Privacy Policy

migraDOCS is operated by [Company name and registered address]. We provide a service that helps users understand immigration documents and navigate immigration processes.

We are the data controller for the personal data described in this policy. Contact us about data protection matters at privacy@migradocs.org.

Waitlist (before launch)

• Email address — to notify you when the service launches.

Account registration and use

• Email address and display name (via Google sign-in)
• Google account identifier (used to link your account)
• Google Drive folder identifier (to store your documents in your own Drive)

Immigration process data

• Text descriptions of your immigration situation that you enter
• Process plans, steps, and checklist items that you create or that are generated on your behalf
• Document file names and metadata (the actual files are stored in your own Google Drive, not on our servers)

Technical data

• Server logs (including IP addresses) retained for up to 30 days for security and debugging purposes

When you describe your immigration situation, the text you enter may be sent to Anthropic PBC (San Francisco, USA) for AI processing. Anthropic acts as our data processor under a Data Processing Agreement that includes Standard Contractual Clauses (SCCs) for EU–US data transfers.

Anthropic does not use API inputs to train its models. Your data is processed only to generate a response and is not retained by Anthropic beyond that request.

We use pre-built process templates where possible to avoid sending your data to the AI entirely. AI is only invoked when no matching template exists for your situation.

Your account data and process plans are stored in Supabase (PostgreSQL database). Our Supabase project is hosted in the EU. Your documents are stored in your own Google Drive account, governed by Google's privacy policy.

The Anthropic API is based in the United States. Data sent to the API is transferred under Standard Contractual Clauses as described in Section 4.

• Waitlist emails: Until the service launches and you have been notified, or until you ask us to delete your email.
• Account and process data: For as long as you have an active account. You can delete your account and all associated data at any time.
• Server logs: Up to 30 days.

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, email us at privacy@migradocs.org. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) at imy.se.

We currently use only essential session cookies required for authentication. We do not use advertising or tracking cookies. If we add analytics in the future, this policy will be updated and your consent will be requested before any non-essential cookies are set.

Our service is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this policy from time to time. We will notify registered users of material changes by email. The "Last updated" date at the top of this page reflects when the policy was last revised.

migraDOCS
[Company name and registered address]
privacy@migradocs.org