Privacy Policy

Last updated: August 26, 2026

Heritage Passport is a digital platform proudly built and operated by CitizensOS Inc. Throughout this Privacy Policy, "Heritage Passport" refers to the brand and services you interact with, while "CitizensOS," "we," "us," or "our" refers to CitizensOS Inc., the technology company providing the platform.

CitizensOS Inc. ("CitizensOS," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to heritagepassport.co, any subdomain we operate, and any service or application that links to this Policy (collectively, the "Services").

By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

1. Who We Are

CitizensOS is a Delaware C-corporation operating the CitizensOS platform — the Live Anywhere Platform — helping users discover, plan, and execute international residency and citizenship rights. CitizensOS provides information, tools, and software. CitizensOS is not a law firm, an immigration consultancy, or a financial, tax, or investment advisor. We do not provide legal advice, immigration representation, financial planning advice, or investment advice. See our Terms of Service for the full disclaimer.

Contact for privacy matters: CitizensOS Inc. 169 Madison Avenue, STE 975569 New York, NY 10016 United States Email: support@heritagepassport.co

2. Information We Collect

We collect three categories of information directly. One of those categories — sensitive personal information — is treated with heightened safeguards described in Section 2.4.

2.1 Information You Provide Directly

When you sign up, complete an assessment, or use our Services, you may provide:

Account information: name, email address, password (stored as a hash), profile photo, account preferences, time zone, and language preference.
Assessment and planning information: country of citizenship, country of residence, language proficiency, education level, work history, family information (including ancestry and heritage information for descent-based citizenship pathways), travel and residency history, savings range, income range, retirement plans, intended destinations, and similar inputs you provide to receive personalized country matches and residency plans.
PassVault contents: documents and metadata you upload to organize your residency, citizenship, or visa application materials, including but not limited to: passports and national ID cards; birth, marriage, divorce, and death certificates; baptismal and naturalization records; police certificates and apostilles; tax records; bank statements and proof-of-funds documentation; prior visa, residency, or denial decisions; and translations and notarizations of any of the foregoing.
Payment information: billing name, billing address, and payment method details. We do not store full credit card numbers. Payment information is collected and processed by our payment processor, Stripe, Inc. See Section 5.
Communications: the content of messages you send to us through email, contact forms, or chat, including any feedback or support requests.

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

Device and usage information: device type, operating system, browser type, IP address, language settings, screen resolution, referring URLs, pages viewed, links clicked, time spent on pages, assessment progression, and approximate location (derived from IP address).
Cookies and similar technologies: as described in our Cookie Policy.

2.3 Information from Third Parties

We may receive information about you from:

Authentication providers: if you sign in with Google, Apple, or another OAuth provider, we receive your email address, name, profile photo, and a unique provider identifier from that provider.
Payment processor: Stripe shares limited transaction data with us (e.g., last four digits of card, transaction status, billing country) so we can service your account.
Analytics providers: aggregated usage data from the analytics tools described in our Cookie Policy.
Public sources: publicly available information used to enrich the country, program, and pathway data we surface in our Services (this is information about countries and programs, not about you).

2.4 Sensitive Personal Information and Identity Documents

Because the Services support residency, citizenship, and visa planning, much of the information we collect falls into categories considered "sensitive personal information" under one or more privacy laws. These categories include:

Government-issued identification documents: passport scans, national ID cards, driver's licenses, residence permits, social security numbers, tax identification numbers (TINs), and equivalent foreign identifiers;
Vital records: birth, marriage, divorce, and death certificates; baptismal records; naturalization certificates; adoption records;
Heritage and ancestry information: the names, birthplaces, dates of birth, marriages, deaths, and citizenship status of your ancestors and family members, used to evaluate eligibility for citizenship-by-descent pathways such as Italian jure sanguinis or Irish Foreign Births Register registration;
Financial information: income range, savings range, asset categories, proof of funds, and other financial data needed to evaluate eligibility for residency programs that have minimum solvency or investment requirements;
Tax-relevant information: information about citizenship, tax residence, prior tax filings, FATCA/FBAR reporting status (for U.S. persons), and account ownership disclosures that may be required by destination countries;
Immigration history: prior visas, residency permits, denials, removals, and travel records;
Religious or cultural affiliations: in limited cases relevant to a specific pathway (for example, Sephardic ancestry for certain Spanish or Portuguese pathways).

How we handle sensitive personal information:

We collect this information solely to provide the Services you have requested. We do not use it for advertising, profiling, or any purpose unrelated to the Services.
Sensitive personal information is encrypted in transit using TLS 1.2 or higher, and encrypted at rest by our infrastructure providers on the storage and database systems that hold it (see Section 5.1).
Access is restricted to personnel and service providers who need it to operate the Services, under role-based access controls.
We do not sell, share, or use sensitive personal information for cross-context behavioral advertising as those terms are defined under California law.
You may request deletion of any specific document or category of sensitive personal information at any time, subject to legal retention requirements (Section 6).

3. How We Use Your Information

We use your information to:

Provide, operate, maintain, and secure the Services, including account creation, authentication, and customer support;
Match you to relevant residency, citizenship, and visa pathways and generate personalized plans;
Read the contents of documents you upload in order to extract names, dates, places, and other facts needed to assess your eligibility, build your document checklist, and prefill application forms (see Section 5.1 for the provider that performs this processing);
Process payments and manage your purchases and access;
Communicate with you about your account, transactions, security, and changes to the Services;
Send you marketing communications about CitizensOS (you can opt out at any time using the unsubscribe link or by emailing support@heritagepassport.co);
Conduct analytics, research, and product development to improve the Services, including refinement of our scoring methodologies and assessment workflows;
Learn from how applications actually perform. We study the outcomes of cases run on the Services — which requests are accepted or rejected by which issuing office, what caused a rejection, which certificate types and evidence each office will and will not take, how long each office takes, and where members get stuck — and we use what we learn to improve guidance, checklists, and forms for every member. This operational learning is derived from case outcomes and metadata; it does not require, and we do not use, the images of your documents for this purpose;
Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service;
Comply with legal obligations and enforce our agreements.

We do not use your personal information to train artificial intelligence or machine learning models that are made available to other CitizensOS users or third parties, and we do not permit the AI providers we use to train their models on your content (see Section 5.1).

4. Legal Bases for Processing (EU/UK Users)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on the following legal bases:

Performance of a contract: to provide the Services you have requested.
Legitimate interests: to operate, secure, and improve the Services, prevent fraud, and conduct analytics, where these interests are not overridden by your rights.
Consent: for marketing communications and certain cookies, where required.
Legal obligation: to comply with applicable laws.
Explicit consent (Article 9 GDPR): for processing of special-category personal data (such as heritage data and religious or cultural affiliations relevant to a specific pathway).

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before the withdrawal.

We share information only as described below. We do not sell your personal information for monetary consideration, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

5.1 Service Providers

We share information with vendors who perform services on our behalf under written contracts that restrict their use of your information. This is the complete list of subprocessors that receive personal information, what each one receives, and why.

Supabase, Inc. — receives: All account data, case data, and uploaded document files. Why: Authentication, database, and file storage. Data is held in the United States (AWS us-east-2, Ohio).
Vercel, Inc. — receives: All request traffic, including data processed server-side while you use the Services. Why: Application hosting and content delivery. Served from the United States (iad1).
Stripe, Inc. — receives: Billing name, billing address, payment method details, and transaction events. Why: Payment processing. Card details go to Stripe directly; we never receive or store full card numbers.
Anthropic PBC — receives: The images and PDFs you upload to PassVault, and the text extracted from them. Why: Reading your documents to extract names, dates, and places for eligibility and form prefill. Under Anthropic's Commercial Terms, Anthropic may not train its models on this content, and inputs and outputs are deleted within 30 days.
OpenAI, L.L.C. — receives: The images and PDFs you upload to PassVault, and the text extracted from them. Why: Reading your documents to extract names, dates, and places for eligibility and form prefill. Under OpenAI's Business Terms, OpenAI may not train its models on this content, and inputs and outputs are deleted within 30 days.
Google LLC — receives: Your email address, name, profile photo, and provider identifier — only if you choose to sign in with Google. Why: Federated sign-in.
Cloudflare, Inc. — receives: Your IP address and a browser challenge token. Why: Turnstile bot challenge on the sign-in entry point, to stop automated abuse.
Loops — receives: Your email address and notification metadata. Why: Transactional and notification email. Documents, document links, and case file contents are never sent by email.
Cal.com, Inc. — receives: Your name, email address, and booking details. Why: Scheduling and managing Family Kickoff calls.
Geoapify GmbH — receives: The address and place text you type into an address field. Why: Address and place autocomplete. Requests are proxied through our servers.
FamilySearch International — receives: Your authorisation to connect, and the genealogical records you choose to import. Why: Importing your existing family tree — only when you connect the account yourself.
Lob.com, Inc. — receives: Your name and mailing address, and the contents of a printed kit. Why: Printing and posting a physical kit to you, where that is part of what you bought. Not used unless that fulfilment path is enabled for your order.
PostalMethods Ltd. — receives: Your name and mailing address, and the contents of the packet we print for you, which include your completed application form and the copy of your photo ID. Why: Printing and posting your completed record request to you, in colour, single sided, First Class, with a reply envelope already addressed to the issuing office. The account is held by CitizensOS Inc. Not used unless physical mail is enabled for that record.
TrustedSite — receives: Page-load telemetry from visitors to our public site. Why: Site verification trustmark on public marketing pages. It does not receive account or case data.
PostHog, Inc. — receives: Pseudonymous funnel identifiers, an account UUID after signup, minimized product-use and payment event metadata, and ordinary network metadata associated with event delivery. Why: Cookieless launch-funnel measurement in PostHog Cloud US (Virginia). We do not send email, name, family, case, document, or ancestor identifiers, document contents, raw survey answers, or URLs and query strings; advertising, autocapture, session replay, and person profiles are disabled.

No analytics or advertising subprocessor receives your case data or document contents.

If we add a subprocessor that receives personal information, we will update this table before it begins processing.

5.2 Third-Party Professionals

If you choose to engage a third-party professional (such as an attorney, immigration consultant, tax advisor, translator, or document procurement specialist) through introductions facilitated by CitizensOS, you may authorize us to share specific portions of your information with that professional. We share only what you direct, and the third-party professional becomes an independent controller of any information you share with them. CitizensOS is not responsible for the third-party professional's information practices. See Section 11.2 of our Terms of Service for more on Third-Party Professionals.

5.3 Legal and Safety Disclosures

We may disclose information when we believe in good faith that disclosure is necessary to: comply with a subpoena, court order, or other legal process; respond to a lawful government request; protect the rights, property, or safety of CitizensOS, our users, or others; investigate potential violations of our Terms of Service; or detect, prevent, or address fraud or security issues.

5.4 Business Transfers

If CitizensOS is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. The following conditions apply to any such transfer, and they are binding commitments, not statements of intent:

The commitments in this Policy travel with the data. Any successor, acquirer, or purchaser of CitizensOS or of the assets that include your personal information takes that information subject to this Privacy Policy as it exists at the time of transfer. In particular, the successor is bound by our commitments not to sell, license, or rent your family records, and not to permit AI providers to train on your content.
Written acceptance is a condition of the transfer, not a promise about it. No transfer of your personal information takes place unless and until the successor has agreed in writing to be bound by this Policy with respect to that information. That written agreement is a condition precedent: until it is signed, the transfer does not occur, and if it is never signed, your personal information is excluded from the transaction entirely.
You get notice and a way out before it happens. We will give you advance notice of any transfer of ownership or control of your personal information, and a meaningful opportunity — before the transfer takes effect — to export your data and to delete your account and its contents. Deletion requested during that window is completed before the transfer, and deleted data is not transferred.
This survives bankruptcy and asset sales. These conditions apply whether the transfer happens through a negotiated sale, a financing, a reorganization, or an insolvency or bankruptcy proceeding, and we will assert them in any such proceeding. Your personal information is not a general asset of CitizensOS that can be sold free of these conditions; it is held subject to them, and any purchaser takes it on that basis or not at all.

We include these terms because a privacy promise that a buyer can discard is not a promise. If we ever tell you we are not in the business of selling your family's data, that has to remain true of whoever holds it next.

We may share your information with other third parties when you direct us to do so or otherwise consent.

6. Data Retention

We retain your information for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, enforce our agreements, and operate the Services.

Account information: retained while your account is active and for up to 24 months after closure, unless a longer period is required by law.
Assessment data: retained while your account is active. You may delete individual assessments from your account at any time.
PassVault contents (uploaded documents): retained while your account is open, so that your records stay available to you for as long as your application takes. When you close your account or ask us to delete your documents:
You will have a 30-day grace period during which you can sign in and download your documents from your PassVault.
After the 30-day grace period, documents in your PassVault are deleted from production systems.
You may also request immediate deletion at any time by emailing support@heritagepassport.co.
Payment records: retained for at least seven years to comply with tax and accounting obligations.
Support communications: retained for up to three years.
Backup copies: our database provider takes automated daily backups and retains them on a rolling 7-day window. Data you delete may therefore persist in those backups for up to 7 days after it is removed from production systems, after which the backup containing it expires.

You may request deletion of your account and associated data at any time. See Section 7.

7. Your Privacy Rights

7.1 All Users

Regardless of where you live, you can:

Access the personal information we hold about you;
Correct inaccurate or incomplete information;
Delete your account and associated personal information, subject to legal retention requirements;
Export a copy of your information in a portable format;
Opt out of marketing communications.

How to exercise these rights today: email support@heritagepassport.co from the email address associated with your account, telling us what you want — a copy of your data, a correction, deletion of a specific document, or deletion of your whole account. We verify the request by confirming you control that email address, then carry it out. This is a handled request rather than a self-service button in the product. Your rights are the same either way; the difference is that a person handles it rather than a form.

7.2 California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it;
Right to delete personal information we have collected from you;
Right to correct inaccurate personal information;
Right to limit use of sensitive personal information to that which is necessary to perform the Services;
Right to opt out of sale or sharing — as noted, we do not sell or share personal information as those terms are defined under California law;
Right to non-discrimination for exercising your rights.

You may exercise these rights by emailing support@heritagepassport.co. We will verify your request by confirming your control of the email address on file. You may also designate an authorized agent to make a request on your behalf.

If you are in the EEA, UK, or Switzerland, you also have the right to:

Object to processing based on legitimate interests;
Restrict processing in certain circumstances;
Withdraw consent for processing based on consent (including consent to the special-category processing described in Section 4);
Lodge a complaint with your local data protection authority.

You may contact us at support@heritagepassport.co to exercise these rights.

8. International Data Transfers

CitizensOS is based in the United States. Our infrastructure, our team, and our service providers operate across multiple countries. The nature of cross-border mobility planning means that international data transfers are inherent to the Services.

Examples of international transfers that may occur in the course of providing the Services:

A U.S. user pursuing Italian citizenship by descent may have their genealogical records and supporting documents reviewed by partner professionals or processed by Italian comune offices, consulates, or courts;
A user pursuing Portuguese, Spanish, or Greek residency may have their financial documentation transferred to those countries' authorities or to in-country service providers;
A user pursuing Irish Foreign Births Registration may have records transferred to Irish authorities;
Your information may be processed by our service providers operating in the United States, the European Union, the United Kingdom, Canada, or other countries where our infrastructure or vendors operate.

When we transfer personal information from the EEA, UK, or Switzerland to the United States or to other countries that have not received an adequacy decision, we rely on appropriate safeguards, which may include:

Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office;
The UK International Data Transfer Agreement or the UK Addendum to the EU SCCs;
Where the transfer is to a third-party professional you have engaged, your explicit consent to that specific transfer for the specific purpose of advancing your application;
Other lawful transfer mechanisms as they become available.

You may contact support@heritagepassport.co for a description of the specific transfer mechanism applicable to your information.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

Encryption in transit using TLS 1.2 or higher for all communications between you, our Services, and our service providers;
Encryption at rest of personal information stored in our databases, including identity documents and PassVault contents;
Row-level database policies that scope each record to the account that owns it, enforced by the database itself rather than only by the application;
Role-based access controls so that personnel access only the information needed to perform their duties;
Short-lived, single-purpose links for document access, which expire minutes after they are issued;
Vendor due diligence including data processing agreements with service providers and subprocessors.

What we do not yet have. We do not currently maintain a complete audit log of staff access to uploaded documents, and we do not hold SOC 2, ISO 27001, or any comparable third-party security certification. We would rather tell you that than imply otherwise.

No system is perfectly secure, however, and we cannot guarantee the absolute security of your information.

If we become aware of a breach affecting your personal information, we will notify you and applicable regulators as required by law.

10. Children's Privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you are under 16, do not use the Services or provide us with information. If we learn that we have collected information from a child under 16, we will delete it. Parents or guardians who believe we have collected information from a child should contact support@heritagepassport.co.

Heritage and ancestry information about your relatives, including children, may be collected as part of an eligibility assessment. This information is provided by you about third parties; it is not collected directly from those individuals.

11. Cookies and Tracking

We use cookies and similar technologies as described in our Cookie Policy. You can control cookies through your browser settings and through any cookie consent tool we display.

12. Third-Party Links and Services

The Services may link to third-party websites and services that are not operated by CitizensOS. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address on file) or by a prominent notice on the Services before the change takes effect. The "Last updated" date at the top of this Policy reflects the most recent revision.

14. Contact Us

Questions, concerns, or requests regarding this Policy or your personal information:

CitizensOS Inc. Attn: Privacy 169 Madison Avenue, STE 975569 New York, NY 10016 United States Email: support@heritagepassport.co