MigraInfo Pro Data Processing Addendum
Part of the MigraInfo Pro Terms of Service. Effective date: October 13, 2026
This Data Processing Addendum ("DPA") is part of the MigraInfo Pro Terms of Service (the "Terms") between Sonoran Apps LLC ("Sonoran Apps," "we," "us") and the organization that uses MigraInfo Pro (the "Customer," "you"). It governs the personal information in Customer Data that we process on your behalf to provide the Service. Capitalized terms not defined here have the meanings in the Terms.
1. Scope and Roles
- Customer Data has the meaning in the Terms: the information you and your Members put into the Service, or that the Service retrieves for your cases, about your Members, your Clients and the people whose cases you monitor. "Members" are the people you add to your organization; "Clients" are the people whose cases you monitor and may message. Customer Data does not include information we hold for our own purposes: your organization's account and billing records, our business contact with you, and the security, operational and compliance logs we keep to run and protect the Service. We handle those under our Privacy Policy at migrainfo.com/privacy.
- Roles. You decide why and how personal information in Customer Data is processed. We process it only on your behalf and on your documented instructions. Where a U.S. state privacy law applies to that information, we act as your "processor," "service provider," "contractor" or the equivalent role that law defines. Nothing in this DPA means that any particular privacy law applies to you; that depends on where you and your Clients are.
- Restrictions. We process Customer Data only for the limited and specified business purposes described in the Terms and this DPA. We will not sell Customer Data; share it for cross-context behavioral advertising; retain, use or disclose it for any other purpose or outside our direct business relationship with you, except as the law permits; or combine it with personal information we receive from others, except as the law permits. We will tell you if we can no longer meet these restrictions.
2. Details of Processing
| People | Your Members; your Clients and the people whose cases you monitor |
|---|---|
| Data | Member names and email addresses; Client names, phone numbers, email addresses and preferred language; USCIS receipt numbers, A-numbers and, for court lookups, nationality; case statuses, histories and hearing information returned by the agencies; notes, tags, assignments and key dates; consent and opt-out records; message content and delivery status; activity and audit entries |
| Sensitive data | Immigration-related information can be sensitive. The Service collects what case monitoring and client notice need. It is not designed to store highly sensitive information it does not need: Social Security numbers, financial account credentials, payment card numbers, medical or health records, biometric information, or account passwords. Do not enter them |
| Purpose | Monitoring cases, reminders, team coordination, client notifications, reports, billing and support |
| Duration | The term of the Terms plus the retention periods in section 11 |
3. Processor Obligations
- Documented instructions. We process Customer Data only on your documented instructions, which are: the Terms; this DPA; any order form; your configuration and use of the Service's features; and other instructions you and we agree in writing. We may decline an instruction that would violate the law or materially expand the Service unless we agree to it in writing. If the law requires us to process Customer Data differently, we will tell you, unless the law forbids it.
- Personnel. Anyone we authorize to access Customer Data is bound by confidentiality obligations, gets access only where necessary, and is limited by role and operational need (Terms, section 9).
4. Confidentiality and Security
We maintain appropriate technical and organizational measures designed to protect Customer Data against unauthorized access, destruction, loss, alteration or disclosure. Annex A describes them. No security measure is perfect, and we do not promise absolute security. We keep Customer Data confidential as the Terms provide.
5. Subprocessors
You authorize the subprocessors in Annex B. Before adding a materially new subprocessor we give at least 30 days' notice, by email to your organization's owners and/or by updating the list at migrainfo.com/pro/security. You may object within that period on reasonable data-protection grounds. If we cannot resolve a legitimate objection, you may cancel the Service and receive a prorated refund of prepaid fees. We bind each subprocessor to data-protection obligations at least as protective as this DPA and remain responsible for its performance. We do not negotiate individual subprocessor terms with each customer.
6. Data Location and Transfers
- Primary storage and processing. Customer Data is stored and processed on Google Cloud in the United States: the Firestore database in nam5, a U.S. multi-region configuration; server code in the us-central1 region; and files in a U.S. multi-region storage bucket.
- Message delivery. Text messages pass through Twilio and the mobile carriers, and email through Resend and the recipient's mail provider, which route each message to wherever the recipient is and may handle it in transit outside the United States.
- Authentication. Google and Microsoft authenticate your Members on their own global infrastructure and share the Member's name and email address with us.
- Payments. Stripe processes billing details on its own infrastructure under its own privacy policy.
- Support and operations. We operate the Service from the United States; our logs and error reports are stored on Google Cloud in the United States.
We do not promise United States-only processing for the third-party steps above; each provider's own safeguards and terms apply to them.
7. Security Incidents
A "Security Incident" is an unauthorized access to, or loss, alteration or disclosure of, Customer Data processed by Sonoran Apps or its subprocessors. It does not include unsuccessful attempts or events that do not compromise Customer Data, such as failed sign-ins, blocked attacks, port scans, probes or other activity that stops at our or a subprocessor's defenses.
Sonoran Apps will notify Customer without undue delay and no later than 72 hours after becoming aware of a Security Incident affecting Customer Data, unless applicable law requires earlier notice, by email to your organization's owners. The notice describes the nature of the incident, the data and people affected as far as known, what we have done and are doing to contain and remedy it, and a contact; we update it as we learn more. We will cooperate with your investigation and with any notifications you must make. A notice is not an admission of fault.
8. Client Consent and Communications
- You are responsible for determining whether legally sufficient consent exists before the Service texts or emails a Client, for the accuracy of the consent information you and your Members record, and for compliance with the messaging and communications laws that apply to your messages (Terms, section 4).
- We record consent and opt-out information, block messages to Clients without a recorded consent for that channel, process STOP replies and email unsubscribes, and keep the message log.
- You may not circumvent those controls.
9. Individual Rights and Compliance Assistance
- Requests from individuals. You are responsible for responding to a person who asks to access, correct, delete or otherwise exercise rights over their information in Customer Data. The Service lets you view, correct and export Client records and message logs yourself. Where a request cannot be met with those tools, we provide reasonable technical assistance, taking into account the nature of the processing and the Service's features. If a person contacts us directly about Customer Data, we refer them to you unless the law requires otherwise.
- Compliance. We provide reasonable assistance, considering the nature of the processing and the information available to us, with your security assessments, data-protection impact assessments and legally required consultations or inquiries, through our documentation and answers to reasonable questions. We do not perform your legal compliance work.
10. Audits
On reasonable written request, no more than once in any 12-month period, we will provide the information reasonably needed to demonstrate compliance with this DPA: our security documentation, answers to a reasonable security questionnaire, and any certifications or independent reports we hold at the time. We hold no third-party certifications (such as SOC 2 or ISO 27001) today. You agree to rely on that information before requesting any further audit. An on-site or hands-on audit is available only where the law requires it, or where that information proves insufficient after a material, verified compliance concern; it must be reasonable in scope, conducted at a mutually agreed time, not disrupt the Service or expose other customers' confidential information, and is at your expense unless it reveals a material breach of this DPA.
11. Return and Deletion
- While your organization is active, an admin can export all Customer Data from Settings at any time.
- An owner can request deletion of the organization from Settings. We delete it 30 days later unless the request is cancelled in that period.
- When a trial ends without a subscription, we delete the organization's Customer Data 90 days after the trial ends. The owners and admins get an email 14 days before.
- When a paid subscription is cancelled or ends, we keep Customer Data for 90 days so you can export it or reactivate, then delete it. The owners and admins get an email 14 days before.
- Copies in database backups expire within 7 days of deletion from the live database; operational logs and error reports are kept for up to 30 days.
- We keep Customer Data longer only where the law requires.
The Terms (section 12) use the same periods.
12. Government Requests
If we receive a legally binding demand for Customer Data from a government body or in litigation, we will notify you before disclosing unless the law prohibits it, disclose only what the demand legally requires, and challenge or seek to narrow a demand that is overbroad or improper where reasonably appropriate.
13. Order of Precedence
If this DPA conflicts with the Terms on the processing or protection of Customer Data, this DPA governs for that matter. Otherwise the Terms govern. This DPA is written in English; a translation is provided for convenience, and the English version controls if they conflict.
Annex A - Technical and Organizational Security Measures
- Hosting and encryption. Google Cloud (Firebase) in the United States; data is encrypted in transit (TLS) and at rest (Google-managed encryption).
- Organization isolation and access control. Organization-scoped Firestore data is readable only by authorized Members of that organization under the applicable Firestore security rules, which check organization membership, carried on the Member's sign-in token, on every read; the one public exception is an organization's logo, served from Cloud Storage for its sign-up page and emails. Every change goes through our server functions, which check the Member's role (owner, admin, staff, viewer) before writing; no client application can write to the database directly. Clients of an organization cannot read organization data; they see only what the organization sends them and, if invited into the MigraInfo app, the status of that one case.
- Authentication. Members sign in with Google or Microsoft accounts through Firebase Authentication; those providers manage the credentials, and MigraInfo does not receive or store users' authentication passwords. Owners can require that new Members sign in with an email address at the organization's own domains, can set an inactivity sign-out, and can require multi-factor authentication through their own Google Workspace or Microsoft 365 settings. Members can sign out of every device at once.
- Least data. Invite links, case-share links and calendar-feed links are stored only as one-way hashes of their tokens. Message logs do not contain Clients' unsubscribe links. Web error reports carry the page path only, with query strings and tokens removed.
- Resilience. Point-in-time recovery for the database (7 days), a daily backup retained for 7 days, and deletion protection on the database.
- Logging and audit. Organization creation and settings, membership, invitations and roles, branding, terms acceptance, billing and subscription changes, case additions, imports, share links and app links, note deletions, key dates, client records, consents and opt-outs, messages sent, exports, calendar links and deletion requests are written to an audit log that the organization's owners and admins can read.
- Payments. Raw payment-card and bank-account credentials are entered with Stripe and do not pass through or persist on MigraInfo application servers; we keep billing metadata such as Stripe identifiers, invoice references and subscription state.
- Personnel. Production access is limited to authorized personnel using named accounts protected by multi-factor authentication and role-based permissions.
Annex B - Subprocessors and Other Providers
| Provider | Role | Purpose | Data | Location |
|---|---|---|---|---|
| Google LLC (Google Cloud, Firebase) | Subprocessor | Hosting, database, file storage, server functions, authentication, logging, error reporting | All Customer Data | United States |
| Twilio Inc. | Subprocessor | Text messages to Clients | Client phone numbers, message content, delivery status | United States company; messages are routed through carriers wherever the recipient is |
| Resend (Plus Five Five, Inc.) | Subprocessor | Email to Members and Clients | Email addresses, message content, delivery status | United States: Resend's DPA places its primary processing operations there and its documentation keeps account data there; the sending region chosen for a domain controls only where mail is routed from |
| Stripe, Inc. | Independent payment processor | Subscription billing and invoicing | Billing contact and payment details, entered directly with Stripe | United States |
| Microsoft Corporation | Independent identity provider | Sign-in for Members who use Microsoft accounts | Member name and email address | Global |
| Google LLC (Google Sign-In) | Independent identity provider | Sign-in for Members who use Google accounts | Member name and email address | Global |
| Intuition Machines, Inc. (hCaptcha) | Independent provider | Human verification for court lookups made from Members' browsers | Browser and device signals; no Customer Data | United States |