Privacy Policy

Effective Date: March 17, 2026

1. Who We Are

EB5Visa.io is operated by Bluecode Inc., a Delaware corporation ("we," "us," or "our"). We operate an online marketplace connecting EB-5 investors with Regional Centers, immigration attorneys, real estate developers, securities attorneys, migration agents, and broker-dealers.

Data Controller: Bluecode Inc.

Privacy inquiries: [email protected]

Data Protection Officer: [email protected]

Mailing address: Bluecode Inc., 8 The Green, Suite A, Dover, DE 19901

2. Data We Collect

We collect data that you provide directly and data generated through your use of the platform.

All Users

Full name, email address, handle, and password (hashed)
Profile information you choose to provide (bio, location, profile photo)
Content you post (posts, comments, messages) — including moderation scan results
Usage data: pages visited, features used, session duration, device and browser type
IP address and approximate geographic location
Marketing attribution data (UTM parameters) if you arrive via a marketing link

Investors (additional)

Investment capacity range (self-reported)
Source of funds declaration (self-reported; e.g., business income, real estate sale, gift, loan)
Accredited investor self-certification status
Outreach communication preference (outreach_opt_in)
Project inquiry history and saved projects

Regional Centers, Developers, Attorneys, Agents, Broker-Dealers (additional)

Professional credentials: bar admission numbers, USCIS designation IDs, FINRA CRD numbers, licensing jurisdiction(s)
Organization name, logo, and entity type
Verification documents uploaded for identity and credential verification
Team member information (for organizations with multiple users)
Project listing details, offering documents, and financial projections
Booking URLs and contact preferences for investor inquiries

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under GDPR Article 6:

Processing Activity	Legal Basis
Account creation and authentication	Contract performance (Art. 6(1)(b))
Platform features and communication	Contract performance (Art. 6(1)(b))
SEC Shield content scanning	Legitimate interest — regulatory compliance (Art. 6(1)(f))
Compliance audit trail (Blackbox)	Legal obligation — SEC recordkeeping (Art. 6(1)(c))
RC outreach communications	Consent (Art. 6(1)(a)) — withdrawable at any time
Analytics and platform improvement	Legitimate interest (Art. 6(1)(f))

4. How We Use Your Data

To provide, maintain, and improve the platform
To verify your identity and professional credentials
To scan content for regulatory compliance (SEC Shield) — content is analyzed for prohibited language before publication
To facilitate connections between investors and EB-5 professionals
To send transactional emails (account verification, inquiry notifications, security alerts)
To send RC outreach communications if you have enabled outreach_opt_in in your settings
To detect, investigate, and prevent fraud and platform abuse
To maintain compliance audit logs as required by SEC recordkeeping rules
To analyze aggregate, anonymized usage patterns for product improvement

5. Compliance Audit Trail (Blackbox)

Disclosure required by GDPR Art. 13/14: EB5Visa.io maintains an immutable compliance audit log of all significant platform activity. This log is a legally required record for regulatory compliance purposes.

The Blackbox Audit Trail records the following types of events:

Registration and profile changes for Professional users (Regional Centers, attorneys, agents)
Investor inquiry creation, status changes, and messaging activity
Content moderation actions taken by administrators
Administrator identity and action type for every moderation decision
Organization membership changes (invites, role changes, removals)

Audit logs are retained for 7 years from the date of recording, in accordance with SEC recordkeeping requirements under Exchange Act Rule 17a-4. These logs are immutable — they cannot be modified or deleted outside of a formal legal retention adjustment process.

Access to audit logs is restricted to super-administrators with verified god_mode credentials. Audit logs may also be disclosed to regulatory authorities (SEC, USCIS, FINRA) in response to valid legal requests.

7. Data Retention

Data Category	Retention Period
Active account data	Duration of account + 30 days after deletion request
Compliance audit logs (Blackbox)	7 years (SEC recordkeeping requirement)
Content moderation scan logs	2 years
Marketing attribution data	90 days
Analytics data (aggregated, anonymized)	Indefinite (not personal data)

8. Your Privacy Rights

GDPR Rights (EEA / UK residents)

Right of access: Request a copy of your personal data
Right to rectification: Correct inaccurate personal data
Right to erasure: Request deletion of your data (subject to legal retention obligations — audit logs cannot be erased within the legal retention period)
Right to portability: Receive your data in a machine-readable format
Right to object: Object to processing based on legitimate interest
Right to withdraw consent: Withdraw consent for outreach communications at any time via Settings → Privacy

CCPA Rights (California residents)

Right to know: Request disclosure of personal data collected, used, and shared
Right to delete: Request deletion of your data (subject to legal exceptions)
Right to opt out of sale: We do not sell personal data
Right to non-discrimination: We will not discriminate against you for exercising CCPA rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing certain requests.

9. RC Outreach Communications

If you are a registered investor, you may be contacted by Regional Centers with information about EB-5 investment opportunities if you have enabled the outreach preference in your account settings (outreach_opt_in = true).

This consent is optional and not required to use the platform. You may withdraw consent at any time by navigating to Settings → Privacy or by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

10. Cookies & Tracking

We use the following types of cookies:

Essential cookies: Required for authentication and session management. Cannot be disabled.
Analytics cookies: Used to understand how users interact with the platform. Anonymized aggregate data only.
Marketing attribution cookies: Track UTM parameters for 90 days to measure marketing campaign effectiveness.

You may control non-essential cookies through your browser settings. Disabling cookies may affect some platform functionality.

11. Children

EB5Visa.io is intended for users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected personal data from a child under 18, we will delete it promptly. If you believe we have inadvertently collected such data, contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the Effective Date at the top of this page. Continued use of the platform after an updated policy takes effect constitutes your acceptance of the changes.