Privacy Policy

1. Who we are

The EB-2 NIW Platform (the “Service,” “Platform,” “we,” “us,” or “our”) is operated by Oscar Pardo Consulting SLU, doing business as (dba) Oscar's Green Card, a company incorporated in Spain. For the purposes of the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD), Oscar Pardo Consulting SLU is the data controller of the personal data described in this policy.

• Company: Oscar Pardo Consulting SLU
• Tax ID (NIF): B56741572
• Privacy contact and to exercise your rights: oscar@oscarsgreencard.com
• Our full registered postal address is available on request to the contact above or to a supervisory authority.

2. Scope of this policy

This policy explains what personal data we collect when you use the Platform, why we collect it, how we store and protect it, who we share it with, and the rights you have. It applies to all users worldwide. Because our Company is established in Spain and we serve customers in the European Union, the United States, and elsewhere, this policy is written to meet the requirements of the GDPR and, for residents of California, the California Consumer Privacy Act as amended by the CPRA (“CCPA”).

3. The data we collect

Depending on how you use the Platform, we collect the following categories of personal data:

• Account data: your email address and display name, created when you register or sign in with email or Google. If you sign in with Google, we receive your name, email, and profile identifier from Google.
• Identity data: the legal first and last name you enter before generating your petition, and whether you hold a PhD, used to populate your petition documents.
• Petition content and uploaded documents: the files and information you provide to build your petition — for example your CV, academic degrees and transcripts, credential evaluations, publications, awards, press coverage, recommendation letters, professional or business plans, and other supporting evidence, together with the titles, descriptions, contributions, proposed endeavor, and national-importance information you enter. These may contain detailed personal, educational, professional, and immigration-related information about you and about third parties such as your recommenders.
• AI conversation content: the messages you exchange with our in-platform AI assistants.
• Signature record: when you accept our Terms and Conditions, we capture a drawn signature image together with your email and a timestamp, and generate a signed acceptance PDF, as a record of your acceptance.
• Payment data: when you make a purchase, payment is processed by Stripe. We do not receive or store your full card number. We receive a payment confirmation, a Stripe identifier, and the payment date.
• Technical and usage data: your IP address and the date/time you were last active, basic device/browser information, error diagnostics, and aggregate page-view counts. If you enable browser notifications, we store a push-notification token.
• Communications: messages you send us through the contact form, reviews you submit, questions you post, and any email correspondence.
• Waitlist data: if you join our waitlist, we store the email address you provide.

4. Special categories of data

Immigration and professional evidence can sometimes reveal information that the GDPR treats as “special category” data (for example, information from which one’s racial or ethnic origin, religious beliefs, or health could be inferred). We do not ask you to provide special-category data, and we ask that you avoid uploading documents containing it where it is not necessary for your petition. Where you do choose to upload such information, we process it on the basis of your explicit consent, which you provide by uploading the document for the purpose of generating your petition. You may withdraw this consent at any time by deleting the document or your account.

5. Why we use your data and our legal bases

We use your data for the following purposes, on the following legal bases under the GDPR:

• Create and manage your account and provide the Platform and generated documents — performance of a contract (Art. 6(1)(b)).
• Process your uploaded documents and content through our AI providers to produce your draft — performance of a contract; explicit consent for any special-category data (Art. 9(2)(a)).
• Process payments and prevent fraud — contract; legitimate interests; legal obligation.
• Send service emails — performance of a contract.
• Send announcements or marketing emails, which you can opt out of at any time — consent / legitimate interests.
• Maintain security, diagnose errors, prevent abuse, and improve the Platform — legitimate interests (Art. 6(1)(f)).
• Keep a record of your acceptance of our Terms — legitimate interests; legal obligation.
• Respond to your requests, reviews, and questions — legitimate interests; consent.

We do not sell your personal data, and we do not use your uploaded documents or petition content to train artificial-intelligence models.

6. Service providers, recipients, and international transfers

We use carefully selected third-party service providers and technology partners to operate, secure, deliver, and improve the Platform. These providers may process personal data only as necessary to provide their services to us. Where they act as our processors, they process personal data under a data-processing agreement and our documented instructions. Some providers, such as payment providers, may also process certain data as independent controllers where required for fraud prevention, compliance, security, tax, accounting, or legal obligations.

The categories of providers we use include:

• Cloud infrastructure, hosting, database, authentication, file storage, and push-notification providers.
• Payment processors and billing providers.
• AI-processing providers used to generate drafts, summaries, and related outputs from user-provided documents and content.
• Workflow-orchestration providers used to manage multi-step petition-generation processes.
• Email-delivery providers used to send transactional, service, and announcement emails.
• Error-monitoring, diagnostics, security, and performance-monitoring providers.
• Analytics and advertising-measurement providers used to understand aggregate Platform usage and to measure the effectiveness of our advertising (for example, whether an advertisement led to a sign-up).
• Video-hosting and streaming providers used to deliver course and lesson content.
• Professional advisers, legal, tax, accounting, compliance, or other business-service providers, where necessary.
• Public authorities, courts, regulators, law-enforcement bodies, or other parties where disclosure is required by law or necessary to protect our rights, users, or the Platform.

Some of these providers may process personal data outside the European Economic Area, including in the United States, India, and other countries where they or their subprocessors operate. Where required, we rely on appropriate transfer safeguards, such as adequacy decisions, EU-U.S. Data Privacy Framework certification where applicable, Standard Contractual Clauses, and/or equivalent safeguards under applicable data-protection law.

You may contact us to request more information about the categories of recipients with whom we share your personal data.

7. How long we keep your data

We keep your account and petition data for as long as your account is active and for a reasonable period afterwards so you can return to your draft, and to comply with our legal and accounting obligations (in Spain, certain records must be kept for up to six years). You can delete your documents at any time from within the Platform, and you can delete your entire account and its associated data using the in-app account-deletion function or by contacting us. When you delete your account, we remove your case data and uploaded files from our active systems; routine backups are overwritten on a rolling basis.

8. How we protect your data

Data is encrypted in transit (HTTPS/TLS) and at rest by our storage providers. Access to personal data is restricted to the Company and authorised personnel who need it to operate the Platform. Each user can only access their own case; administrative access is limited and logged. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data using industry-standard measures.

9. Your rights

Subject to applicable law, you have the right to access the personal data we hold about you; to rectify inaccurate data; to request erasure; to restrict or object to certain processing; to data portability; and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these rights, email us at oscar@oscarsgreencard.com. We will respond within the timeframes required by law (generally one month under the GDPR).

If you are in the EU/EEA and believe we have not handled your data properly, you may lodge a complaint with your local supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

California residents: you have the right to know what personal information we collect and how we use it, to request deletion, and to not be discriminated against for exercising your rights. We do not sell or share your personal information for cross-context behavioural advertising. To make a request, contact us at the email above.

10. Cookies and tracking

We use cookies and similar technologies that are strictly necessary to keep you signed in, to operate and secure the Platform, and to process payments and prevent fraud. Our payment provider, Stripe, sets its own cookies for these purposes on pages that use its services, such as the checkout and any page that displays payment or instalment options. These strictly necessary technologies do not require your consent.

With your consent, we also use a limited set of optional analytics and advertising-measurement technologies: privacy-friendly, aggregate page-view analytics, and Google advertising tools that let us measure whether one of our advertisements led to a sign-up (conversion measurement). These load only after you accept our cookie banner; if you decline, they are not loaded and you can still use the Platform normally, and you can change your choice at any time. We do not build cross-site behavioural advertising profiles about you, and we do not sell your personal information.

11. Children

The Platform is intended for adults (18 years or older) pursuing their own immigration petition. It is not directed at children, and we do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Platform. The version date at the top reflects the current version.

13. Contact

For any privacy question or to exercise your rights, contact us at oscar@oscarsgreencard.com.