Privacy Policy

1. Who we are and how to contact us

Chuang Legal Office, Inc. (“we,” “us,” or “our”) is a law firm. This policy explains how we collect, use, share, keep, and delete personal information. It covers our website chuangshilaw.com, the online forms linked from it, and our Client Portal. Together we call these the “Services.”

Contact us about privacy: xiao@chuangshilaw.com · HQ 707-707-8964 · Consultation 909-969-6666 · 18645 Gale Ave, Ste 238, City of Industry, CA 91748.

If you are our client, your information is also protected by attorney-client privilege and our duty of confidentiality. This policy adds to those protections. It does not reduce them.

2. The types of data we collect

• Contact information: your name, phone number, and email address. These are required on our forms.
• Information about your legal matter: what you tell us in a form, questionnaire, message, or uploaded document. For an immigration matter, this can include your date of birth, address history, immigration history, travel history, employment, family members, and identity documents.
• USCIS case information: USCIS receipt numbers and the case status that USCIS returns for them (see Section 4).
• Job applications: your resume, work history, and qualifications.
• Technical data: IP address, browser and device type, pages visited, and visit times. Our forms use Cloudflare Turnstile, which checks browser and device signals to stop bots.

What we do not collect through the Services: precise geolocation, your phone’s contacts, or biometric data. We do not ask for financial information or medical information unless your legal matter requires it. In that case we will tell you why and how to send it safely. Please do not send a Social Security number, bank account number, or medical record in a first inquiry.

3. How we use your data

We use your data only to:

• answer your questions and schedule consultations;
• check for conflicts of interest;
• work on legal matters you hire us for;
• send you notices about your matter, such as hearing dates, document requests, and case status updates;
• run and protect the Client Portal and our website;
• review job applications; and
• meet our legal and professional duties.

We do not use your data for advertising or to build marketing profiles. We do not create, use, or share de-identified, anonymized, or pseudonymized versions of your data for any other purpose.

4. USCIS case status information

We use the USCIS Case Status API to check the status of immigration cases for our clients, and for people who ask us to check their case.

• We may collect USCIS receipt numbers or other case-related information only when voluntarily provided by the user for the purpose of retrieving or displaying immigration case status information. This includes receipt numbers in a matter where we represent you.
• Case status information is shown only to you and to the firm staff working on your matter.
• We do not sell USCIS case information or personal information.
• USCIS case information will not be disclosed to third parties except as necessary to provide the requested service or as required by law.
• API credentials are stored securely and are not exposed to users or unauthorized third parties. They are kept on our servers, never in a public web page, and only authorized firm staff can reach them.
• Users may request permanent deletion of their personal information and case-related data (see Section 9).
• Case status comes from USCIS. USCIS keeps the official record, and you can also check your case on the USCIS website.

5. We do not sell your data

No data is sold, rented, or traded for profit or any other monetary transaction. We do not share data for targeted advertising. This has been true for at least the past 12 months.

6. Who we share data with, and how they use it

We share data only with the companies below. Each one may use your data only to provide its service to us. Each one is bound by the terms of this privacy policy and by its contract with us. None of them may sell your data or use it for its own purposes.

• Automattic (WordPress.com, Jetpack, Akismet): hosts our website, receives website form submissions, counts site visits, and filters spam.
• Google (Google Workspace): stores our email, form answers, Client Portal records, and uploaded files.
• Cloudflare (Turnstile): checks that a form is filled in by a person, not a bot.
• Telegram: delivers notices to firm staff. If you agree, it also delivers notices to you or to a group set up for your matter.

We also share data, as part of your legal matter, with government agencies, courts, and opposing parties. We do this only when you direct us to or the law requires it.

Your consent is required for any other use. No third party may use or disclose your information for any other reason without your active consent. This includes de-identified, anonymized, or pseudonymized data. We will share data without your consent only when the law requires it, such as for a valid subpoena or court order.

7. Your sharing choices, and their risks and benefits

• Telegram notices are optional. They are fast and convenient. But everyone in a Telegram group can read the messages, and Telegram stores them on its servers. You can ask us to use only email or phone instead. If you choose that, you may get some notices later.
• Information about other people. Immigration and family forms often ask about your spouse, children, parents, and other relatives. When you give us this information, it also affects them. For example, it may show their immigration status or family history. Please share only what your matter needs, and tell your family members that you are giving it to us. We protect it the same way we protect your own data.
• Limits. Some information is required to handle your legal matter. If you do not give it, we may not be able to help with some tasks.

8. How long we keep data

• Inquiries that do not lead to us representing you: 3 years after our last contact, then permanently deleted.
• Client files (questionnaires, uploads, and case status records): 7 years after the matter closes, then permanently deleted. We keep them longer only if the law or a court order requires it.
• Logs of each USCIS status lookup: no more than 90 days.
• Job applications: 3 years, then permanently deleted.
• Technical data: no more than 12 months.
• Dormant Client Portal accounts: if you do not sign in for 24 months, we turn off your portal access. Your data is then kept only for the periods above.

Backup copies are removed within 90 days after the data is deleted.

9. How to permanently delete your data

1. Email xiao@chuangshilaw.com with the subject “Delete my data,” or call HQ 707-707-8964 · Consultation 909-969-6666.
2. Give your name and the phone number or email you used with us. We will check that the request comes from you.
3. We will confirm the request within 10 days. We will delete your data within 45 days. Backup copies are removed within 90 days.
4. We will also tell our service providers in Section 6 to delete it.

Sometimes the law or our professional rules require us to keep a record. One example is the file of a matter where we represented you. If so, we will tell you what we are keeping and why. We will delete it when the requirement ends. You can also ask us to see or correct your data in the same way.

California residents: you have rights under the California Consumer Privacy Act (CCPA), where it applies. These include the right to know, delete, and correct your data. We will not treat you differently for using these rights.

10. How to close your Client Portal account

Email or call us and ask us to close your Client Portal access. After we confirm it is you, we will turn off your access within 5 business days. Your data is then kept as described in Section 8. If you also want it deleted, follow Section 9.

11. Security and data breaches

We use encrypted (HTTPS) connections and limit access to authorized staff. We block bots and limit how often forms can be sent. We store passwords and keys securely. Clients never get direct access to our file storage. Still, no system is perfectly secure.

If a data breach affects your information, we will notify you without unreasonable delay. The notice will tell you what happened and what data was involved. It will also tell you what we are doing and what steps you can take to protect yourself, such as changing passwords or watching for fraud. We will also notify the authorities, and USCIS if USCIS data is involved, when required.

12. If the firm changes ownership

The firm could merge, be sold, transfer its practice, or close. If so, we will notify you before anything happens to your data. Any new owner must follow this privacy policy, or a policy that protects you at least as well. You may also choose to have us:

• securely delete your data;
• transfer your data or file to you or to a lawyer you choose; or
• give you a copy of your data to download.

13. Changes to this policy and your consent

Before we change this policy, we will post a plain-language summary of what changed at the top of this page. We will also email you if we have your email address.

We will ask for your active consent to the change. For example, we may ask you to check an “I agree” box when you next sign in or send a form, or reply to our email. Until you agree, we will keep handling the data you already gave us under the old policy. If you do not agree, you may close your account and ask us to delete your data.

14. Cookies and links

Our website and its tools may use cookies. You can block or delete cookies in your browser. Some features may not work without them. Our pages may show YouTube videos or link to sites such as Telegram and Google. Those sites follow their own privacy policies.

15. Children

The Services are not meant for children under 13. We do not knowingly collect data online from children under 13. If a legal matter involves a child, we get the child’s information from a parent, guardian, or authorized representative.

16. Language

This policy is also available in Chinese. If the two versions differ, the English version controls.