Privacy Policy

Corpation Filings LLC (“Corpation”, “we”, “us”) is a Delaware limited liability company that provides business formation, registered agent, tax identification and compliance filing services. This policy explains what personal information we collect when you use corpation.com or buy a service from us, why we collect it, who we share it with, and what you can do about it.

This policy covers our website, our client dashboard, our email and phone support, and the services we perform on your behalf. It does not cover third-party sites we link to, or the banks, payment processors and government agencies you interact with directly — those organisations have their own policies.

We are the data controller for the information described here. If you do not agree with this policy, please do not use the site or our services.

Information you give us

• Identity and contact details: your full legal name, email address, postal address, phone number and country of residence.
• Company details: proposed company names, entity type, state of formation, business purpose, ownership structure and the names and details of other owners, members, directors or officers.
• Government identifiers: passport details, national identification numbers, Social Security Numbers or ITINs where a filing genuinely requires them — for example an EIN application, an ITIN application or a beneficial ownership report.
• Correspondence: the content of emails, chat messages, contact forms and support calls.

Information we collect automatically

• Technical data: IP address, browser type and version, device type, operating system and referring URL.
• Usage data: pages viewed, time on page, links clicked and the path you took through checkout.
• Cookies and similar technologies, as described in the cookies section below.

Information from third parties

• Payment confirmations, the last four digits of your card and billing address from our payment processor. We never receive or store your full card number.
• Filing status, approval documents and rejection notices from Secretaries of State and the IRS.
• Sanctions, politically-exposed-person and adverse-media screening results from identity verification providers, where required by law.

We do not knowingly collect special category data (such as health or biometric information) and ask that you do not send it to us.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use your information to train machine learning models.

• Government agencies. Secretaries of State, the IRS, FinCEN and the USPTO receive the information required by the filing you asked us to make. Much of what appears on a state formation document becomes a public record.
• Payment processing. Stripe, Inc. processes card payments and receives your name, email, billing address and transaction details. Stripe acts as an independent controller for fraud prevention purposes.
• Service providers. Cloud hosting, email delivery, document storage, e-signature, identity verification and customer support tools, each under a written contract that limits them to processing on our instructions.
• Introductions you ask for. Where you buy a banking or payment setup service, we share the documents and details necessary to make that introduction — and only with partners you have agreed to.
• Professional advisers. Our lawyers, accountants and auditors, where necessary and under a duty of confidentiality.
• Legal and safety. Where we are legally compelled by subpoena, court order or regulator, or where disclosure is necessary to establish or defend legal claims or to prevent fraud or serious harm.
• Business transfers. If Corpation is acquired or merged, your information may transfer to the acquirer under the same protections, and we will tell you before it becomes subject to a materially different policy.

We are based in the United States and our systems are hosted there. If you are in the United Kingdom, the European Economic Area or another jurisdiction with data transfer restrictions, your information will be transferred to and processed in the United States.

Where required, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented by technical measures including encryption in transit and at rest. You can request a copy of the relevant safeguards by writing to us.

Note that a U.S. company formation is, by its nature, a U.S. legal act: information required by a state or federal agency will be processed in the United States regardless of where you live.

When a retention period ends we delete the information or irreversibly anonymise it. Some records cannot be deleted on request because we are legally required to keep them — anti-money-laundering records are the main example.

• TLS 1.2+ encryption for all data in transit, and AES-256 encryption at rest.
• Role-based access control, so a specialist can only see the files they are working on.
• Mandatory multi-factor authentication for every member of staff.
• Identity documents uploaded through an encrypted channel, never accepted over ordinary email.
• Card data handled entirely by our PCI DSS Level 1 payment processor and never stored on our systems.
• Regular backups, access logging and annual review of our security controls.

No system is perfectly secure. If a breach affects your personal information and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority without undue delay and, where required, within 72 hours.

If you are in the UK or EEA

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have data deleted where we no longer have a lawful reason to keep it.
• Restriction — limit how we use your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complain — to your supervisory authority, such as the UK Information Commissioner’s Office.

If you are in California, Colorado, Connecticut, Virginia or a similar state

• Know what personal information we collect, use and disclose, and to whom.
• Request deletion of your personal information, subject to legal retention duties.
• Correct inaccurate personal information.
• Opt out of sale or sharing — we do neither, so there is nothing to opt out of.
• Not be discriminated against for exercising any of these rights.
• Appeal a refusal, by replying to our decision email.

To exercise any right, email legal@corpation.com from the address on your account. We verify identity before acting on a request and respond within 30 days, or 45 days where a state law allows an extension and we tell you why. Exercising these rights is free unless a request is manifestly unfounded or excessive.

• Strictly necessary cookies keep you signed in, remember your checkout progress and protect against cross-site request forgery. These cannot be switched off.
• Preference cookies remember choices such as your selected state of formation.
• Analytics cookies count visits and show which pages people find useful. We use privacy-respecting, aggregated analytics and do not build advertising profiles.

We do not run third-party advertising or retargeting pixels. You can block or delete cookies in your browser settings; blocking strictly necessary cookies will break checkout. Where required by law we ask for consent before setting non-essential cookies, and we honour Global Privacy Control signals.

Our services are for people aged 18 or over and we do not knowingly collect information from children. If you believe a child has given us personal information, write to legal@corpation.com and we will delete it promptly.

We update this policy when our practices or the law change. The effective date at the top always reflects the current version. If a change materially affects how we use your information, we will email account holders at least 14 days before it takes effect. Continuing to use the service after that date means you accept the updated policy.