Privacy Policy

1. Who we are

The data controller is:

For any privacy question, data request, or complaint, contact us at [email protected].

2. When this Privacy Policy applies

This Privacy Policy applies when you:

• visit our website;
• create an account;
• complete a pre-check, intake form, order form, annual questionnaire, support form, or compliance questionnaire;
• purchase, renew, cancel, or use our services;
• ask us to support, review, transfer, or onboard an existing LLC;
• upload identity, company, tax, banking, address, mail, provider, or compliance documents;
• approve, sign, or submit documents, forms, authorizations, filings, or instructions;
• request a refund, cancellation, transition, handover, dispute review, or chargeback response;
• communicate with us by email, dashboard, form, chat, call, meeting, or another channel;
• use address, registered agent, mail forwarding, document storage, signing, or compliance workflows connected to our service.

3. Personal data we collect

We collect different types of personal data depending on how you use the service.

3.1 Account data

This may include your name, email address, password hash, account settings, language preference, login records, account status, authentication data, security data, two-factor authentication status, and user permissions.

We do not store your plain-text password.

3.2 Contact and communication data

This may include your email address, phone number if provided, billing contact, support messages, onboarding messages, internal service notes, attachments, correspondence, provider messages, meeting notes, and communication history.

If we record calls or meetings, we will do so only where permitted by law and, where required, with notice or consent.

3.3 Order and service data

This may include your selected package, selected state, selected address or registered agent option, billing status, renewal status, order number, checkout data, service status, formation progress, document workflow status, first compliance cycle status, annual compliance package year, filing-year logic, renewal cycle, cancellation requests, refund requests, transition requests, and handover status.

3.4 Formation and company data

This may include:

• proposed LLC name;
• approved LLC name;
• state of formation;
• filing date;
• effective date;
• state document number, filing ID, or other state reference number;
• EIN status;
• EIN, where provided or obtained;
• principal office address;
• mailing address;
• registered agent information;
• business address information;
• organizer, member, manager, authorized person, or signatory information;
• business activity;
• NAICS code or activity code, where used;
• company documents, certificates, resolutions, operating agreements, consents, authorizations, filings, receipts, and related records.

Some formation and company data may become public record when submitted to state authorities or other official filing systems.

3.5 Existing LLC onboarding and transfer data

If you already have a U.S. LLC and ask us to support, review, transfer, or onboard it, we may collect information and documents about the existing company. This may include:

• articles of organization, certificates, state filings, annual reports, amendments, certificates of status, receipts, and state account references;
• current registered agent, registered office, principal office, mailing address, business address, and mail-service details;
• EIN confirmation letters, IRS notices, 147C letters, tax identification records, or other tax-reference documents where provided;
• prior Form 5472 / pro forma 1120 filing copies, submission evidence, fax confirmations, professional-preparer records, or related tax workflow evidence where provided;
• prior FBAR screening or filing evidence where provided;
• ownership, authority, signing, transfer, resignation, change-of-agent, or provider-handover documents;
• open compliance issues, missed-deadline information, dissolution or reinstatement records, provider invoices, and renewal status.

We may use this information to assess whether the existing LLC falls within our supported scope, to organize the onboarding workflow, and to identify whether external professional review may be needed.

3.6 Identity, KYC, verification, and risk-screening data

We may collect data needed to verify identity, authority, ownership, business purpose, and service eligibility. This may include:

• passport, national ID card, residence card, driver's license, or similar identity document;
• identity-document number;
• issuing country;
• issue date and expiry date;
• date of birth;
• nationality or citizenship;
• photograph shown on the identity document;
• proof of residential address;
• utility bill, bank statement, government letter, or similar proof-of-address document;
• company registry extract, certificate of incorporation, certificate of good standing, articles, bylaws, operating agreement, shareholder register, director register, incumbency certificate, ownership chart, board resolution, power of attorney, or similar authority document;
• beneficial ownership information;
• sanctions, restricted-party, fraud, payment-risk, and compliance-screening results;
• source-of-funds or business-purpose information where reasonably required.

We do not intentionally collect biometric data for the purpose of uniquely identifying you unless this is clearly stated in a separate notice or required by a verification provider.

3.7 Tax, compliance, and annual questionnaire data

For first compliance cycle support, annual compliance-preparation workflows, existing LLC support, and related screening, we may collect information such as:

• tax year and filing year;
• annual compliance package year, renewal cycle, compliance calendar, and deadline-tracking status;
• LLC legal name;
• EIN;
• owner name and address;
• country of citizenship;
• country of tax residence or organization;
• capital contributions;
• distributions;
• owner payments;
• related-party transactions;
• loans, reimbursements, management fees, service charges, royalties, licensing arrangements, sales, purchases, rents, interest, or other reportable transfers;
• business activity;
• U.S. customers;
• U.S. office, employees, contractors, inventory, warehouse, workdays, or other U.S. activity;
• state-specific business activity;
• sales tax, payroll, licensing, or nexus screening responses;
• Form 5472 / pro forma 1120 workflow information;
• FBAR screening responses;
• foreign financial account information if FBAR-related support is requested or triggered;
• CPA referral or professional handoff status;
• signed forms, filing copies, receipts, submission evidence, fax confirmations, confirmation numbers, BSA identifiers, and compliance archive records.

We use this information to support administrative and compliance-preparation workflows. We do not use it to provide personalized tax advice unless separately agreed through a qualified professional.

3.8 Payment, billing, refund, and dispute data

Payments are processed by our third-party payment processor.

We may receive and store limited payment-related information such as payment status, payment method type, last four digits of a payment card where provided by the processor, billing name, billing email, billing address, invoices, receipts, refund status, chargeback records, and payment-dispute records.

We may also keep cancellation reasons, refund calculations, work-stage records, provider-cost records, non-refundable cost records, renewal records, transition or handover records, dispute notes, customer approvals, customer instructions, and evidence needed to respond to refund requests, chargebacks, complaints, or legal claims.

We do not store full card numbers or full card security codes.

3.9 Address, mail, and forwarding data

If you use registered agent, business address, virtual office, mail scanning, mail forwarding, package handling, or related services, we or our providers may process:

• address-service application data;
• mail recipient name;
• forwarding address;
• sender information;
• envelope information;
• tracking numbers;
• scanned mail images;
• mail contents where scanning or opening is requested, authorized, or required;
• forwarding instructions;
• postage, courier, storage, disposal, and delivery records;
• USPS Form 1583 or similar authorization documents, where applicable;
• provider verification records;
• address-formatting records;
• package acceptance, refusal, return, forwarding, storage, or disposal records;
• provider communication records and mail handling history.

Mail and address services may be subject to separate provider terms and legal requirements.

3.10 Technical, security, usage, and audit data

We may collect IP address, browser type, device type, operating system, referring page, pages visited, time and date of access, login attempts, session identifiers, cookie identifiers, security logs, error logs, audit logs, workflow timestamps, dashboard actions, uploaded-document metadata, email approvals, dashboard approvals, digital-signature records, submission timestamps, and actions taken in the dashboard.

We use this data to operate, secure, debug, audit, evidence, and improve the website, platform, workflows, and service.

4. Cookies and similar technologies

We use essential cookies and similar technologies needed to operate the website and platform. These may include:

• session cookies;
• login cookies;
• security cookies;
• CSRF-protection cookies;
• language-preference cookies;
• consent-preference cookies (the usll_consent cookie stores your analytics choice for 12 months, for usllclight.com and its subdomains);
• referral cookies (the usll_discount cookie stores a referral discount code for 90 days so your discount is applied at checkout);
• first-party attribution cookies (the usll_acq cookie stores, for 90 days, which ad or campaign link first brought you to our site and the most recent paid ad click — including Google click identifiers and UTM parameters from the link you clicked — as part of our commercial records of how an order originated; this data stays with us and is never shared with Google or any advertising platform).

4.1 Optional analytics (Google Analytics 4)

With your consent where required, we use Google Analytics 4, a web-analytics service provided by Google Ireland Limited (Ireland), with Google LLC (USA) as sub-processor, to understand how visitors use our public website and — once we run search ads — to measure which of our ads lead to sign-ups. We do not use Google Signals and we do not use ads personalization: the ads-personalization consent signal is permanently set to "denied" in our integration.

• If you are visiting from the EEA or the UK, Google Analytics stays off unless you allow it via the cookie banner (legal basis: consent, Art. 6(1)(a) GDPR / UK GDPR).
• Elsewhere, Google Analytics runs on the basis of our legitimate interest in improving the website and measuring our advertising; you can opt out at any time.
• When active, Google Analytics sets first-party _ga cookies (_ga and _ga_*, each stored for up to 24 months).
• The same measurement also covers the checkout completion page on our app subdomain (app.usllclight.com), where we record completed purchases. Your choice from the cookie banner applies there too.
• Google Analytics 4 does not log or store IP addresses; for visitors in the EU, IP data is collected via EU-based servers and discarded before logging.
• Transfers to Google LLC in the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.
• You can change or withdraw your choice at any time via the "Cookie settings" link in the footer.

4.2 Live chat (Chatwoot)

Our website and client dashboard offer a live chat provided by Chatwoot Inc. (USA; hosted on AWS), acting as our processor. The chat loads only when you open it — before you click the chat button, no Chatwoot scripts run and no chat cookies are set.

• Data processed: your chat messages, contact details you provide (such as email and name), the page you opened the chat on, and technical metadata.
• For logged-in clients, your account identity (name, email, account id) is attached so our team can verify who they are talking to.
• When you open the chat, Chatwoot sets first-party cookies (cw_conversation, and cw_user_* for logged-in clients) to keep your conversation together.
• Legal basis: performance of the service you explicitly request by opening the chat (Art. 6(1)(b) GDPR).
• Chat conversations are retained for a limited period (currently 30 days on our chat plan) plus our support records.
• Please do not share passports, tax forms, or banking details in chat — use the secure document upload in your dashboard instead.

4.3 Call scheduling (Calendly)

If you request a call with us, we use Calendly, Inc. (USA), acting as our processor, to let you pick a time slot for the call.

• Data processed: the name, email address, and optional question you enter in our call request form, plus the page you sent the request from; where present, the acquisition data captured by the usll_acq cookie described above is stored with your request.
• When you continue to book a time slot, the booking data you enter (such as your selected time and any details Calendly's own booking page asks for) is entered directly on Calendly's page and governed by Calendly's own privacy notice.
• Legal basis: performance of the call you explicitly requested (Art. 6(1)(b) GDPR).
• We retain call-request data for as long as needed to schedule, follow up on, and keep a record of the call, plus our support records.

We do not use advertising cookies. We do not use other third-party tracking cookies unless this Privacy Policy and the cookie settings are updated first.

5. How we collect personal data

We collect personal data:

• directly from you when you enter information, upload documents, complete forms, answer questionnaires, sign documents, approve workflows, or contact us;
• automatically through website, dashboard, server, security, audit, and cookie technologies;
• from payment processors when you pay for services, renew services, request refunds, or dispute payments;
• from registered agents, address providers, mail providers, formation partners, filing providers, identity-verification providers, e-signature providers, tax workflow providers, or other service providers involved in delivering the service;
• from your previous or current registered agent, filing provider, address provider, mail provider, accountant, CPA, attorney, or other service provider where you request or authorize an existing LLC onboarding, transfer, referral, or handoff;
• from state registries, government portals, public records, official filing systems, IRS systems, FinCEN systems, or other official sources;
• from professional advisers, CPAs, accountants, attorneys, or other specialists where you request or authorize a referral or handoff.

6. Why we use personal data

We use personal data for the following purposes.

6.1 To provide the service

This includes creating and managing your account, processing orders, conducting intake and onboarding, reviewing service eligibility, preparing formation information, onboarding existing LLCs, coordinating registered agent, address, or mail services, preparing company documents, supporting EIN workflows, creating document checklists, managing digital signing, preparing state annual report workflows, preparing Form 5472 / pro forma 1120 workflows based on client-provided data, conducting FBAR screening, maintaining compliance calendars, tracking renewals, storing documents, providing dashboard access, and communicating with you about your service.

6.2 To verify identity, authority, and eligibility

This includes verifying your identity, verifying proof of address, verifying company ownership or authority, checking whether you are authorized to act for an entity owner or existing LLC, screening for sanctions, restricted jurisdictions, fraud risk, payment risk, misuse, or prohibited activity, and determining whether your case falls within our supported scope.

6.3 To prepare, coordinate, and submit filings

Where included in the service and authorized by you, we may use personal data to prepare, coordinate, or submit filings, documents, forms, applications, authorizations, or supporting materials to state authorities, the IRS, FinCEN, registered agents, address providers, mail providers, banks, payment processors, e-signature providers, professional advisers, or other relevant parties.

6.4 To manage renewals, cancellations, refunds, transitions, and disputes

We may use personal data to manage annual renewals, renewal reminders, cancellation requests, refund requests, work-stage reviews, provider-cost calculations, provider transfers, handover requests, complaints, chargebacks, disputes, and legal claims.

6.5 To comply with law and protect the service

We may use personal data to comply with legal, regulatory, tax, accounting, sanctions, fraud-prevention, consumer-protection, payment, provider, and recordkeeping obligations.

We may also use personal data to respond to lawful requests, maintain evidence of filings and approvals, enforce our Terms of Service, handle disputes, manage refunds and chargebacks, protect our systems, and prevent fraud, misuse, money laundering, sanctions evasion, or other prohibited activity.

6.6 To improve and manage our business

We may use personal data to improve our website, platform, workflows, forms, checklists, support process, fraud-prevention process, compliance workflows, and service design.

Where practical, we use aggregated, anonymized, or minimized data for these purposes.

6.7 To communicate with you

We may send onboarding messages, account messages, service updates, document requests, payment reminders, renewal reminders, annual compliance reminders, signature requests, provider requests, support responses, security notices, legal notices, and policy updates.

We may send marketing emails only where permitted by law. You can unsubscribe from marketing emails, but you may still receive service, account, compliance, billing, security, provider, and legal notices.

7. Legal bases for processing

Where GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases.

7.1 Contract

We process data where necessary to enter into or perform our contract with you. This includes account creation, orders, formation workflows, registered agent coordination, address setup, document preparation, existing LLC onboarding, annual compliance workflows, renewals, support, billing, cancellations, and service communications.

7.2 Legal obligation

We process data where necessary to comply with legal obligations, including recordkeeping, tax, accounting, sanctions, fraud-prevention, payment, consumer-protection, government-request, and dispute-handling obligations.

7.3 Legitimate interests

We process data where necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms.

These interests include operating and improving the service, preventing fraud and misuse, securing the website and platform, verifying eligibility and authority, maintaining business records, managing provider relationships, handling refunds and disputes, enforcing our Terms of Service, and defending legal claims.

7.4 Consent

We rely on consent where required by law, for example for certain optional cookies, marketing emails, optional referrals, call recordings where required, or specific authorizations.

You may withdraw consent at any time. Withdrawal does not affect processing that happened before withdrawal and may not affect processing based on another legal basis.

7.5 Legal claims and compliance-related processing

Where sensitive or higher-risk data is incidentally processed, we rely on the applicable legal basis and condition available under relevant law, such as legal claims, compliance obligations, substantial public interest, or explicit consent where required.

8. Sensitive data and special-category data

We do not intentionally request sensitive or special-category data unless it is reasonably necessary for verification, compliance, legal, security, provider, filing, or service-delivery purposes.

Identity documents, proof-of-address documents, tax-residence information, citizenship information, foreign bank information, sanctions-screening results, and compliance files may reveal information that could be considered sensitive or higher-risk in some jurisdictions.

We use sensitive or higher-risk data only where reasonably necessary for the purposes described in this Privacy Policy and subject to applicable law.

Please do not send us unnecessary sensitive data, such as health information, religious beliefs, political opinions, trade union membership, criminal-record information, or sexual-orientation information, unless we specifically request it and it is necessary for a lawful purpose.

9. Who we share personal data with

We share personal data only where reasonably necessary for the purposes described in this Privacy Policy.

9.1 Service providers

We may share data with hosting providers, database and storage providers, email delivery providers, payment processors, identity-verification providers, sanctions-screening and fraud-prevention providers, e-signature providers, document-generation providers, customer-support tools, analytics providers if introduced, security providers, backup providers, logging providers, monitoring providers, workflow providers, and professional service providers.

We use hosting, cloud infrastructure, database, security, backup, and IT service providers to operate, secure, maintain, and improve our website, platform, forms, dashboards, document workflows, and related services.

9.2 Formation, registered agent, address, and mail providers

We may share relevant data with registered agents, formation partners, state filing providers, business address providers, virtual office providers, mail scanning and forwarding providers, postal providers, courier providers, USPS Form 1583-related providers, provider compliance teams, and provider account-management teams.

9.3 Government authorities and official filing systems

We may share data with state authorities, Secretaries of State or equivalent filing offices, the IRS, FinCEN where applicable, tax authorities, courts, regulators, law enforcement, or other authorities where required or permitted by law or where authorized as part of the service.

9.4 Professional advisers and referrals

If your case appears to require specialist review, or if you request a referral or handoff, we may share relevant information with a CPA, accountant, attorney, tax adviser, registered agent, banking specialist, or other professional.

The professional adviser's own privacy policy, engagement terms, and confidentiality obligations will apply to their services.

9.5 Provider confidentiality and use limits

Where we use service providers to perform functions for us, we expect them to process personal data only for the services they provide to us or to you, subject to their own terms, privacy policies, legal obligations, and applicable data-processing arrangements.

Government authorities, banks, payment processors, registered agents, mail providers, and professional advisers may also have independent legal duties and may process data under their own rules.

9.6 Business transfers

If we sell, merge, reorganize, finance, transfer, or restructure all or part of our business, personal data may be disclosed to prospective or actual buyers, investors, lenders, advisers, or successor entities, subject to appropriate confidentiality and legal safeguards.

9.7 Legal protection and enforcement

We may share data where necessary to enforce our Terms of Service, respond to claims, respond to chargebacks, comply with subpoenas or court orders, respond to regulator or law-enforcement requests, protect our rights, protect users, protect providers, protect our business, protect our systems, or prevent fraud, sanctions evasion, money laundering, abuse, or illegal activity.

10. Public filings and public records

Some information submitted in LLC formation, annual reports, amendments, registered agent filings, business address filings, tax forms, FinCEN forms, court filings, or other government filings may become public record or may be accessible to government authorities. This may include:

• LLC name;
• state document number;
• filing date;
• principal office address;
• mailing address;
• registered agent name and address;
• manager, member, authorized person, organizer, or signatory information;
• email address or contact information where required by the filing system;
• other information required by the relevant authority.

We may help you use privacy-conscious options within our supported workflow, but we do not guarantee anonymity, non-public treatment, removal from public records, or suppression by search engines, registries, data brokers, or third-party websites.

Before approving or signing a filing, you should review what information will be submitted.

11. International data transfers

We are based in the United States. If you are located outside the United States, your personal data may be transferred to, stored in, accessed from, or processed in the United States and other countries where we or our service providers operate.

These countries may have data-protection laws that differ from those in your country.

Where GDPR, UK GDPR, Swiss data-protection law, or similar transfer rules apply, we use appropriate safeguards where required. These may include:

• Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum, where applicable;
• adequacy decisions, where applicable;
• the EU-U.S. Data Privacy Framework, UK Extension, or Swiss-U.S. Data Privacy Framework, where the recipient is certified and the framework applies;
• contractual, technical, and organizational safeguards;
• another lawful transfer mechanism permitted by applicable law.

12. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Typical retention periods include:

• account data: while your account is active and for a reasonable period after closure;
• order, billing, invoice, payment, refund, chargeback, and dispute records: normally up to 7 years or longer where required by tax, accounting, payment, provider, or legal rules;
• formation, existing LLC onboarding, company, authorization, filing, provider-transfer, and compliance records: normally up to 7 years after the end of the relevant service, filing year, or customer relationship, or longer where needed for legal, tax, compliance, audit, dispute, or evidentiary purposes;
• KYC and identity-verification records: for as long as needed for verification, compliance, fraud-prevention, legal, provider, or dispute purposes, and normally up to 7 years after the customer relationship ends unless a different period is required or justified;
• tax workflow, Form 5472 / pro forma 1120, FBAR screening, annual compliance, submission evidence, and compliance archive records: normally up to 7 years after the relevant tax or compliance year, or longer where needed to address penalties, authority questions, disputes, or legal obligations;
• support communications, provider communications, approvals, instructions, and handover records: for as long as needed to handle your request and maintain service records;
• technical logs and audit logs: normally for a shorter period unless needed for security, fraud prevention, debugging, investigations, legal claims, or compliance.

Some records may need to be retained after cancellation, account closure, refund, provider transfer, or service termination, especially where they relate to filings, authorizations, tax workflows, KYC, fraud prevention, provider obligations, disputes, chargebacks, or legal claims.

We may anonymize data instead of deleting it where lawful and appropriate.

13. Security

We use technical and organizational measures designed to protect personal data.

These may include encryption in transit, password hashing, access controls, role-based permissions, audit logs, secure hosting, backups, provider due diligence, staff access restrictions, internal confidentiality requirements, security monitoring, and data minimization where practical.

No website, platform, email system, storage system, or transmission method is completely secure. You are responsible for keeping your account credentials safe and for using secure channels when sending sensitive documents.

14. Your privacy rights and request process

Depending on your location, you may have rights to:

• access your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent;
• object to direct marketing;
• request information about international transfers;
• complain to a data-protection authority.

These rights may be subject to legal limits. For example, we may need to keep certain records for legal, tax, accounting, fraud-prevention, filing, provider, compliance, dispute, chargeback, or evidence purposes.

To exercise your rights, contact [email protected].

We may need to verify your identity before responding. If an authorized representative acts for you, we may request written authorization, power of attorney, proof of authority, or other information needed to confirm the request is valid.

If we cannot fulfill a request in full, we will explain the reason where required by law and where doing so is lawful and safe.

15. GDPR, UK GDPR, and our international position

US LLC Light is a U.S.-based service offered internationally and priced in USD.

We do not currently maintain an establishment in the EU/EEA or the United Kingdom. At this stage, we have not appointed an EU/EEA or UK data protection representative. This is based on our current assessment of our service positioning, customer base, processing activities, and applicable legal requirements.

We keep this position under review as our business, customer base, marketing activities, and processing activities develop.

If you are located in the EU/EEA, the United Kingdom, Switzerland, or another jurisdiction with data-protection rights, you can contact us directly at [email protected] with any privacy question, request, or concern.

16. California and other U.S. state privacy rights

We are a U.S. business, and some U.S. state privacy laws may apply depending on your location and our legal thresholds.

We do not sell personal data.

We do not share personal data for cross-context behavioral advertising or targeted advertising unless we update this Privacy Policy and provide any required opt-out mechanism.

If a U.S. state privacy law applies to you, you may have rights to access, correct, delete, port, opt out of certain processing, limit certain sensitive-data uses, or appeal a privacy-rights decision. To exercise such rights, contact [email protected].

17. Children

Our website and services are intended for adults forming or managing a business.

We do not knowingly collect personal data from children or minors. If you believe a child has provided personal data to us, contact [email protected].

18. Third-party websites and services

Our website or dashboard may link to third-party websites, portals, providers, banks, payment processors, government websites, registered agents, address providers, mail providers, tax professionals, or other services.

Their privacy policies and terms apply to their processing. We are not responsible for third-party privacy practices.

19. Automated tools and screening

We may use automated tools to support fraud prevention, sanctions screening, restricted-party screening, risk checks, security monitoring, payment-risk review, or service eligibility review.

We do not use automated decision-making that produces legal or similarly significant effects without appropriate human involvement, unless permitted by law and disclosed where required.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

When we update it, we will change the effective date above. If changes are material, we may provide additional notice, such as by email, dashboard notice, or website notice.

21. Contact

For privacy questions, data requests, or complaints, contact: