CorpAtoll, a sole-trade business registered in the Republic of Maldives (“CorpAtoll”, “we”, “us”), helps international founders form and maintain U.S. companies. This Privacy Policy explains what personal data we collect, why we use it, how we protect it, who we share it with, and the choices and rights you have. It applies to corpatoll.com, the Client Portal, and our related services, including communication with us by email and WhatsApp.
For the purposes of data protection law, CorpAtoll is the controller of the personal data described here.
1. Data we collect
Data you give us
- Identity: full legal name, date of birth, nationality, passport number and a copy of your passport or other government ID, and a photo or selfie if identity verification requires it.
- Contact: email address, phone or WhatsApp number, and residential and mailing address.
- Business: proposed LLC name, business activity, ownership and management details, and intended use of the company.
- Tax: foreign tax identification numbers and supporting documents needed for IRS forms such as Form SS-4 (EIN) and Form W-7 (ITIN).
- Financial: BML transfer references, payment amounts and currency, and any bank or payment account details you provide for onboarding.
- Communications: messages you send us by email, WhatsApp, or the portal, and files you upload.
Data collected automatically
- Technical: IP address, device and browser type, approximate location derived from IP address, pages visited, referring page, and timestamps.
- Portal activity: login events and actions taken in the Client Portal, kept in activity logs for security and audit purposes.
- Cookies and similar technologies: see Section 8.
Data from others. We may receive information from state registries, the IRS, registered agents, banks and payment providers (for example, filing confirmations, EIN assignments, or account decisions), and from identity verification and sanctions screening providers.
2. How and why we use your data
| Purpose | Examples | Basis |
|---|---|---|
| Deliver the Services you order | Form your LLC, obtain your EIN or ITIN, arrange registered agent service, introduce banking partners | Contract |
| Verify identity and prevent fraud | KYC checks, sanctions screening, detecting duplicate or fake accounts | Legal obligation and legitimate interests |
| Process payments and keep records | Matching BML transfers to orders, invoicing, accounting, tax records | Contract and legal obligation |
| Communicate with you | Order updates, compliance deadline reminders, renewal notices, support replies | Contract and legitimate interests |
| Secure and improve the Services | Security monitoring, debugging, understanding how the site is used | Legitimate interests and, where required, consent |
| Marketing | Our starter guide and occasional updates you ask for | Consent (you can withdraw at any time) |
| Comply with the law | Responding to lawful requests from authorities, enforcing our Terms | Legal obligation and legitimate interests |
Where we rely on consent, you may withdraw it at any time, without affecting processing already carried out. We do not use your personal data for automated decisions that have legal or similarly significant effects on you, and we do not sell your personal data or use it for third-party advertising.
3. How we protect your data
We use technical and organizational safeguards designed for sensitive identity data:
- Encrypted, private document storage. Documents you upload are stored in a private, access-controlled storage bucket and are encrypted at rest.
- Encryption in transit. All traffic between your device and our services uses TLS.
- Access control. Only team members who need access to deliver your order can view your documents, and access is logged.
- Safe logging. Audit logs automatically strip known sensitive fields when they are written.
- Incident response. If a security incident is likely to put your rights at risk, we will notify you and, where required, the relevant authority, without undue delay.
No system is completely secure. CorpAtoll is not responsible for the leak, disclosure, or loss of your documents or personal data unless it results from CorpAtoll’s own fault, such as our negligence, our failure to apply the safeguards described above, or our misconduct. We are not responsible where a leak is caused by you or by third parties, for example if your login credentials, device, or email account are shared or compromised, if you send documents outside the portal (by email or chat), or after your data has been submitted to government registries, banks, or other third parties that operate under their own rules (some filings become public record). Please use a strong, unique password, never share your login credentials, and upload passport and tax numbers in the portal rather than sending them by plain email or chat.
4. Who we share your data with
We share personal data only as needed to provide the services you ordered or to meet legal duties:
- Government bodies: U.S. state registries (for example, New Mexico, Wyoming, or Delaware), the IRS and, where applicable, FinCEN.
- Service partners: registered agents, U.S. and international banking and payment partners you ask us to approach, and ITIN acceptance agents or certifying partners if your application needs them.
- Infrastructure and tools: hosting, database, storage, email, messaging (including WhatsApp), analytics, and identity verification providers that process data on our behalf under confidentiality and data-protection commitments.
- Professional advisers and authorities: our lawyers, accountants, and insurers where necessary, and courts, regulators, or law enforcement where we are legally required or it is needed to protect rights and safety.
- Business transfers: a successor to the business, if CorpAtoll is ever sold or restructured, subject to this Policy.
Note that information filed with a U.S. state registry (such as your LLC name and, depending on the state, the names of organizers or managers and the registered agent) may become public record. Banks and payment providers you apply to have their own privacy policies.
5. International transfers
We operate from the Maldives, and to deliver U.S. filings and banking introductions we must send data to the United States. Our service providers may also process data in other countries. Where required, we use contractual commitments, technical safeguards, and data minimization to protect your data when it leaves your country. By using the Services, you understand that your data will be transferred as described.
6. How long we keep your data
- Account and order records are kept while your account is active.
- Invoices, payment, and tax-related records are kept for the period required by law, typically seven years.
- Identity documents and uploaded files are kept while we provide ongoing services (such as registered agent or compliance) and for a limited period afterwards to handle disputes, renewals, and regulatory requirements, then deleted or irreversibly anonymized.
- Technical and activity logs are kept for a limited period, typically up to 24 months unless needed longer for security.
- Marketing preferences are kept until you unsubscribe.
You may ask for earlier deletion of data we are not legally required to keep. Please download copies of your LLC documents first, because deleting data from the portal may remove them.
7. Your rights and choices
Subject to applicable law, you can:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Export your data in a portable format (a JSON download is available in the portal);
- Delete your data, subject to our legal retention duties;
- Object to or restrict certain processing, including processing based on legitimate interests;
- Withdraw consent at any time, including for analytics, technical activity logging, identity verification, and marketing.
Most of these can be done yourself in Portal → Privacy Controls, or by emailing hello@corpatoll.com (or support@corpatoll.com if you are a portal user). We may need to verify your identity first. We will respond within 30 days and will tell you if we need more time or cannot fully comply, and why. Withdrawing identity-verification consent or deleting required information may stop us from completing or maintaining regulated filings such as LLC, EIN, or ITIN, and we may be unable to continue the related service.
If you are unhappy with our response, you may complain to the data protection authority in your country of residence or to the relevant authority in the Maldives. We would appreciate the chance to resolve your concern first.
8. Cookies and similar technologies
| Category | Purpose | Your choice |
|---|---|---|
| Strictly necessary | Login sessions, authentication, security, remembering your cookie choices, language and currency (USD/MVR) | Always on |
| Analytics | Understanding which pages are used so we can improve the site | Opt-in |
| Technical activity logging | Recording portal activity to help with support and security investigations | Opt-in |
You can change your choices at any time from the cookie banner or Portal → Privacy Controls, and you can also block cookies in your browser settings, although parts of the site may then stop working.
9. Communications
We send transactional messages (order updates, invoices, compliance deadlines, security notices) as part of the Services. You can unsubscribe from marketing emails at any time using the link in the email or by contacting us. If you contact us on WhatsApp, your messages are handled under WhatsApp’s own terms as well as this Policy. We will never ask for your password or full passport number in a chat message.
10. Children
The Services are for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
11. Third-party links
Our site may link to websites run by others, such as government portals, banks, or payment providers. We are not responsible for their privacy practices, so please read their policies.
12. Changes to this Policy
We may update this Policy to reflect changes in our practices or the law. For material changes, we will notify you through the portal or by email at least 14 days before they take effect, and we will update the “Last updated” date above.
13. Contact us
- General, privacy, and legal inquiries: hello@corpatoll.com
- Client Portal support (for portal users): support@corpatoll.com
- WhatsApp: +960 777 0000 (support hours in Maldives time, UTC+5)
- Support response time: we reply within 24 hours