Effective Date: October 31, 2026
Last Updated: October 31, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between MigrationPulse Incorporated, the company that operates MigrationPulse ("MigrationPulse," the "Processor"), and the Customer (the immigration office, the "Controller"). It governs MigrationPulse's processing, on the Controller's behalf, of personal information about the Controller's clients, prospective clients and the people on their cases ("Client Data").
The Controller determines the purposes and means of processing Client Data. MigrationPulse acts solely as a Processor, processing Client Data only on the Controller's documented instructions. Those instructions are the Terms, this DPA, and the Controller's use of the Service's features.
The Controller is responsible for having the right to collect Client Data and to put it in the Service, for the notices it gives its clients, and for every consent the law requires, including for identity checks that compare a client's face with an ID, for recording or transcribing meetings, and for the information of children and other family members on a case. The Controller is also responsible for the duties of confidentiality it owes its clients. MigrationPulse makes no decision about any client or case.
MigrationPulse processes Client Data only to provide and support the Service: storing client and case records, filling forms from them for the Controller to review, collecting documents through the client portal, drafting and certifying translations, electronic signatures, scheduling and video meetings, email reminders and notices, identity verification, and AI assistance. MigrationPulse will not use Client Data for its own purposes, will not sell it, will not combine it with another customer's data, and will not disclose it except as permitted in this DPA. MigrationPulse files nothing with any government agency.
People: the Controller's clients and prospective clients; family members and others named on a case, including children; and the Controller's own staff.
Kinds of data: names, contact details, dates and places of birth, addresses and family relationships; identity and immigration documents and the numbers in them, such as passport and other identity document numbers, Alien Registration Numbers (A-Numbers) and USCIS receipt numbers; immigration status and history; documents and their translations; signatures and signing records, including the network address and browser a document was signed from; messages and appointments; meeting recordings and transcripts where the Controller uses them; identity verification results, ID images and selfies; and, where the Controller imports them, Social Security numbers. Much of this is sensitive, and the Controller decides what to collect.
MigrationPulse ensures that personnel authorized to process Client Data are bound by appropriate confidentiality obligations and access Client Data only as needed to provide and support the Service. MigrationPulse acknowledges that Client Data may be covered by the Controller's professional duties of confidentiality, including the attorney-client privilege where the Controller is an attorney, and will treat all Client Data as the Controller's confidential information.
MigrationPulse maintains administrative, technical, and physical safeguards designed to protect Client Data, including:
The Controller is responsible for configuring its own account access, assigning roles to its staff, and protecting its credentials.
The Controller authorizes MigrationPulse to engage subprocessors to support the Service, in these categories: cloud hosting and storage, payment processing, email delivery, identity verification, video meetings and transcription, AI, and error monitoring. MigrationPulse imposes data-protection obligations on subprocessors no less protective than this DPA, does not permit its AI subprocessor to use Client Data to train its models, and remains responsible for their performance. A current list of subprocessors is available on request, and MigrationPulse will give notice of material changes. MigrationPulse hosts the Service and Client Data in the United States.
Taking into account the nature of the processing, MigrationPulse will provide reasonable assistance to the Controller in responding to requests from individuals to access, correct, or delete their information, and in meeting the Controller's security and breach-notification obligations. If MigrationPulse receives such a request directly, it will pass it to the Controller and will not answer it itself except as the Controller instructs.
If MigrationPulse receives a subpoena, court order, or request from a government agency or any other third party for Client Data, it will refer the requester to the Controller where the law allows, notify the Controller promptly before disclosing anything unless the law forbids it, and disclose only the Client Data the law requires.
MigrationPulse will notify the Controller without undue delay after becoming aware of a confirmed breach of security leading to the unlawful destruction, loss, alteration, or unauthorized disclosure of Client Data, and will provide information reasonably available to help the Controller meet its obligations.
Export. The Controller's owner or a manager can export the account at any time from the Service. The export contains the account's settings and members, client records and contact details, every file uploaded to the account by the Controller or its clients (including case files), the case records (each case with its stages, the people on it, its checklist, dates, notes and translations), e-signature envelopes with their audit trails and the signed documents, client portal messages, identity verification records (their results and details), signature requests and engagement letters, notes, tasks and appointments, and communication logs, as CSV and JSON tables and the original files. Identity numbers held in encrypted fields are left out of it. It does not include meeting recordings; MigrationPulse will provide a copy of those on the Controller's written request. Each export can be downloaded for 30 days after it is built.
During the Service. The Controller can delete records in the Service. Removing a client archives the record; deleting a client erases the client and case records but not the files uploaded for that client, which MigrationPulse deletes on the Controller's written request. The Service deletes some records on a fixed schedule and keeps others for a fixed period, as the Privacy Policy sets out. A completed identity check's record cannot be deleted before its period ends.
When the Service ends. MigrationPulse does not delete Client Data automatically when the Controller's account ends. It keeps the data under this DPA, protected as before, and deletes it on the Controller's written request, except Client Data the law requires it to keep and records within a fixed retention period, which it deletes when that period ends and the Controller has asked. Deleted data may remain for a limited time in backups before they are overwritten. This DPA continues to apply to any Client Data MigrationPulse keeps.
Upon reasonable written request, and subject to confidentiality, MigrationPulse will make available information necessary to demonstrate compliance with this DPA.
This DPA remains in effect for as long as MigrationPulse processes Client Data on the Controller's behalf. In the event of a conflict between this DPA and the Terms regarding the processing of Client Data, this DPA controls.
MigrationPulse Incorporated
Fajardo, Puerto Rico
Email: support@migrationpulse.app
Phone: (787) 468-3300