Privacy Policy for immi AI
Last Updated: August 2026
At immi AI, we are committed to protecting your personal data and ensuring transparency regarding how your information is processed.
immi AI is an early prototype. Please don't use it to plan a real move, and please don't enter details you wouldn't be comfortable putting into a test system.
1. Data Controller
immi AI
2. Personal Data We Collect & Purpose
We collect minimal personal data required to provide you with personalized immigration guidance and roadmap generation:
| Data Category | Data Elements | Purpose | Lawful Basis (Art. 6 GDPR) |
|---|---|---|---|
| Account / Lead Data | Full Name, Email Address | To initialize your workspace session and send roadmap updates. | Art. 6(1)(b) Performance of a service / Pre-contractual request |
| Relocation Parameters | Target Country, Highest Degree, Work Experience, Language Levels, Reason for Move | To calculate eligibility (e.g., Chancenkarte points) and generate relevant tasks. | Art. 6(1)(b) Performance of a service |
| Conversational Data | AI Chat messages, optional Age / Nationality shared in chat | To allow our AI Co-Pilot to answer your specific visa and legal questions. | Art. 6(1)(b) Performance of a service |
| Technical Data | Anonymized IP address, browser type, session IDs | Server logging, infrastructure performance, and rate-limiting. | Art. 6(1)(f) Legitimate Interest |
3. Data Retention & Automatic 30-Day Purge Policy
We practice strict Data Minimization (Art. 5(1)(c) GDPR):
- All personal lead data, chat logs, profile inputs, and generated relocation tasks are automatically and permanently deleted from our database 30 days after creation.
- Your onboarding answers, including your name and email address, are also stored in your own browser's local storage so the workspace can keep your context between page loads. This copy is discarded the next time you open immi AI more than 30 days after it was saved.
- This browser copy stays on the device you used and is never synced. You can delete it immediately at any time, either with the "Delete my data from this browser" button on the Settings tab, or by clearing this site's data in your browser settings.
- We do not set tracking cookies and we do not use analytics.
4. Sub-Processors & Data Transfers
To deliver our AI co-pilot service, we share necessary data with trusted third-party service providers acting as Data Processors:
-
Supabase Inc. (EU Region - Frankfurt, Germany):
- Role: Primary database storage for sessions and task roadmaps.
- Data Location: Hosted within the European Union (Frankfurt
eu-central-1).
-
n8n GmbH (Berlin, Germany):
- Role: Workflow orchestration agent.
- Data Location: Processed within Germany.
-
Vercel Inc. (USA / Global Edge):
- Role: Frontend web application hosting and CDN edge infrastructure.
-
Tavily Inc. (USA):
- Role: Specialized search API for real-time immigration research.
- Note: Only general web queries are transmitted; no personal user identifiers are sent to search services.
5. Your Rights Under the GDPR
As an EU data subject, you hold the following rights regarding your data:
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Request immediate deletion of your data prior to the automatic 30-day purge window.
- Right to Rectification (Art. 16): Request correction of inaccurate profile information.
- Right to Restrict Processing (Art. 18): Request restriction of data processing under specific circumstances.
6. Security Measures
We implement technical and organizational security measures, including HTTPS encryption in transit, strict Row Level Security (RLS) on database tables, and API authentication keys to prevent unauthorized access.
7. Changes to This Policy
We may update this Privacy Policy from time to time to reflect functional improvements or legal changes. The "Last Updated" date at the top indicates when the latest revisions took effect.