What does this privacy policy cover?

This policy explains what Federal Apostille collects when you order an apostille, why we collect it, who we share it with, and how long we keep it. In short: we collect only what the U.S. Department of State, a state Secretary of State, a county clerk or a courier actually requires to authenticate and return your document — and we purge working copies once your order closes.

It applies to this website, to orders placed through it, and to communication by email, phone or messaging about an order. It does not cover what a foreign ministry, consulate, employer or university does with your document after you hand it over; once the apostille is attached and the document leaves our hands, the receiving institution’s own rules govern.

What information does Federal Apostille collect?

Information you give us directly

When you start an order you supply your name, email address, phone number, the return shipping address, the destination country, and the document you need authenticated — either as a physical original mailed to us or as a scan for pre-review. Depending on the document, you may also send a government ID, a notarised signature page, a certified copy ordered from a vital records office, or a signed authorisation letter allowing us to act as your courier with an agency.

Some documents carry sensitive information by their nature. An FBI Identity History Summary contains criminal history record information. A death certificate contains cause-of-death and family data. A medical licence verification contains professional disciplinary history. We do not go looking for that information — it arrives because it is printed on the page we are authenticating. We treat it accordingly, and we explain our handling controls in detail on our compliance, confidentiality and accreditations page.

Information collected automatically

Like any website, this site records technical data: IP address, browser and device type, referring page, the pages you viewed, and timestamps. This is collected through server logs, cookies and analytics tools. It is used to keep the site working, detect fraud and abuse, and understand which guidance pages people actually read so we can improve them.

Information from third parties

We receive limited data back from the parties who help complete your order: delivery confirmations and tracking events from couriers, authorisation results and fraud scores from our payment processor, status updates from the authenticating agency, and aggregated statistics from analytics providers. We do not buy marketing lists and we do not enrich your record with purchased data.

How do we use your information?

• To perform the service you paid for — preparing, submitting, tracking and returning your apostille.
• To check eligibility before submission — confirming a notary’s commission details are complete, that a copy is a certified copy rather than a photocopy, and that the right agency has jurisdiction.
• To communicate — order confirmations, requests for a missing page, agency status updates, and delivery notifications.
• To take payment — processed by our payment provider at our flat $120 per apostille, all-inclusive price.
• To prevent fraud and misuse — including identity-document fraud, which is a real risk in this field.
• To meet legal and accounting obligations — tax records, and responses to lawful requests.
• To improve the site — analytics on page performance and drop-off points.

What legal bases do we rely on under GDPR and UK GDPR?

Where the EU GDPR or UK GDPR applies to our processing, we rely on the lawful bases set out in Article 6 of the Regulation:

• Performance of a contract — everything needed to process and return your apostille.
• Legal obligation — retaining financial records and responding to lawful demands.
• Legitimate interests — securing our systems, preventing fraud, and measuring how the site performs, balanced against your rights.
• Consent — non-essential cookies and any marketing email, which you can withdraw at any time.

The UK Information Commissioner’s Office publishes a plain-language guide to lawful basis if you want to check our reasoning against the regulator’s own framing.

Who do we share your information with?

Only with parties that have a functional role in completing your order.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We will disclose information where a court order, subpoena or other legal process compels it, and in the event of a business transfer we would pass customer records to the successor under the same commitments set out here. The commercial terms that sit alongside this policy are in our Terms & Conditions.

How long do we keep your documents and data?

Retention is driven by triggers, not by habit. Your physical document is never retained — it goes to the agency and comes back to you. Scanned working copies exist only for as long as they are useful to complete the order and to answer any question that follows it, including the refund and dispute window described in our Refund & Cancellation Policy. Once that window closes, scans are deleted from our systems and from working storage.

Transaction and accounting records are kept separately for the period that tax and accounting law requires. Those records identify that an order happened and what was charged; they do not contain images of your underlying documents. Server and security logs rotate on a shorter cycle.

Never send us the only copy of a document you cannot replace. Agencies handle originals, couriers lose parcels, and no privacy or security control can reconstruct a destroyed record. For vital records, order a fresh certified copy from the issuing office and send that.

What privacy rights do you have, and how do you exercise them?

Which rights you can assert depends on where you live and which law applies to the processing.

California residents can review the statutory rights summary published by the California Attorney General. Several other US states have comparable comprehensive privacy laws, and we extend the core access and deletion rights to every customer regardless of residence.

1. Write from the order email. Send your request from the address used to place the order — it is the fastest way for us to match you to a file.
2. Say exactly what you want. Access, correction, deletion, restriction, portability, or opt-out. Vague requests take longer because we have to ask what you meant.
3. Include the order reference. Or the document type, destination country and approximate order date if you no longer have the reference.
4. Complete identity verification. We will ask you to confirm details already on file. We will never ask you to email a new copy of your ID to satisfy a deletion request.
5. Get written confirmation. We respond within the period the applicable law requires and confirm in writing what was accessed, corrected or deleted — and what we were legally required to keep.

What cookies does this site use, and how do you control them?

• Strictly necessary cookies — session state, security tokens, and the order flow. The site does not function without them.
• Preference cookies — remembering settings so you do not re-enter them.
• Analytics cookies — page views, time on page, and where visitors abandon the order form.

Your controls: block or delete cookies in your browser settings, use private browsing, or install the opt-out tooling your analytics provider offers. Where applicable law requires it, we honour browser-level opt-out signals such as Global Privacy Control. Blocking strictly necessary cookies will break checkout, so expect that trade-off if you switch them off.

How do we protect your data?

Transport encryption on the website, access limited to staff who need a file to do their job, tracked and insured couriers for physical documents, and payment card data handled by a PCI-compliant processor rather than stored on our systems. No control set is perfect, and we do not claim otherwise; if a breach affects your personal data and the law requires notification, you will be told.

What happens when your data crosses a border?

An apostille exists to make a US public document usable in another country, so cross-border movement is the entire point of the transaction. If your document is bound for Spain, Colombia or any other party to the HCCH Apostille Convention status table, the apostille certificate travels with it to the receiving institution abroad, and courier tracking data follows the parcel.

Where we ourselves transfer personal data out of the EEA or the UK to service providers, we rely on recognised transfer safeguards, including the European Commission’s standard contractual clauses. The United States is a third country for these purposes, and your data will be processed here.

What about children’s privacy?

This service is aimed at adults and is not directed to children. We do not knowingly collect personal information online from children under 13, the threshold used by the FTC’s Children’s Online Privacy Protection Rule. Parents and guardians routinely order apostilles for a minor’s birth certificate or school transcript — that is an adult placing the order on a child’s behalf, and the child is not our website user. If you believe a child has submitted information to us directly, contact us and we will delete it.

What about links to other sites?

We link to government and treaty sources — the Department of State, the HCCH, state Secretary of State offices, the FBI — so you can verify requirements at the source. Those sites have their own privacy policies and we do not control them. Read the policy on the site you land on, particularly before you enter data into any agency portal.

Common reasons a privacy request or an apostille order stalls

Both sides of this relationship fail for predictable reasons. These are the ones we see most.

• The request comes from an unrelated email address. We cannot verify you, and handing data to the wrong person is the worse error.
• A deletion request arrives mid-order. We cannot delete the file we are actively using to get your document authenticated. Cancel first, then request deletion.
• Blanket “delete everything” requests. Accounting records we are legally obliged to retain will survive the request; we will tell you which ones and why.
• A photocopy was sent instead of a certified copy. Vital records generally must be certified copies issued by the records office — see our guidance on death certificate apostille requirements.
• The notarisation is incomplete. Missing commission expiry, missing venue, missing signature, or an expired commission will stop a state filing.
• The wrong authority was targeted. Federal documents go to the U.S. Department of State; state-issued records go to the Secretary of State of the issuing state. Sending a federal record to a state office wastes a cycle — the route for an apostille an FBI background check is a good worked example.
• Names do not match. A married name on the order and a maiden name on the certificate needs explaining up front, not after a rejection.

Requirements vary by state, by agency and by destination country, and the authority receiving your document has the final say on whether it accepts it.

How will we tell you about changes to this policy?

We update this page when our practices, our providers or the law change, and the revision date at the top reflects the most recent version. Material changes — a new category of data, a new disclosure recipient, a shortened or lengthened retention trigger — will be flagged on the page and, where required, notified directly. Continuing to use the site after an update means the current version applies to you.

How do you contact us about privacy?

Use the contact details published on this website and put the word “Privacy” in the subject line so it is routed correctly. Tell us what you want, include your order reference if you have one, and write from the email address on the order. If you are in the UK or the EEA and you are unhappy with our response, you can escalate to your national data protection authority.

Your specific next step: if you already have an order with us and want to know exactly what we hold, email a one-line access request quoting your order reference — you will get an itemised answer rather than a form letter. If you are about to order, read the compliance, confidentiality and accreditations page first so you know how your document will be handled before you send it, then start your order at our flat $120 per apostille, all-inclusive price.