This explains what personal data passes through aiylum, why, and what happens to it. It is written for two different readers and says which is which throughout, because the answers differ.
Who is responsible for what
If you are a client of a law firm, that firm decides what to collect about you and why. They are the controller. We hold it for them on their instruction and do nothing else with it. We are the processor. Questions about your own data go to your firm first; we will help them answer, and we will not act on your data without them.
If you are a firm using aiylum, we are the controller of the account data we need to run the service for you: who your people are, what they did in the product, what you were billed.
What a client's record holds
Identity and contact details. Immigration history: dates of entry, status, proceedings, prior applications. The documents uploaded on the matter. What the firm has recorded about the case, including their own notes. Messages between the firm and the client. Payments the firm has taken.
Some of this is special category data under some laws – religion, political opinion, sexual orientation, health – because an asylum claim is frequently about exactly those things. It is handled as such: marked sensitive in the model, excluded by default from disclosure packets, and kept out of anything that leaves the system without a specific decision.
What we do not do
We do not sell personal data. We do not share it for advertising. There is no advertising in the product and no analytics tracker on it. We do not use a client's case data to train models.
Encryption and who can reach it
Identifying fields are encrypted at rest with per-subject keys, so reading a database row does not produce a name or an address. Documents are stored separately, scanned on arrival, and served through short-lived links rather than public URLs.
Inside a firm, access follows roles and case assignment. Between firms there is no access at all: every scoped query carries the firm's own identifier, and a record belonging to another firm reads as not found rather than as forbidden, because "forbidden" would confirm it exists.
aiylum's own staff can see *about* a firm – counts, health, billing – and not inside one. Where a support engagement requires more, it happens in a bounded window, with the firm's agreement, and every read is recorded.
The audit ledger
Every consequential action is appended to a hash-chained ledger: who did it, to what, when. It cannot be edited or deleted, which is the point of it. It is how a firm answers "who opened this file" and how anybody answers "was this record changed".
How long it is kept
A firm's matter data is kept while the firm is a customer and for the period their own retention policy sets. Immigration matters have long tails – a case can be reopened years later, and the file is the evidence of what was done – so retention is measured in years rather than months by default.
When something is deleted, encrypted fields are made unrecoverable by destroying the key material for that subject. The audit ledger keeps the record that the deletion happened, without the content.
A legal hold stops deletion. That is deliberate and it overrides a retention schedule.
Your rights
Access, correction, deletion, portability, objection, and withdrawal of consent where consent was the basis. Which of these apply depends on where you are, and the mechanism depends on which reader you are.
A client of a firm asks the firm. We answer to them, and quickly.
A firm asks us directly at privacy@aiylum.com.
Where data is
Data is held in the United States. Where a firm needs it held elsewhere, say so before you start rather than after.
Changes
The version of this notice you accepted is recorded against your registration, and this page states the current version. A material change is notified before it takes effect.
---
*This page describes how the product is built and is written by the people who built it. It has not been reviewed by outside counsel. For a formal data protection assessment, ask us and we will provide what we have.*