1. Who controls your data

VantarGroup LLC, trading as ExpatPapers. Contact support@expatpapers.com.

2. What we collect

When you request a quote: your name, email address, destination country, application type, appointment date, delivery preference, where you are in the process, and anything you choose to write in the notes field.

When you become a customer: the details required to submit on your behalf, and a delivery address.

Automatically: your approximate country and browser user agent, recorded with the order for fraud prevention. This site sets no advertising or tracking cookies.

3. Criminal history record information

An FBI Identity History Summary may contain criminal history record information. We treat it as the most sensitive category of data we handle.

• We never ask you to email us the report or its contents. When we need it, you get a secure upload link unique to your order
• We never obtain it for you and never receive it from a channeler — federal rules send it only to you. It reaches us only if you pass it to us for apostille
• What you upload is stored encrypted in Cloudflare R2, is not reachable by any public URL, and can only be retrieved by us with an authenticated request
• Automatic deletion is enforced by the storage itself, not by us remembering: an R2 lifecycle rule removes uploaded documents 30 days after upload
• It is never used for analytics, marketing, model training, or any purpose other than completing your order
• It is never shared with anyone except the government offices and courier required to complete your order

4. Why we can hold it

To perform the contract you have entered into with us. Where consent is the basis, you can withdraw it at any time by emailing us.

5. Who else sees your data

• The U.S. Department of State and, where relevant, a state Secretary of State
• Our courier in Washington, and the shipping carrier
• A sworn or certified translator, only where you order a translation
• Cloudflare, which hosts this site, stores order records, and holds uploaded documents encrypted at rest
• Amazon Web Services, which sends our email

We do not sell your data, and we do not share it for advertising.

6. How long we keep things

• Report contents and scans: deleted within 30 days of completion
• Order records (name, email, destination, dates, amount): kept for seven years where required for tax and accounting
• Quote requests that do not become orders: deleted within 12 months

7. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it where we have no legal obligation to keep it, and object to processing. Email us and we will respond within 30 days. If you are in the EEA or UK, you may also complain to your local data protection authority.

8. Security

Data is transmitted over TLS, stored encrypted at rest, and access is limited to the people who need it to complete your order, with access logged.

9. International transfers

We are a U.S. company and your data is processed in the United States. Where a translation or delivery is arranged abroad, only the minimum necessary is shared.

10. Changes

We will update the date at the top of this page when this policy changes, and will tell active customers directly if the change is material.