ITINNumber.io

Privacy Policy

Last updated: November 7, 2026

ITINNumber.io (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. Please read this policy carefully — if you do not agree with its terms, do not access our services.

1. Information we collect

We collect information you provide directly and information collected automatically.

Information you provide

  • Contact details (name, email, phone, country)
  • Applicant details for you and each family member on your order (full legal name, name as on the passport, date and place of birth, country of citizenship and residence, foreign and U.S. addresses, foreign tax identification number, U.S. visa details, and any existing ITIN)
  • Identity and supporting documents you upload (passport scans, national ID or birth certificates, visas, tax returns, exception documents such as bank or withholding-agent letters, and IRS notices)
  • Recordings of your CAA video verification call, in which our Certifying Acceptance Agent examines your original documents and confirms your identity
  • Information about why you need an ITIN (your reason for applying, tax return or exception)
  • Communication content (messages you send via our forms, email, or other channels)
  • Payment-related metadata such as the amount, date and Razorpay payment reference (card details are entered on Razorpay’s checkout and never reach us)

Information collected automatically

  • Device and connection information (IP address, browser type, operating system, referring URL)
  • Usage data (pages visited, time on page, click events) via analytics tools, only if you accept analytics cookies
  • Marketing attribution data (UTM parameters, landing-page URL, referrer)

2. How we use your information

We use the information we collect to:

  • Provide the ITIN application and renewal services you request
  • Verify your identity and documents and certify copies as an IRS Certifying Acceptance Agent, and keep the records the IRS requires acceptance agents to keep
  • Communicate with you about your case and respond to inquiries
  • If you start an application but don’t finish it, send up to five reminder emails over two weeks using the contact details from its first step. Every reminder has an unsubscribe link, and they stop as soon as you submit the application
  • Process payments and issue invoices or receipts
  • Improve our website, services, and user experience
  • Detect, prevent, and address technical and security issues
  • Comply with applicable laws and regulations

We do not sell or rent your personal information to third parties. We do not use your information for unrelated marketing purposes.

3. Information sharing

We may share your information with:

  • Service providers: hosting (Hostinger), email (Zoho Mail), payment processing (Razorpay — card details are entered on Razorpay’s checkout and never reach us — or PayPal, if you choose to pay with PayPal). These providers receive only the information necessary to perform their function.
  • The IRS: When you engage our ITIN service, we submit your Form W-7, certified copies of your documents, our Certificate of Accuracy and your tax return or exception documents to the U.S. Internal Revenue Service. As a Certifying Acceptance Agent we must also make our application records available to the IRS if it reviews our work.
  • Tax return preparers: For the ITIN Complete package, the enrolled agent or CPA who prepares your federal tax return receives the information needed for that return.
  • Legal compliance: We may disclose information if required by law, court order, or government request.
  • Business transfers: If we are acquired or merged, your information may be transferred to the successor entity. We will notify you of any such change.

4. Cookies and tracking

We do not use analytics or advertising cookies on this website.

Some content is provided by others and loads only when you choose it: blog videos play through YouTube’s privacy-enhanced mode after you press Play, and messaging us on WhatsApp is handled by WhatsApp. You can also block or delete cookies in your browser settings.

5. Data retention

We retain your information for as long as your account is active and for a reasonable period afterward to satisfy legal, tax, and business obligations. Specifically:

  • Lead inquiries: 24 months from last contact
  • ITIN application records (Form W-7, document scans and certified copies, video verification recordings and our Certificate of Accuracy): 3 years from the date we file your application, because the IRS requires Certifying Acceptance Agents to keep them for that period. We then delete them
  • Customer account, order, invoice and payment records: 7 years (U.S. tax law)
  • Email communications: 3 years
  • Analytics data: per provider settings, typically 14–26 months

6. Your rights

Depending on your jurisdiction (EU/UK GDPR, California CCPA, etc.), you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your information (subject to legal retention requirements, including the IRS’s 3-year record-keeping rule for acceptance agents)
  • Object to or restrict certain processing
  • Receive a copy of your data in a portable format
  • Withdraw consent for processing where consent is the legal basis

To exercise these rights, email us at support@itinnumber.io. We will respond within 30 days.

7. Security

We implement reasonable technical and organizational measures to protect your information, including TLS encryption for data in transit, hashed passwords (bcrypt), session-cookie security flags, rate limiting, and access controls. Uploaded documents and verification recordings are kept in private storage that only authorized team members can open, and are never published or sent by unencrypted email by us. However, no method of transmission or storage is perfectly secure — we cannot guarantee absolute security.

8. Where your information is stored and international transfers

We are headquartered in India. Our website, application database and the files you upload are hosted on a server in Mumbai, India, provided by Hostinger, and backups are kept within that hosting environment. Our email is provided by Zoho Mail from its India data center.

Some of our service providers process information in other countries — for example Razorpay (India) and PayPal for payments. When your information is processed outside your country of residence, it may be subject to different data protection laws; we only use providers that protect it under their own privacy and security commitments.

9. Children’s privacy

Our services are not directed to individuals under 18, and only adults can place an order. When a parent or guardian applies for an ITIN for a dependent child, we collect the child’s details and documents from that parent or guardian, use them only for the child’s application, and protect and retain them in the same way as the adult applicant’s. If you believe a child has provided us with information directly, please contact us.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new “Last updated” date. Material changes will be communicated by email to active customers.

11. Contact us

Questions about this Privacy Policy? Email support@itinnumber.io.