Privacy Policy

City Registered Agent LLC (and, for California clients, City Registered Agent, Inc.) (together, “City Registered Agent,” “we,” “us,” or “our”) provides statutory registered agent services, optional state filing services, a secure client portal, and Andy – Business AI (together, the “Services”) through CityRegisteredAgent.com (the “Website”). This Privacy Policy explains what information we collect, how we use it, and the choices and rights you have.

It applies to website visitors, people who begin or complete enrollment, our clients, the contacts clients designate, and people who order a filing or document service from us on its own (such as a Change of Registered Agent filing, a Certificate of Good Standing, or certified copies of filed documents), whether or not they are clients. By using the Website or Services, you agree to this Privacy Policy.

1. Information We Collect

1.1 Information you give us

• Enrollment and account information: your name, legal business name, entity type, state, business address, email address, phone number, mobile number for text alerts, and login credentials.
• Designated contacts: the name, firm, title, address, email, and phone number of any secondary person you ask us to notify, and any email address you designate for document forwarding.
• Agreement records: your electronic signature, the date and time you signed (New York time), the IP address and country you signed from, and your electronic-consent acknowledgment. We record the IP address and country at the moment you sign, as evidence of your electronic signature, and print them with the date and time on your signed Client Agreement.
• Payment information: as described in Section 1.5, card and bank details go directly to our payment processor; we keep only the payment method and card brand (for some older accounts, the last four digits of the card).
• Filing-service information: the details needed to prepare a filing you purchase, such as your DOS ID or entity number and the information that appears on the filing.
• Stand-alone orders: when you order a Change of Registered Agent filing, a Certificate of Good Standing, or a certified copy of a filed document on its own, your name, email address, and phone number; the business name, entity type, state, and entity number; the document you request; the order terms you accept with your typed signature; and how you chose to pay. Card details are handled by our payment processor, not by us.
• Identity verification: if we ask you to verify your identity, the result of the check, and any government-issued identification, formation documents, or proof of authority you give us. ID images, selfies, and biometric identifiers are collected and held by our identity-verification provider, not by us, as described in Section 10.
• Communications: messages you send us by email, phone, text message, support ticket, website chat, or the client portal.
• Andy conversations: what you type to Andy – Business AI and Andy’s replies (see Section 4).
• Standing Check requests: the business name, state, and email address you enter to receive a free Good Standing audit.
• Partially completed enrollments: if you begin enrollment and enter your email address, we save what you have entered so far (such as your name, business name, state, and plan) to send you one reminder to finish.
• Sign-in with Google: if you choose “Continue with Google,” we receive your name, email address, and profile picture from Google, and nothing else. We do not receive your Google password.
• Outside AI apps you connect: you can connect an outside artificial-intelligence app or assistant to your client account through our secure authorization page. The app can use only the account tools that page lists, acting for you, which can include reading your account information, and only after you sign in and approve it; what the app does with that information is governed by its own privacy policy. You can disconnect it at any time by removing the connection in that app; contact us if you need help.

1.2 Information we receive on your behalf

As your registered agent, we receive service of process, legal notices, and official state correspondence addressed to your business. This mail leaves City Registered Agent only (a) to the service providers that act for us under written contracts, including our mail receipt and scanning providers, Stable and LegalZoom Virtual Mail, which receive, scan, and store it at our registered agent addresses on our behalf, and the other providers listed in Section 5.1; (b) to you and the people you authorize; and (c) when the law requires it (Section 5.4). We post the scans to your client portal and otherwise keep them confidential.

1.3 Information collected automatically

• Device and usage data: IP address, browser and device type, pages viewed, and referring pages.
• Account security records: login times, failed login attempts, account changes, and a log of when documents in your portal are viewed or downloaded. For failed or suspicious logins, we record the approximate location (city and state) derived from the IP address.
• Cookies: see Section 8.

1.4 Information from public sources

We look up public records of state business filing offices to verify entity details, run Standing Checks, and prepare filings.

1.5 Payment information

2. How We Use Information

We use information only to:

• Act as your registered agent: receive, scan, deliver, and notify you of documents served on your business.
• Prepare and submit filing services you purchase.
• Create and secure your account, process payments and renewals, and send invoices, receipts, and renewal reminders.
• Send service notifications by email and, if you opt in, by text message.
• Answer your questions, including through Andy, and provide customer support.
• Verify identity (including through the ID-and-selfie check described in Section 10), prevent fraud, and protect accounts and our systems.
• Send one reminder about an unfinished enrollment and, if you request a Standing Check, your audit and related information about our Services. You can unsubscribe at any time.
• Understand how the Website is used so we can improve it (using analytics only with your consent) and, only if you choose “Accept all,” measure and personalize our advertising (Section 8).
• Comply with law, sanctions screening obligations, and lawful requests from authorities, and enforce our agreements, including collecting past-due amounts (Section 5.6).

3. Confidentiality of Documents Received on Your Behalf

Service of process and other documents we receive for you are made available only to you, your authorized person, anyone you designate to be notified, and City Registered Agent staff who need them to perform the Services. Staff access is limited by role and logged. We do not review the substance of your documents except as needed to handle, scan, and deliver them, or when you ask Andy to read one for you.

4. Andy – Business AI

Andy is an artificial-intelligence assistant available on the Website and in the client portal. When you use Andy:

• What Andy sees: your messages and Andy’s replies. If you are a logged-in client, Andy can also read your own account records and, when you ask, a document in your account. Andy is technically restricted to the logged-in client’s own records and cannot access any other client’s account.
• AI providers: to generate a reply, your message and the relevant account or document information are sent to artificial-intelligence and web-search providers that process it on our behalf. They may not sell it or use it for their own purposes.
• Human review: authorized staff may review Andy conversations to provide support, investigate problems, ensure security, and improve accuracy.
• Account actions: Andy acts on your account only when you ask and after you confirm. Andy cannot change your email address, phone number, or tax ID.
• No automated decisions: Andy’s answers are informational. We do not use Andy to make decisions that have legal or similarly significant effects on you.
• Please don’t share sensitive data: do not enter Social Security numbers, full bank or card numbers, passwords, or health information.
• Your choice: using Andy is optional. You can reach us by email, phone, or support ticket instead, and you may ask us to delete your Andy conversation history, subject to Section 7.

Andy’s terms of use are in Section 3 of our Terms of Use and, for clients, in the Client Agreement.

5. When Information Leaves City Registered Agent

We disclose client information only in the following limited situations: to service providers acting for us under written contracts (Section 5.1), including our mail receipt and scanning providers and our IP-geolocation lookup provider; to state filing offices (Section 5.2); to people you authorize (Section 5.3); when the law requires it or to protect rights (Section 5.4); in a business transfer (Section 5.5); and to a collection agency for a past-due account (Section 5.6). In every other case, it stays with us.

5.1 Service providers acting on our behalf

These companies operate parts of our Services for us. They receive only the information needed for their task, must keep it confidential and secure, and may not use it for their own purposes, except the limited use by our identity-verification provider that you separately consent to (Section 10.6).

Signed agreements are stored in a Google Drive account we control.

5.2 State filing offices

When you purchase a filing, certificate, or certified copy, we submit the information the state requires to the applicable state filing office. Information on state filings becomes public record under state law. When we serve as your registered agent, our address — not yours — appears as your registered agent address.

5.3 People you authorize

We notify or share documents with a secondary contact or forwarding email address only because you designated them. If you connect an outside app to your account (Section 1.1), it receives the account information you authorized.

5.4 Legal requirements and protection

We may disclose information when required by law, subpoena, or court order; to comply with U.S. sanctions laws; to enforce our agreements, including in a court case or arbitration to collect an amount owed; or when we believe in good faith it is necessary to prevent fraud or protect the rights, property, or safety of our clients, our company, or others. Where the law allows, we will notify you before disclosing your information in response to legal process.

5.5 Business transfer

If City Registered Agent is merged, acquired, or sells its assets, client records may transfer to the successor, which must honor this Privacy Policy. We will notify you by email before your information becomes subject to a different privacy policy.

5.6 Collection agency for past-due accounts

If an amount you owe remains unpaid at least 30 days after its due date and we have given you written notice, we may refer the account to an unaffiliated, licensed third-party collection agency, as the Client Agreement describes. We then give the agency only what it needs to collect the amount owed: your name, business name, contact details, the services, invoices, amounts owed, and payment history. The agency must comply with the debt collection laws that apply to it. We do not sell past-due accounts or give the agency your documents, Andy conversations, or identity-verification information.

6. How We Protect Information

• Encryption of data in transit (TLS) and encrypted storage with our hosting and storage providers.
• Role-based staff access, a signed confidentiality agreement for staff, and logs of who viewed or downloaded client documents.
• Login lockouts after repeated failed attempts, login alerts, and automatic sign-out of idle sessions.
• Email confirmation of contact-information changes, with a link to reverse any change you did not make.
• Identity-verification results are stored without ID images, ID numbers, dates of birth, or biometric identifiers (see Section 10).

No system is completely secure. If a breach affects your personal information, we will notify you and any regulators as required by law.

7. How Long We Keep Information

• Active accounts: account records and scanned documents are kept while your service is active.
• Original paper documents: kept for forty-five (45) days after receipt, then securely shredded, unless you ask us to send you the original.
• After your service ends: you keep read-only portal access for 365 days after your service ends. We email you a reminder 7 days before that period ends. Then your portal access ends and the documents stored in your portal are deleted from your account, so they can no longer be opened through our Services. Our hosting provider does not let us erase the underlying stored file directly; any such copy stays only in its secure storage and is not used.
• Legal, tax, payment, and agreement records: signed agreements, invoices, payment and refund records, and records needed for legal or tax purposes are kept for up to seven (7) years after your service ends.
• Andy conversations: stored by our hosting platform with your account. Our hosting platform does not yet let us delete them automatically, so they are not covered by the automated deletions below; you may ask us to delete your Andy conversation history at any time (Section 4), and we will have it deleted.
• Account security records: failed-login, lockout, phone-verification, and rate-limit records are deleted seven (7) years after they are created. Logs of account changes and document views for your account are kept while your account is open and deleted with your account records seven (7) years after your service ends.
• Stand-alone orders: order records, the order terms you accepted, and payment records are kept for up to seven (7) years after the order, and then deleted; copies of certificates and certified copies we obtain for you are kept for up to 365 days after we deliver them.
• Unfinished enrollments and Standing Check requests: deleted 24 months after you started them, or sooner if you ask us.
• Identity verification: as set out in Section 10.7.
• Legal holds: if the law, a pending fraud investigation, or a legal claim requires us to keep information longer, we keep it until that reason ends, and then delete it.

Deletions from our client database and identity-verification redactions are made by an automated process that runs every day, and each one is logged.

8. Cookies and Analytics

How Google Analytics runs on our Website. We use Google Analytics in Google Consent Mode. Unless one of the exceptions below applies, the Google tag loads in the background when you visit our Website. Until you choose “Accept all” or “Analytics only” in our cookie banner (and also if you choose “Reject”), Consent Mode keeps analytics and advertising storage turned off: no Google Analytics or advertising cookies are set or read, and the tag sends Google only cookieless pings, which carry information such as the page address, the time, your browser type, the referring page, and your consent choice, and which Google may use in aggregate, for example to estimate visits that cannot be measured directly.

• Visitors in the EU, EEA, United Kingdom, and Switzerland. If your browser’s time zone is in one of these places, the Google tag does not load at all, and not even cookieless pings are sent, until you choose “Accept all” or “Analytics only.” We work this out from your browser’s time-zone setting only, not from your IP address.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, the Google tag never loads and nothing is sent to Google.
• Essential cookies keep you signed in, secure your session, and remember your cookie choice. They cannot be turned off without breaking the portal.
• Analytics cookies (Google Analytics) measure how the Website is used. They are placed only if you choose “Accept all” or “Analytics only” in our cookie banner.
• Advertising cookies (Google Analytics advertising features, including Google signals and advertising personalization) let Google measure the results of our ads and show personalized ads, including to people who visited our Website. They are used only if you choose “Accept all.” Until then, Google Consent Mode keeps every advertising signal turned off.
• Never on identity-verification pages. Google Analytics and its advertising features are turned off completely on our identity-verification pages and on our Consumer Health Data Privacy Policy page. Whatever you choose in the cookie banner, nothing from those pages, including page views, events, cookie identifiers, and advertising signals, is sent to Google, and biometric and other consumer health data is never used for advertising (Section 10).
• Google Analytics data sharing. Our Google Analytics account allows Google to use Analytics data to provide and improve its products and services, for benchmarking, and for technical support, as described in Google’s “How Google uses information from sites or apps that use our services” (policies.google.com/technologies/partner-sites). This data comes only from your use of our public Website, never from your client records, documents, or payment information.

We do not use social-media or other retargeting pixels. You can change your choice at any time with “Your Privacy Choices” at the bottom of every page, by clearing your browser’s site data, or by blocking cookies in your browser settings. You can also opt out of personalized Google ads at adssettings.google.com. We honor Global Privacy Control signals: if your browser sends one, we do not load Google Analytics at all and treat the signal as your opt-out of sale, sharing, and targeted advertising. Because there is no common standard, we do not respond to “Do Not Track” browser signals.

9. Text Messages

If you opt in to text alerts, we use your mobile number only to send account and service notifications, such as notice that a document was received. Mobile numbers and text-message opt-in data and consent are not shared with any third party or affiliate for marketing or promotional purposes. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help, or change your preference in the client portal.

10. Identity Verification

We may ask the person who acts for a client account to verify their identity, at enrollment or later, for example before an important change to the account, when we see signs of fraud or impersonation, or when the law requires it. This Section explains how the check works, what is collected, and your rights. It is also our written policy on biometric information, including our retention schedule, our guidelines for destroying it, and our incident-response commitment (Section 10.8).

Washington and Nevada residents. The biometric data used in the ID-and-selfie check is “consumer health data” under Washington and Nevada law. Our Consumer Health Data Privacy Policy explains your rights; a summary is in Section 10.13.

10.1 How the check works

The check is performed by Stripe Identity, an identity-verification service of Stripe, Inc. (“Stripe”), on Stripe’s own secure web page. You take a photo of a government-issued photo ID (such as a driver's license, state ID card, or passport) and a live selfie with your phone or computer camera. The provider checks that the ID appears genuine, unaltered, and unexpired, and then uses facial-recognition technology to compare your selfie with the photo on the ID. To do this, it creates measurements of facial geometry from both images (a "biometric identifier"). Most checks finish within a few minutes.

10.2 What is collected, and by whom

Collected and held by our provider:

• images of the front and back of your ID, and the information printed on it, such as your name, date of birth, address, ID number, issuing state or country, and expiration date;
• your selfie and the images captured while it was taken;
• the biometric identifiers created from your selfie and ID photo; and
• device and connection information, such as IP address, browser and device type, and approximate location, used to detect fraud.

About Stripe. We use Stripe Identity, from Stripe, Inc., to verify your identity. Stripe collects name, email, phone number, address, facial images, identity document images, and ID numbers, as well as advanced fraud signals and information about the devices that connect to its services. Stripe uses biometric technology (facial-geometry measurements) to compare your selfie with the photo on your ID. Stripe shares this information with us (we keep only the result described below) and also uses this information to operate and improve the services it provides, including for fraud detection. You may also choose to allow Stripe to use your data to improve Stripe’s biometric verification technology. Stripe retains a copy of the data provided as part of a verification. You can learn more about Stripe and read its privacy policy at stripe.com/privacy; Stripe’s privacy information for Stripe Identity users is at stripe.com/privacy-center/legal#stripe-identity.

Received and kept by City Registered Agent: only whether verification has not been started, is pending, is processing, has been verified, or has failed; the date and time; the provider's reference number for the check; and, if it failed, a short reason code (such as "document expired" or "selfie did not match"). Our website, client portal, and employee portal do not store your ID images, selfie, ID number, date of birth, or biometric identifiers, and our employees cannot see them there. Access to the provider's records is limited to authorized management personnel, and only to investigate suspected fraud, resolve a question about a result, respond to your request, or comply with law.

10.3 Why we use it

We use identity verification only to:

• confirm that you are who you say you are and that you are authorized to act for the client;
• protect client accounts, registered agent mail, and legal documents from impersonation and unauthorized changes;
• prevent fraud and identity theft, and prevent use of our services to hide who controls a business or to evade service of process (see Section 7 of our Terms of Use);
• comply with law, including U.S. sanctions requirements; and
• investigate and resolve disputes about a verification.

We do not use identity-verification information or biometric identifiers for marketing or advertising, to build profiles, to train artificial-intelligence models, or to decide whether you qualify for credit, insurance, employment, or housing.

10.4 Your consent and your choices

• Our consent first. On our verification page, before you continue to the provider, you must check two separate boxes: one giving your written consent, signed electronically, to the collection and use of your biometric identifiers for the check as described in this Section; and one agreeing that the provider may also use your verification information as an independent business, as described in Section 10.6. You cannot continue unless you check both.
• The provider’s notice. Before any image is captured, the provider’s own page then tells you what will be collected and why, explains that biometric technology will be used on your images, and asks you to agree or decline. No biometric identifier is collected unless you give both of our consents and the provider’s, and none is collected if you decline.
• Optional permission for the provider. The provider may separately ask your permission to use your images to improve its own technology. That permission is optional, and saying no does not affect your verification.
• Another way to verify. If you do not want facial recognition used, or you cannot complete the check, choose “Request another way to verify” on our verification page or contact us, and we will arrange a live video check with a member of our staff instead: you show your government-issued photo ID on camera, no facial recognition is used, and no copy of your ID is kept.
• If you decline. If you decline both the check and the alternative, we may be unable to complete some requests, and the Client Agreement explains when we may delay, suspend, or end the Services.
• Withdrawing consent. You may withdraw your consent at any time by emailing [email protected]. We will then have the provider delete your verification information as described in Section 10.7. Withdrawing does not undo a check already completed, but we may need to confirm your identity another way before acting on an account request.

10.5 Automated results and human review

The provider's result is automated. If a check fails, we will tell you the general reason and let you try again. You may ask a member of our staff to review the result, and you may use the alternative method in Section 10.4. We will not close your account or refuse the Services based only on an automated result without first giving you those options. If a member of our management team confirms your identity through the alternative method, your status shows as “Verified (manual review)”.

10.6 Who receives verification information

Our provider processes verification information on our behalf as our service provider, must protect it, and may use it only to perform the check. The provider may also use it as an independent business for limited purposes, such as fraud prevention, security, and legal compliance, under its own privacy notice, which it shows you before you begin (Stripe’s privacy policy: stripe.com/privacy).

We do not sell, lease, trade, or otherwise profit from identity-verification information or biometric identifiers, and we do not share them for advertising. We disclose them only: (a) to our provider; (b) with your consent; (c) to complete a transaction you request or authorize; (d) when required by federal, state, or local law; or (e) in response to a valid warrant or subpoena.

10.7 How long it is kept, and how it is destroyed

When information is due for deletion, or you ask us to delete it, we instruct Stripe to permanently delete (“redact”) the verification from its systems, including the images, the information read from your ID, the biometric identifiers, and related records. Our system does this automatically every day for each check whose thirty (30) days have passed, and Stripe usually finishes within four days. We treat the purpose of a check as fulfilled thirty (30) days after it is finished, which leaves time for questions and disputes about the result. Because Stripe may keep its own copy for its own purposes (Section 10.6), you can also ask Stripe to delete your information or withdraw your consent to its use through Stripe support at support.stripe.com. If the law, a pending fraud investigation, or a legal claim requires us to keep any of it, we will tell you what we kept and why, and delete it when that reason ends. In every case, biometric identifiers are deleted by the earliest of: when the purpose of the check is fulfilled; one (1) year after collection; and forty-five (45) days after we determine they are no longer necessary.

10.8 Security

Verification information is encrypted in transit and at rest, and access to it is limited and logged. We treat biometric and ID information as "private information" under the New York SHIELD Act and similar laws and protect it with reasonable administrative, technical, and physical safeguards. If a breach affects it, we will notify you and regulators as required by law, including N.Y. Gen. Bus. Law § 899-aa.

Incident response. We keep a written incident-response protocol for biometric and ID information. If we learn of a security incident that may affect it, we will act promptly to contain it, work with our provider to investigate what happened and what information was involved, notify affected people and regulators within the time the law requires, and take steps to prevent it from happening again.

10.9 This is not a credit check

Identity verification is not a credit check or a background check. We do not obtain a consumer report to verify your identity, the check does not appear on or affect your credit report, and we do not use the result for any purpose covered by the federal Fair Credit Reporting Act or the New York Fair Credit Reporting Act (N.Y. Gen. Bus. Law § 380 et seq.), such as decisions about credit, insurance, employment, or housing. If we ever obtain a consumer report about you, we will do so only for a purpose those laws permit. If we take adverse action based in whole or in part on a consumer report, we will give you the notice the law requires. That notice includes the name and contact information of the consumer reporting agency, a statement that the agency did not make the decision, and your right to get a free copy of the report and dispute its accuracy.

10.10 Rights under federal, state, and international law

We apply this Section to everyone who completes identity verification, wherever they live. In particular:

• Federal law. Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive practices, and the Federal Trade Commission’s May 18, 2023 Policy Statement on Biometric Information explains how that applies to biometric information. Consistent with that statement, we tell you clearly how biometric information is used, use it only for identity verification and fraud prevention, rely on a provider that is bound by contract to protect it, limit and log staff access, and offer a non-biometric alternative. The Children’s Online Privacy Protection Act treats biometric identifiers of children under 13 as personal information; identity verification is only for adults (Section 10.12). The Fair Credit Reporting Act is addressed in Section 10.9.
• Illinois. This Section is our publicly available written policy under the Illinois Biometric Information Privacy Act (740 ILCS 14/15), including our retention schedule and destruction guidelines. We obtain a written release before any biometric identifier is collected, and we never sell, lease, trade, or otherwise profit from it.
• Texas and Washington. We give notice and obtain consent before a biometric identifier is captured, we do not sell it, and it is destroyed within one year (Tex. Bus. & Com. Code § 503.001; Wash. Rev. Code ch. 19.375).
• Colorado. Under Colorado’s biometric identifier law (Colo. Rev. Stat. § 6-1-1314), this Section is our written policy, with our retention schedule (Section 10.7), our incident-response protocol (Section 10.8), and our deletion guidelines: biometric identifiers are deleted by the earliest of when the purpose of the check is fulfilled, one year after collection, and 45 days after we determine they are no longer necessary. Before collection we tell you that biometric identifiers are being collected, why, how long they are kept, and that our identity-verification provider processes them. We do not sell, lease, or trade them, and we will not refuse the Services because you decline biometric verification; you may use the alternative in Section 10.4.
• California. Biometric information and government ID numbers are "sensitive personal information." We use them only for purposes California law permits, and you have the rights described in Section 11.1.
• States with comprehensive consumer privacy laws. The consumer privacy laws in force in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island treat biometric data used to identify a person as sensitive data. We process it only with your consent, you may withdraw that consent at any time, and you may appeal our decision on any request as described in Section 11.2.
• Maryland. Under the Maryland Online Data Privacy Act (Md. Code, Com. Law § 14-4701 et seq.), we collect and process biometric data only when it is strictly necessary to verify identity for the Services you request, and we never sell it.
• Consumer health data (Washington and Nevada). Washington’s My Health My Data Act (Wash. Rev. Code ch. 19.373) and Nevada’s consumer health data law (Nev. Rev. Stat. ch. 603A) give additional rights. See our Consumer Health Data Privacy Policy.
• New York. We protect biometric and ID information as "private information" under the New York SHIELD Act (N.Y. Gen. Bus. Law §§ 899-aa and 899-bb), as described in Section 10.8.
• Every other state. Residents of every other state, and of states whose laws take effect later, receive the same notice, consent, retention, destruction, security, and no-sale protections described in this Section.
• European Union, United Kingdom, and Switzerland. Where these laws apply, we rely on your explicit consent for biometric data (GDPR Article 9(2)(a) and the equivalent UK and Swiss rules) and on our legitimate interest in preventing fraud for the document check. You may withdraw consent at any time, ask for access, correction, deletion, restriction, or a copy of your information, object to processing, and ask for human review of an automated result (GDPR Article 22). Transfers to the United States are protected by recognized safeguards, such as Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. You may complain to your local data protection authority. See also Section 13.1.

10.11 Verifying privacy requests

When you make a privacy request under Section 11, we confirm your identity by matching the details on your account or asking you to confirm through your portal login. We will not require the ID-and-selfie check to make a privacy request.

10.12 Age

Identity verification is only for adults 18 and older. If a check shows that the person is under 18, we will not use the result and will have the provider delete it.

10.13 Consumer health data (Washington and Nevada residents)

10.14 Questions

Email [email protected] or use the chat on our Website.

11. Your Choices and Rights

Every client and visitor may ask us to:

• Tell you what personal information we hold about you and give you a copy;
• Correct inaccurate information (most details can be updated in the client portal);
• Delete your information, except records we must keep to provide active registered agent service or to meet legal, tax, or dispute obligations; and
• Stop marketing emails (use the unsubscribe link or contact us).

We will not treat you differently for exercising these rights.

11.1 California residents

This Section is our notice at collection and our privacy policy under the California Consumer Privacy Act, as amended (Cal. Civ. Code § 1798.100 et seq.), and its regulations (Cal. Code Regs. tit. 11, § 7000 et seq.). We extend these rights to California residents whether or not the CCPA applies to us.

What we collect, why, from whom, who receives it, and how long we keep it. In the past 12 months we collected and disclosed the following categories. We disclosed each of them only for a business purpose, to the recipients listed:

We do not collect inferences about you, and we do not use personal information for purposes other than the business purposes listed above.

• No sale; sharing only with your opt-in. We do not sell personal information, and we have not sold it in the past 12 months. If you choose “Accept all” in our cookie banner, we share identifiers (cookie and device identifiers) and internet activity on our Website with Google for cross-context behavioral advertising (Section 8). We do not share any other category, and we do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.
• Sensitive personal information. We use and disclose sensitive personal information only for the purposes permitted by Cal. Code Regs. tit. 11, § 7027(m): to provide the Services you request, to verify your identity, to prevent, detect, and investigate security incidents, and to resist fraudulent or illegal actions. Because we use it only for those purposes, the right to limit its use does not apply, and we do not offer a separate “limit” link.
• No automated decisions. We do not use automated decision-making technology to make significant decisions about you. Identity-verification results can always be reviewed by a person (Section 10.5).

Your rights. If you are a California resident, you have the right to:

• Know and access: the categories and specific pieces of personal information we collected about you, the categories of sources, our business purposes, and the categories of recipients;
• Delete: personal information we collected from you, subject to legal exceptions, such as records we must keep for tax or legal purposes;
• Correct: inaccurate personal information;
• Opt out of sale or sharing: we do not sell personal information. To opt out of sharing for advertising, choose “Analytics only” or “Reject” under “Your Privacy Choices” at the bottom of every page, or turn on Global Privacy Control in your browser, which we honor as an opt-out (Section 8);
• Limit the use of sensitive personal information: as explained above, this right does not apply because we use sensitive personal information only for permitted purposes; and
• No discrimination or retaliation: we will not deny you service, charge a different price, or provide a different quality of service because you exercised a privacy right.

How to submit a request, verification, and authorized agents. Submit a request as described in Section 11.3. We verify your identity by matching the details on your account or asking you to confirm through your portal login; we will not require the ID-and-selfie check. An authorized agent may submit a request with your signed permission, and we may ask you to confirm your identity directly and to confirm that you gave the agent permission. Timing: we confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we will tell you in writing and may take up to 45 more days.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes. You may ask about this by emailing [email protected].

Do Not Track and Global Privacy Control (Cal. Bus. & Prof. Code § 22575). We do not respond to “Do Not Track” browser signals because there is no common standard. We do honor Global Privacy Control signals as an opt-out preference signal and treat them as declining analytics and advertising cookies and as an opt-out of sale and sharing (Section 8). Other than Google, through Google Analytics and only with your cookie consent, we do not allow third parties to collect personal information about your online activities over time and across other websites through our Website.

Last updated and review. This policy was last updated on the date shown at the top of this page. We review and update it at least once every 12 months.

11.2 Residents of other states

Residents of states with comprehensive consumer privacy laws, including those listed in Section 10.10, have similar rights: to confirm whether we process their personal data and to access it, to correct and delete it, to get a portable copy, and to opt out of targeted advertising, sale, and profiling. We do not sell personal information or engage in profiling; targeted advertising happens only through Google Analytics advertising cookies and only if you opt in (Section 8), and you can opt out at any time with“Your Privacy Choices” or a Global Privacy Control signal. We extend these rights to residents of every state. If we deny a request, you may appeal by replying to our decision with the word “Appeal.” We will respond to your appeal in writing within the time your state’s law requires and, if we deny it, tell you how to contact your state attorney general. These rights include withdrawing consent to our processing of sensitive data, such as biometric data (see Section 10.4).

11.3 How to make a request

Email [email protected] with the subject “Privacy Request.” You may also send your request through the chat on our Website or, if you are a client, through Andy in your client portal, and we will handle it the same way. We do not take requests by telephone. Because we operate exclusively online and have a direct relationship with the people whose personal information we collect, California law allows us to offer an email address as the method for requests to know, delete, or correct (Cal. Civ. Code § 1798.130(a)(1)(A)), and our Website is also available for submitting them. To protect your documents, we will verify your identity by matching the details on your account or asking you to confirm through your portal login. We will not require you to complete the ID-and-selfie check described in Section 10 to make a privacy request. An authorized agent may submit a request with your signed permission, and we may still ask you to confirm your identity. We confirm receipt within 10 business days and respond within 45 days, and will tell you in writing if we need up to 45 more.

12. Children

The Services are for businesses and adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

13. Visitors Outside the United States

Our Services are provided in the United States. If you use the Website from another country, your information will be processed in the United States, where privacy laws may differ from those in your country.

13.1 European Union, EEA, United Kingdom, and Switzerland

When this applies. We are established only in the United States. The EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection may still apply to personal data of people in those places when we offer our Services to them or monitor their use of our Website (for example, through analytics cookies used with consent) (GDPR Article 3(2)).

Controller and privacy contact. The controller of your personal data is City Registered Agent LLC or, for California clients, City Registered Agent, Inc., 228 Park Ave S #40708, New York, NY 10003-0103. Privacy contact for residents of the EU, EEA, United Kingdom, and Switzerland: Privacy Agent, 228 Park Avenue South - Suite 40708, New York, NY 10003-0103, [email protected].

Purposes and legal bases. Where these laws apply, we process personal data for the purposes in Sections 1, 2, and 5 on these legal bases:

• Providing the Services (acting as your registered agent, receiving and forwarding documents, filings you buy, your account and portal, and Andy’s account actions): performance of our contract with you, or steps you ask us to take before entering into it (Article 6(1)(b)).
• Payments, invoices, renewals, and refunds: performance of our contract (Article 6(1)(b)); keeping tax and accounting records: legal obligation (Article 6(1)(c)) where EU, EEA, UK, or Swiss law requires it, and otherwise our legitimate interest in complying with the U.S. laws that apply to us (Article 6(1)(f)).
• Sanctions screening and responding to lawful requests: legal obligation where EU, EEA, UK, or Swiss law requires it, and otherwise our legitimate interest in complying with U.S. law (Article 6(1)(c) or (f)).
• Security, fraud prevention, and protecting accounts and documents, including the document check in Section 10: our legitimate interests in keeping our Services and our clients safe (Article 6(1)(f)).
• Biometric data in the ID-and-selfie check: your explicit consent (Article 9(2)(a)); you may use the non-biometric alternative instead (Section 10.4).
• Analytics and advertising cookies, optional text messages, and marketing emails: your consent (Article 6(1)(a)), which you may withdraw at any time without affecting earlier processing. Cookies that are not strictly necessary are used only with consent, as described in Section 8.
• Answering visitors’ questions through Andy or chat, and improving our Services: our legitimate interests (Article 6(1)(f)).
• Collecting past-due amounts and enforcing our agreements: our legitimate interests, including establishing, exercising, or defending legal claims (Article 6(1)(f)).

Do you have to give us your data? The information marked as required at enrollment is needed to enter into and perform the Client Agreement and for us to act as a registered agent under state law; without it we cannot provide the Services. Other information is optional.

International transfers. We are based in the United States, and we and our service providers process personal data there. Where the GDPR, the UK GDPR, or Swiss law requires a transfer mechanism, we rely on the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. Data Privacy Framework) for recipients certified under it, on the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum or Agreement, or, where they apply, on the derogations in GDPR Article 49 (for example, where a transfer is necessary to perform our contract with you). You may ask us for more information about these safeguards at the privacy contact above.

Your rights. You may ask for access to, correction of, or deletion of your personal data; ask us to restrict processing; receive your data in a portable format; object to processing based on legitimate interests, and to direct marketing at any time; withdraw consent; and ask for human review of any decision based solely on automated processing (we do not make such decisions, and identity-verification results can always be reviewed by a person, Section 10.5). We respond within one month, which the law allows us to extend by two more months for complex requests. You also have the right to lodge a complaint with a supervisory authority, such as the data protection authority where you live, work, or where you believe a violation occurred, the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint), or the Swiss Federal Data Protection and Information Commissioner.

Retention. We keep personal data for the periods in Section 7 and Section 10.7.

13.2 Clients outside the United States

If you or your business are outside the United States, the information you and your contacts give us is transferred to, processed in, and stored in the United States, where the law may differ from the law of your country. By enrolling, you acknowledge this transfer, and you are responsible for giving any notice and getting any consent that your local law requires for information you give us about other people (such as owners, officers, and contacts). Your Client Agreement (Section 33, International Clients) and our Terms of Use (Section 15) also apply. We screen clients against U.S. and United Nations sanctions and restricted-party lists as described in Section 19 of the Client Agreement, and we may share information with government authorities when sanctions law requires it.

13.3 Language

This Privacy Policy and our privacy notices are provided in English only, and the English version controls. Any translation, whether by your browser, a machine-translation or artificial-intelligence tool (including Andy), or a person, is for convenience only, is at your own risk, and is not binding. This does not limit any privacy right you have under the law.

13.4 Canada

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial private-sector privacy laws govern how we handle your personal information. We collect, use, and disclose it only for the purposes described in Sections 1, 2, and 5, with your consent, which you give when you provide information and use the Services, and which we obtain expressly for sensitive information such as biometric data (Section 10). You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, although we may then be unable to provide some or all of the Services. Your information is stored and processed in the United States by us and our service providers, and it may be accessible to courts, law enforcement, and national security authorities there under U.S. law. Our privacy officer can be reached at [email protected] or by mail at the address in Section 15. You may ask to access the personal information we hold about you and to have it corrected, and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3 (priv.gc.ca/en/report-a-concern).

13.5 Mexico

If you are in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) may apply. You may exercise your rights of access, rectification, cancellation, and opposition (“ARCO” rights), and withdraw your consent, by emailing [email protected] with your name, a description of the personal data and the right you want to exercise, and a way for us to confirm your identity. We will respond within the time the law requires. You may also contact the Mexican authority responsible for personal data protection.

14. Changes to This Policy

We may update this Privacy Policy. When we do, we will post the new version on this page with its “Last Updated” and “Effective” dates.

• 45 days’ notice. We will notify clients of changes to this Privacy Policy at least forty-five (45) calendar days before they take effect, by email to the address on file and by a notice in the client portal.
• Continuing to use the Services. By continuing to use the Services after the effective date, you agree to and accept the updated Privacy Policy.
• If you do not agree. You may cancel your service before the effective date in the client portal or by emailing [email protected]. Your cancellation options and any refund are governed by your Client Agreement.
• Your consent for new uses. Where the law requires it, we will ask for your affirmative (opt-in) consent before we use personal information we have already collected in a way that is materially different from what we described when we collected it.

15. Contact Us

• City Registered Agent LLC (and, for California clients, City Registered Agent, Inc.)
• Privacy requests: [email protected]
• General support: [email protected]
• Billing: [email protected]
• Chat: the chat on our Website, or Andy in the client portal
• Mail: City Registered Agent, 228 Park Ave S #40708, New York, NY 10003-0103