to those listed in Section 5.

7. Attorney-client privilege

Submitting an inquiry through ViRein, by itself, does not create an attorney-client relationship. An attorney-client relationship is formed only after a written engagement letter is signed. Information you share before that point is held in confidence to the extent permitted by Rule 1.18 of the New York Rules of Professional Conduct.

8. Cookies and tracking

The web version of ViRein uses cookies for two purposes only: (a) analytics through Google Analytics 4, and (b) remembering your language preference. We do not use advertising cookies. You can disable analytics cookies through your browser, the Google Analytics opt-out add-on, or by emailing us. The mobile app does not set cookies.

9. Data retention and dormancy

We keep your information only as long as we need it.

• Inquiries and free-text submissions — kept for up to 24 months from your last interaction with us, unless you have an open matter with the firm.
• Client matter files — kept for 7 years after the matter closes, in accordance with New York bar rules.
• Analytics data — retained for 14 months in Google Analytics 4 and then automatically purged.
• Push tokens — kept until you opt out or uninstall the app, then purged within 30 days.
• Account dormancy — accounts inactive for 24 consecutive months are flagged for deletion. We notify you at the email on file 30 days before deletion. If you do not respond, the account and associated personal information are permanently deleted.

10. Your rights and how to delete your data

You have the right to access, correct, port, and permanently delete the personal information we hold about you. Residents of California have the additional rights described in the California Consumer Privacy Act (CCPA / CPRA), including the right to opt out of sale or sharing of personal information (we do neither), and the right to limit the use of sensitive personal information.

How to permanently delete your data:

• In-app deletion: open Settings in the app to clear your saved data from your device and find a one-tap link to request permanent deletion of your server-side records.
• By email: send a request from the email address associated with your account to privacy@ratheelawfirm.com. We will verify your request and complete permanent deletion within 30 days.
• By mail: Rathee Law Firm P.C., Attn: Privacy, 501 Fifth Avenue, Suite 1408, New York, NY 10017.

Deletion removes your information from our active systems within 30 days. Encrypted backups are overwritten on a 90-day rolling cycle, after which deletion is final and irreversible. Information we are required to retain for legal, regulatory, or bar-rule reasons (for example, conflict-check records or files for closed client matters within the 7-year retention window) is segregated and not used for any other purpose.

We do not charge a fee for deletion requests and will not retaliate for the exercise of your privacy rights. If you would like to close your account without permanently deleting your historical records, mention that in your email or mailed request.

11. Security and breach notification

We use administrative, technical, and physical safeguards designed to protect your information, including TLS encryption in transit, encryption at rest for sensitive fields, role-based access control, and regular backups. No system can be guaranteed perfectly secure.

If we become aware of a breach that compromises the confidentiality, integrity, or availability of your personal information, we will notify affected users and the appropriate authorities without unreasonable delay, and in any event within 72 hours of discovery where required by applicable law (including New York General Business Law § 899-aa, the California CCPA, and, for European Union residents, GDPR Article 33). The notification will describe the nature of the incident, the categories of information involved, the steps we are taking, and what you can do to protect yourself.

12. Successor companies and ownership changes

If Rathee Law Firm P.C. or ViRein is merged, acquired, reorganized, or sold (in whole or in part), or its assets are transferred, your information may be transferred to the successor entity. Any successor entity will be required to honor this Privacy Policy with respect to information collected before the transfer, or to provide notice and obtain your active, affirmative consent before applying a materially different policy. We will notify you by email and in-app banner at least 30 days before any change of control that affects how your information is handled, and you will have the opportunity to delete your data before the transfer takes effect.

13. Changes to this Policy

We may update this Policy from time to time. For non-material changes (typo fixes, clarifications, new contact information), we will update the "Last updated" date at the top of this page. For material changes — including any change to the categories of information we collect, how we use them, or who we share them with — we will:

• post a plain-language summary of the change at the top of this page,
• email account holders at the address on file at least 30 days before the change takes effect, and
• ask you to actively, affirmatively accept the new Policy on next sign-in. We do not treat continued use as acceptance of material changes. If you do not accept, you may close your account and request deletion under Section 10.

14. International users

ViRein is operated from the United States. If you access ViRein from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those of your country. Where required (for example, under the GDPR), we rely on appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

15. Accessibility

We are committed to keeping ViRein and this Policy accessible. This page is designed to meet WCAG 2.1 AA contrast and readability guidelines. If you have trouble accessing any part of ViRein or this Policy, please email privacy@ratheelawfirm.com and we will provide the information in an alternate format.

16. Contact

Privacy questions, deletion requests, or notice of a suspected breach:

• Email: privacy@ratheelawfirm.com
• Phone: (917) 803-1117
• Mail: Rathee Law Firm P.C., Attn: Privacy, 501 Fifth Avenue, Suite 1408, New York, NY 10017