Privacy policy

The controller under the GDPR is Noah Rodman, BSc, sole trader, trading as Migrada, Donau-City-Straße 3/08.05, 1220 Wien, Austria. Email: [email protected].

Write to that address for anything about your data. We do not have a data protection officer, because the law does not require one for a business of our size.

Your plan request. Your country, when you want to start, what you want to study, your German and English level, whether you are under or over 24, whether your family can show the money Austria asks for, your email and, if you are under 18, a parent's email. It becomes your case: we use it to write your plan, send it to you and follow up on it. So that you are not asked again, the browser you sent it from keeps a one-time key for 7 days; if you create an account in that browser, the key links the case to it and is then deleted. Legal basis: steps you ask us to take (Art. 6(1)(b) GDPR).

Your community posts and replies. What you write, the topic, the country you choose to show and the name you choose (or "A student"). This includes milestones you choose to share when you finish a stage of your case. They are public as soon as you post them; your email never shows. When you mark a post as helpful, others see only the number, not who. When someone replies to your question, we email you once, so you see the answer. We may remove posts that break the community rules. If you delete your account, your posts stay, without your name. Legal basis: Art. 6(1)(b) GDPR.

Your buddy application. Your account email and that you would like to join the team as a buddy. We use it to contact you about the team. Legal basis: Art. 6(1)(b) GDPR.

Your account, if you create one. Your email and password (stored only as a secure hash), or, if you sign in with Google, the name, email and picture Google shares with us. Plus your case: your answers, its progress, our notes to you and any documents you upload. We use it to run your account and your case. Legal basis: Art. 6(1)(b) GDPR.

When you email us. Your message and address, to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR.

Using the website. Our host keeps technical logs (such as IP address, browser and time) to run the site securely, and we measure visits without cookies, as described under "Statistics". Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Documents. Your plan needs no documents. We only receive documents you choose to upload to your case, to have them checked. Your passport, bank statement and admission letter are read by an automatic check (see Mistral AI below), which picks out only what the rules need: dates, names, the balance and its currency and from the admission letter your university, programme, semester and enrolment deadline. We keep those few values and the result, never the full text, and never your passport, account or student number. A person at Migrada looks at anything unclear and at every other document. The result is a pre-check, never a decision about you. Only you and Noah can open your files and you can delete them at any time. We do not sell your data and we do not use it for advertising.

Your dates and our emails. The dates you add to your case (such as your application deadline, semester start, embassy appointment and arrival), plus those read from your admission letter. We use them to show your countdown and to email you a reminder 14 and 3 days before each date and a short weekly update on Mondays. When Noah makes your timeline, he can also set dates on your steps: we show them in your timeline and email you when he sends or updates it. You can turn these emails off under Account or with the "Email settings" link in any email. Legal basis: Art. 6(1)(b) GDPR.

Emails after a plan request. When you ask for a plan, we email you the plan and a few short follow-ups about your move, for example the link to open your plan in the app or your next step. Every email has a small "Email settings" link: without signing in, you choose everything, only deadline reminders, a pause for a month or no emails at all. Emails you ask for yourself, such as a sign-in link or the link to your plan, still reach you. Legal basis: our legitimate interest in helping with the request you made (Art. 6(1)(f) GDPR).

Short questions in the app. Now and then the app asks one optional question, such as which universities you are looking at, what almost stopped you from starting or how sure you feel about your next step. Your answer is saved on your case and only Noah reads it, to improve your plan and the app. You can always choose "Not now". Legal basis: our legitimate interest in a service that helps (Art. 6(1)(f) GDPR).

Who sees your case. Noah Rodman, who runs Migrada. A buddy from the Migrada team sees your case only if you share it with their buddy code or Noah introduces them to you: then they see your answers, your steps and dates and which documents you uploaded and whether they were checked. Buddies never open your files or see anyone else's case and the Buddy Agreement binds them to keep what they see confidential. Under Account you see who can see your case and you can stop sharing at any time; we keep a note of when you share and when you stop. Buddies who joined the team also see an overview of the students who asked us for help, without names or contact details (country, route, start, languages, age group and stage), so they can offer to help; Noah decides who helps you. Legal basis: Art. 6(1)(b) and (f) GDPR.

If you are a buddy. Your account email, the name shown on the team, your city, your buddy code, whether you offer independent paid help and your acceptance of the Buddy Agreement: the full name you typed, your email, the version and the time. We keep that acceptance record for 3 years after you leave the team, to show what was agreed (Art. 6(1)(b) and (f) GDPR). Your photo, first name and city appear on migrada.eu and Migrada's social media only with your consent (Art. 6(1)(a) GDPR). You can withdraw it under Account at any time and your photo then comes off the site within 7 days.

These services process data on our behalf, under data processing agreements that are part of their terms:

• Supabase stores the forms, accounts, cases and uploaded documents (database, sign-in, file storage), in the EU (Ireland).
• Cloudflare hosts the website and delivers it quickly worldwide. It also runs Turnstile, a check that tells people from bots when you sign up, sign in or send a form: it looks at technical signals from your browser and your IP address, without puzzles in most cases and only to stop automated spam and fake accounts (our legitimate interest in a secure service, Art. 6(1)(f) GDPR).
• PostHog (EU cloud, Frankfurt) measures how the site and the app are used, without cookies, as described below.
• Cloudflare Web Analytics counts page views and visits, without cookies, as described below.
• Resend sends emails from the website: a welcome email, your plan and timeline, messages from Noah about your case, document results, date reminders and the weekly update, replies to your community questions and a copy of each form you send to our own inbox, so we can answer you.
• Mistral AI (Paris, France) runs the automatic document check: it reads the passport, bank statement or admission letter you upload and returns the few values above. It processes the file only to answer us, keeps it for at most 30 days to prevent abuse and does not use it to train its models.

These providers act on their own responsibility, under their own privacy policies:

• Google, only if you choose to sign in with Google.
• Microsoft runs our email inbox (Outlook.com). Emails you send us and the copies of your forms, arrive there.

Partners. Where your plan links to a partner, such as a bank or an insurer, we do not pass them your data. If you click the link, the partner may learn that you came from Migrada and their own privacy policy applies to anything you do with them. We always say when we may be paid for a link.

We measure how the site is used so we can fix the pages that confuse people, without cookies and without storing anything on your device for this purpose:

• PostHog (EU cloud, Frankfurt) records which pages you open, what you click, how far you scroll, which steps of our forms you complete (for example "step 3 of 5") and the country you visit from. It never receives your email address or what you type, and web addresses are stored without anything after the "?" or "#". We do not record your screen. To count visitors without cookies, PostHog forms a code from your IP address and browser with a key that changes every day, so it can tell visits on the same day apart but never recognises you on another day. Your IP address is not stored. These statistics travel through our own address (migrada.eu) and Cloudflare adds the country, only the country.
• Cloudflare Web Analytics counts which pages are opened, from which country and type of device and how fast they load. It does not identify you, does not follow you across visits or other sites and stores nothing on your device.

Case statistics. If you have a case, our server also counts its steps in PostHog: for example your plan request, your plan being sent, a document uploaded or checked, the steps you tick, our reminder emails and that you answered a short question (with the 1 to 5 score, never your words). These carry a random case number and your country, route and start year, never your name, email, documents or messages, and are not linked to your browsing. They show us where students get stuck.

Legal basis for all statistics: our legitimate interest in a site and a service that work (Art. 6(1)(f) GDPR). We do not use any of this for advertising.

You can object at any time with one click on the cookie page. If you are signed in, the same button also stops the statistics for your case. If your browser sends the Global Privacy Control signal, we treat that as an objection and measure nothing in your browser.

Mistral AI is based in the EU. The other services above are run by companies based in the United States (Supabase, Cloudflare, PostHog, Resend, Google and Microsoft), even where they store our data in the EU. Where data can reach the United States, the transfer is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

• Plan requests and community questions without an account and our emails with you: up to 24 months after our last contact with you, or earlier if you ask us to delete them.
• Published community questions: until you ask us to take them down. Your email is never published.
• Your account, your case and anything you upload: until you delete them or your account.
• A buddy's acceptance of the Buddy Agreement: 3 years after they leave the team.
• Files read by the automatic document check: at Mistral AI for at most 30 days.
• Statistics in PostHog: we use them for up to 1 year, the period our PostHog plan keeps them.
• Technical logs: for the short period our host keeps them.

If you are under 18, we ask for a parent's contact when you request a plan and we may involve them. If you are under 14, please ask a parent to fill in the form with you.

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to receive it in a portable format and you can object to processing based on our legitimate interest. You can withdraw any consent at any time, without affecting what happened before. Write to [email protected].

You can also complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, www.dsb.gv.at.

We do not make automated decisions about you that have legal or similarly significant effects. The automatic document check only flags what a person, or you, should look at again.

When we change how we use data, we update this page and the date at the top before the change takes effect.