Privacy Notice

migrate.fi is operated from Espoo, Finland, under business identity code (Y-tunnus) 3636874-7. We are the controller of the personal data described here: we decide what is collected and why, and we are answerable for it.

Write to us at support@migrate.fi about anything in this notice. Data protection requests — access, correction, deletion — go to the same address. Put 'data request' in the subject line and we will handle it as one.

The waitlist: if you join the waitlist on the front page, we store the email address you give us and the language the page was in. That is the whole of it — there is no account behind it and no profile. We keep it in order to tell you when the service opens, and for nothing else, and you can have it removed at any time by writing to support@migrate.fi.

Your account: the email address you sign up with, your password stored only as a bcrypt hash, and the language you chose for the interface. If you sign in with Google instead of a password, Google passes us your email address, your name and your profile picture.

What you tell us during onboarding: the country you are coming from, where you are now, the permit type you hold or are seeking, your family situation, the ages of your children (ages only, never names), the Finnish city you are moving to, your arrival date, when your current permit expires, how far along you are, and the concerns you named. This is what your roadmap is built from.

Documents you upload: the file itself, and what the analysis read out of it — a name for it, what kind of document it is, who sent it, a summary, whether it needs an answer, any date you must answer by, and any expiry date printed on it.

Mail you forward: every account can be given a private address at inbox.migrate.fi. Anything sent there is stored with its attachments and read the same way an uploaded document is.

Your conversations: the questions you ask the assistant and the answers it gives, kept so the thread is still there when you come back.

Payment: if you buy the Relocation Pass we store the payment record and the customer reference that identifies you at Stripe. Your card number is entered on Stripe's own page and never reaches us.

Reminders: a record of which deadline reminder was sent to you on which day, so the same one is not sent twice.

Technical logs: running the service produces server logs of requests and errors. They are deleted automatically after 30 days.

Some of what people upload here says far more about them than a passport number does. A permit decision can reveal a health condition, an asylum claim, a religion, a political opinion, a persecution ground, or that someone was a victim of trafficking or of labour exploitation. Article 9 of the GDPR calls these special categories of personal data and protects them more strictly than the rest.

This product supports those routes deliberately — the asylum path is part of the roadmap — so we will not describe the case as hypothetical.

Nothing obliges you to upload such a document. You choose which files to add, and the roadmap and the chat work without any of them. When you do upload one, you give explicit consent to it being stored and read as this notice describes, and that consent is the legal basis we rely on.

You can withdraw that consent by deleting the document: the record, everything the analysis extracted from it, and the stored copy of the file itself all go together in that one click, and nothing here reads it again. Deleting your account erases every stored file the same way. Anything old enough to predate how we store files today is the one exception, and support@migrate.fi will erase that too.

Every document that arrives here is analysed automatically — on upload, and on arrival for forwarded mail. There is no 'store it but do not read it' option. If you would rather a particular paper was never read by an AI model, do not upload it. We would rather say that plainly than imply a choice that does not exist.

Running the service — your account, the roadmap, the chat, the documents you asked us to read, the reminders you asked for — rests on performing our contract with you (Art. 6(1)(b) GDPR).

Documents in the special categories above rest on your explicit consent, given when you upload them (Art. 9(2)(a)).

Analytics rests on your consent and on nothing else (Art. 6(1)(a)). Refusing it costs you nothing: every part of the product works either way.

Keeping the service standing — rate limits, blocking abuse, stopping an account being used to attack it, and the error reports that tell us something has broken — rests on our legitimate interest in a service that stays up and gets repaired (Art. 6(1)(f)).

We do not sell personal data and we do not share it for anyone's advertising. Five companies receive it: four so that the product can work at all, and one so that we find out when it stops working.

We require each of them to use your data only for the work we asked of it, and not to use it to train or improve its own products. That is the instruction we give and the condition we hold a processor to; it is not a promise about what a company does outside our instructions. Stripe differs in shape rather than in rule: it takes the payment on its own account and under its own privacy terms, which is what paying by card requires.

Google. The AI features run on Google's Gemini models, and this is the most sensitive of these recipients. When a document is analysed the file itself is sent to Google — the passport scan, the permit decision, the letter from Migri — because the model reads the file directly, with no step in between. Your chat questions, your onboarding answers, your profile and the text of forwarded letters are sent as well, in order to produce the answers, the task cards and the tips. If you sign in with Google, Google also handles that sign-in.

Amazon Web Services. AWS hosts the application, stores your uploaded files, runs the database, and carries email in both directions — the reminders we send you and the letters you forward in.

Stripe. Stripe takes the payment for the Relocation Pass and holds your email address, the billing address you enter at checkout, and the payment record for that purpose. Your card details are handled by Stripe and are never seen by us.

Cloudflare. The waitlist form on the front page is protected by a bot check, Cloudflare Turnstile. It is loaded from Cloudflare every time that page opens, and when you submit the form your IP address goes to Cloudflare together with the signals the check reads from your browser, so that it can judge whether you are a person. No account data, no document and nothing you have written reaches Cloudflare.

Sentry. When something in the product fails, a report of that failure goes to Sentry, so that we learn about a broken page from a dashboard rather than from you. The report is the technical account of the error: what failed and where in the code, and the address of the page or the route that was in use. The only thing in it that can point at you is your account's identifier — never your name, and never your email address. Before it is sent we remove what a report does not need in order to be useful — the contents of the request, the cookies, your email address, the identifier of the document a request was for, and the values of everything in a web address, keeping only their names. Your documents, the letters you forward and your conversations are not sent. One limit belongs here rather than in a footnote: the wording of an error message is written by the software that failed, so we cannot rule out that a fragment of your data is quoted inside one.

We also hand data over where the law requires it — a binding order from an authority or a court. If we ever receive one, we will tell the person concerned unless we are legally forbidden from doing so.

The application, your uploaded files and the database run in Amazon Web Services' Stockholm region, in the European Union. Email is sent and received through its Ireland region, also in the European Union.

The AI processing by Google may take place outside the European Economic Area, and so may the storage of the error reports described above. Where any processor takes personal data outside the EEA, the transfer must be covered by an adequacy decision of the European Commission or by the Commission's standard contractual clauses; we do not use a processor for which neither applies.

We are telling you where the data sits rather than promising that no byte ever leaves the EEA, because the second would be a promise about somebody else's infrastructure.

We do not delete personal data on a fixed schedule, and this notice will not invent one. Your account and what is in it stay for as long as the account exists.

A waitlist entry is not an account and does not follow that rule. It is one row holding an email address and a language, kept so that we can tell you when the service opens; one message to support@migrate.fi removes it.

When you delete your account the deletion happens immediately: the account, the documents and their analyses, the conversations, the roadmap and the payment records go with it. It is not a request that waits in a queue.

Five things outlive that. Backups held by our hosting provider age out on their own cycle, so a deleted account can persist in a backup until that backup expires. Stripe keeps its own record of a payment under its own retention rules and its own legal obligations — that is outside our control and we cannot delete it for you. When an administrator acts on an account — blocks it, grants access, deletes it — the record of that action is kept, including the email address it concerned, so that what was done to an account can still be answered for after the account is gone. And two technical records outlive it as well: the server logs, and the error reports sent to Sentry. Deleting your account does not reach into either; each expires on its own cycle instead, on the timings the next paragraph gives.

Server logs are deleted automatically after 30 days, and the error reports described above age out on Sentry's own cycle.

Uploaded files sit in private storage that is closed to the public internet and encrypted at rest. They are served only through a route that first checks the file belongs to the account asking for it.

Passwords are stored as bcrypt hashes. Nobody can read your password back out, including us.

We make no claim to hold a security certification, an external audit or an ISO standard, because we hold none. A privacy notice is the wrong place to imply otherwise.

You have the right to see the personal data we hold about you (Art. 15), to have it corrected (Art. 16), to have it deleted (Art. 17), to have its use restricted (Art. 18), to receive it in a portable form (Art. 20), and to object to processing that rests on legitimate interest (Art. 21).

Where processing rests on consent — the special-category documents, analytics — you may withdraw that consent at any time (Art. 7(3)). Withdrawing it does not make what happened before unlawful, and it does not affect what rests on our contract with you.

Most of this you can do yourself, in the product: your profile is editable in Settings, a document can be deleted from the Documents page, and the account itself can be deleted from Settings. A copy of your account data downloads from the same page, and the file itself names what it leaves out. For anything the product does not cover, write to support@migrate.fi. We answer within one month, as the GDPR requires, and sooner where we can. If you are on the waitlist and have no account here, the same rights apply to that entry, and support@migrate.fi is how you use them.

We do not make automated decisions about you that produce legal effects or anything similarly significant (Art. 22). The roadmap, the task cards and the tips are generated by a model, but they are guidance for you to act on. Nothing here decides anything about your permit and nothing here is submitted to any authority.

If you believe we have handled your data wrongly you can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), at tietosuoja.fi. You may go to them directly, without asking us first.

The sign-in cookie is necessary: it is what keeps you signed in as you move between pages, and the product cannot work without it. It is set when you sign in and cleared when you sign out.

Analytics — Google Analytics — is set only if you agree to it. Refusing costs you nothing, every feature works either way, and you can change your answer later.

We run no advertising cookies. Apart from the analytics, the only third-party code on the site is the Cloudflare bot check on the waitlist form and the error reporting described above — the first there to keep bots off the list, the second to tell us when a page breaks, and neither of them to follow you anywhere.

When we change something that matters here, we change the date at the top of the page. If a change affects what happens to data we already hold, we tell account holders by email. We will not change what we do and describe it afterwards.