Privacy Policy

1. Who we are

i-migrate.ai is operated by Northbeams Inc., a Delaware C-corporation, 2261 Market St #76418, San Francisco, CA 94114, United States ("we", "us"). We decide how and why your personal data is used, so we are the data controller.

Our privacy contact is privacy@i-migrate.ai.

2. What we collect

We collect only what the service needs to work:

• Account details: your name, your email address and, if you choose one, a hash of your password. We never store the password itself.
• Assessment answers: what you tell us about your age, education, work, language tests, funds, family and travel history, and the scores and results we calculate from them.
• Uploaded documents: files you choose to upload, such as passports, bank statements, test results, police certificates and medical exams, plus the check notes Robin writes about them.
• Messages you send to Robin, our AI assistant, and the answers you receive.
• Usage counters (for example how many document checks you have used), your plan and subscription status, and any review you write.
• Basic technical logs: IP address, browser type and timestamps, kept for security and to keep the service running.
• How you found us: the campaign or site whose link first brought you here, and the page you landed on, if you allow usage statistics.
• Where you pressed pay: the part of the app that took you to checkout, such as your checklist or your plan, saved with your acceptance of the Terms, if you allow usage statistics.
• WhatsApp, only if you choose it: the phone number you give us for WhatsApp, your yes or no to WhatsApp messages and when you gave it, and a record of each message we send you there (which message, whether it was sent, delivered, read or failed, and when). If you reply, we only act on a request to stop, such as STOP or BAJA, and do not keep any other reply.

Some of this data is sensitive. The assessment may ask about criminal records, past immigration refusals and health matters such as tuberculosis tests, and your documents may contain the same information. We only ask for what an immigration application needs. We collect this sensitive data, and we send your documents to our AI provider, only with your explicit consent. You give that consent when you create your account (or, for older accounts, through a notice shown in the app), and we record the date and time you gave it. You can withdraw it at any time by deleting the documents or your account, or by writing to privacy@i-migrate.ai.

3. Why we use your data and on what basis

We use your data for these purposes, each with a legal basis:

• To run the service you asked for: calculating eligibility, building your checklist and plan, checking documents, answering your questions and managing your subscription. Basis: our contract with you.
• To process sensitive data (criminal-record, immigration-history and health answers, and the documents that contain them) and to send documents to our AI provider. Basis: your explicit consent.
• To keep the service secure, prevent fraud and abuse, and fix problems. Basis: our legitimate interest in running a safe service.
• To count visits and see which pages are read, without cookies and without identifying anyone. Vercel Web Analytics does this for every visitor, and PostHog does it until you accept product analytics: each works from a code made on its own servers from your IP address, browser and the site, which cannot be turned back into you. Vercel discards it after 24 hours and PostHog makes a new one every day. Basis: our legitimate interest in understanding how the service is used.
• To understand which links and campaigns bring people to i-migrate.ai, and which parts of the app lead people to Pro, so we spend on what helps. Basis: our legitimate interest in running and improving the service. You can object at any time in Privacy choices.
• To send you service emails, such as password resets, receipts and a warning before we delete old documents. Basis: our contract with you. We do not send marketing emails unless you ask for them.
• If you choose WhatsApp (an unticked box on your compare or results page, or in Settings): to send you your result and at most one reminder about questions you have left, through Twilio and WhatsApp. No ads or offers, and we use the number for nothing else. Basis: your consent. You can withdraw it at any time by replying STOP (or BAJA) to any of our WhatsApp messages, or by switching WhatsApp off in Settings. WhatsApp's own terms and privacy policy apply to your use of WhatsApp.
• If you sign up on our website for the free checklist or for email alerts (rule, fee or Express Entry draw changes): we keep your email address, your language, the topics you chose, the page you signed up on, and when you asked and confirmed. We use them only to send those emails, which go out after you confirm from the email we send you. Basis: your consent. Every email has a one-click unsubscribe link, and you can also write to privacy@i-migrate.ai.
• To meet legal duties, such as tax and accounting rules. Basis: legal obligation.
• Family and Business plans: when you join someone else's plan, the person who pays sees your name, your email address and the date you joined, so they can run the plan they pay for (performance of that contract, and your consent when you accept the invite). They never see your answers, results, documents or conversations with Robin. We keep the email address of an invite for as long as the plan exists.
• To measure which Google and Meta (Facebook and Instagram) ads lead to sign-ups and purchases, and to show our ads again to people who visited. In the EU, the UK and the other countries where the law requires it, only after you accept in the small bar or switch on Advertising in Privacy choices; elsewhere unless you switch Advertising off in Privacy choices or your browser sends a Global Privacy Control signal. While it is on, our server shares a sign-up or purchase with Google and Meta, with a hashed (scrambled) email address and user number, the ad click id, your IP address and browser. Basis: your consent where the law requires it, which you can withdraw at any time in Privacy choices; elsewhere our legitimate interest in measuring our advertising, with Privacy choices as an easy way to object.
• To see which pages and steps people use, from the link that brought them to the plan they chose, so we can fix where people get stuck (PostHog product analytics). In the EU, the UK and the other countries where the law requires it, only after you accept in the small bar or switch on Product analytics in Privacy choices; elsewhere unless you switch Product analytics off in Privacy choices or your browser sends a Global Privacy Control signal. While it is on, PostHog sets its cookie and receives the pages you visit and the steps you take, your browser, an approximate location worked out from your IP address and, once you sign in, a random account ID, never your name, email address, assessment answers or documents. On our public pages, the first questions and the compare, results and upgrade pages it may also record how a page was used (where you scrolled and tapped), with anything you type hidden; on the compare, results and upgrade pages every word, number and picture is hidden too, so a recording never shows your name, email address, answers, results or documents. Basis: your consent where the law requires it, which you can withdraw at any time in Privacy choices; elsewhere our legitimate interest in understanding how the service is used, with Privacy choices as an easy way to object.
• To count visits and see how people use our pages and steps across visits (Google Analytics). It runs under the same choice as PostHog: in the EU, the UK and the other countries where the law requires it, only after you accept in the small bar or switch on Product analytics in Privacy choices; elsewhere unless you switch Product analytics off in Privacy choices or your browser sends a Global Privacy Control signal. While it is on, Google Analytics sets its cookies and receives the pages you visit, with the private parts of their addresses removed, your browser and device, an approximate location worked out from your IP address, and a few steps: starting the questions, asking for a sign-in code, creating an account (and how), and buying a plan (with its order reference, amount and currency). It never receives your name, email address, assessment answers or documents, we do not give it an account ID, and Google signals is switched off. Basis: your consent where the law requires it, which you can withdraw at any time in Privacy choices; elsewhere our legitimate interest in understanding how the service is used, with Privacy choices as an easy way to object.

We do not sell your personal data. We share it with Google and Meta for advertising only while Advertising is on, and never your assessment answers, documents or conversations with Robin.

4. Who processes your data

We use a small number of service providers. They process your data only on our instructions, to run the service.

5. International transfers

Our servers and most of our providers are in the United States, so your data is stored and processed there, wherever you live. Where the law of your country requires safeguards for such transfers (for example the EU GDPR or the UK GDPR), we rely on standard contractual clauses, or the UK International Data Transfer Addendum, with our providers. You can ask us for details at privacy@i-migrate.ai.

6. Cookies

We use six cookies of our own plus Stripe's, and advertising cookies while Advertising is on:

• im_session: keeps you signed in. It is set when you sign in, can only be read by our server, and lasts 30 days.
• NEXT_LOCALE: remembers the language you pick, for one year. It is only set when you choose a language. If you switch off Remember my language in Privacy choices, it lasts only until you close your browser.
• im_privacy: remembers your privacy choices, for one year.
• im_ft: remembers which link first brought you here, such as a search engine or a campaign, and the page you landed on, until you close your browser. It is only set while usage statistics are on. If you create an account, we save it with your account.
• im_check: keeps the answers of a Quick check you choose to save, encrypted, so you do not have to give them again when you create an account. It is only set when you choose to save your answers, only our server can read it, and it is deleted once the answers are added to your account, or after 7 days.
• im_guest (session storage, not a cookie): the anonymous id under which the answers you give before creating an account are saved, so a page reload does not lose them. Nothing in it identifies you, it lasts only until you close the tab, and the saved answers are deleted 30 days after the last one unless you create an account, when they move to it.
• im_ads: only while Advertising is on, keeps the id of the Google or Meta ad you clicked, for 90 days, so a later sign-up or purchase can be matched to that ad.
• Google and Meta cookies (_gcl_au, _gcl_aw, _fbp, _fbc and similar): set by the Google tag and the Meta Pixel only while Advertising is on, to measure our ads and show them again to past visitors. They last up to 90 days (_fbp, _gcl_au) and are removed from this site when you switch Advertising off.
• ph_…_posthog: set by PostHog only while Product analytics is on, so it can recognise your browser across our website and app. It lasts up to one year and is removed when you switch Product analytics off.
• _ga and _ga_…: set by Google Analytics only while Product analytics is on, so it can recognise your browser across visits to our website and app. They last up to 2 years and are removed when you switch Product analytics off.
• Stripe cookies: set by Stripe on the checkout page for payment and fraud prevention.

Vercel Web Analytics and Speed Insights set no cookies and do not identify you. The visit counts described in section 3 cannot be switched off, because nothing is stored in your browser for them. Speed Insights and the im_ft cookie are usage statistics that UK law allows without consent as long as you can object, so you can switch them off in Privacy choices, linked at the bottom of every page and in Settings. We also treat a Global Privacy Control signal from your browser as an objection.

In the EU, the UK and the other countries where the law requires it, advertising and product analytics are off until you say yes, either in the small bar that asks once or in Privacy choices, and we never ask a browser that sends a Global Privacy Control signal. Elsewhere they are on unless you switch them off in Privacy choices or your browser sends that signal. You can change your answer at any time.

While Product analytics is off, PostHog only counts visits, as section 3 describes, and stores nothing in your browser.

While Product analytics is off, Google Analytics does not load and sets no cookie.

7. AI processing and its limits

Robin is powered by Anthropic's Claude models through Anthropic's API. When you ask Robin a question, we send your message together with a summary of your assessment, your plan progress and your document status. When you ask for a document check, we send the file itself. This lets Robin answer about your case rather than in general. When you ask for feedback on a writing practice answer, we send your answer and the practice task.

Anthropic does not use these inputs to train its models. Under its commercial terms it keeps them for a limited period to provide the service and detect misuse, and then deletes them.

Robin is AI, not a person, and can be wrong. Document checks and answers are general information to help you prepare. They are not legal advice. Always confirm requirements with the official source, and check important points with a regulated adviser.

Your results are worked out automatically from your answers by our rules engine. They are advisory: they are not a decision by IRCC or the Home Office, and nothing is decided about you because of them. You can ask a person on our team to review your results at any time, from your results page or from Requests and complaints. The reviewer can keep or change the outcome and tells you why.

8. Retention and backups

• Account data: kept while your account is open.
• Uploaded documents: kept while your account is open. If you do not sign in for 24 months, we delete your uploaded documents. We email you one month before we do.
• Email sign-ups (checklist and alerts): kept until you unsubscribe. An address that is never confirmed is deleted. After you unsubscribe we keep only a record that the address must not be emailed again.
• WhatsApp: your number stays on your account until you switch WhatsApp off (by replying STOP or BAJA, or in Settings) or delete your account. When you switch it off, we remove the number from your account and send nothing more. The record of the messages we sent you (which message, its delivery status and when) and of your yes or no, which include the number they were for, is kept with your account and deleted when you delete it.
• Backups: encrypted backups are taken every night and kept for 30 days. Deleted data leaves the backups within that time.
• Payment records: Stripe keeps payment records for as long as tax and accounting law requires, even after you delete your account.
• Reviews: if you allowed us to publish your review, it may stay on the website with your first name and destination until you ask us to remove it.

9. Security and staff access

Uploaded documents are kept in a private store and are only served through our own routes, which require you to be signed in. Data is encrypted in transit and at rest. Passwords are stored as hashes. If you sign in with a code we email you, the code is stored only as a keyed hash and stops working after 10 minutes. Sessions expire after 30 days, and changing your password signs out every other device.

A small number of our staff (administrators) can open uploaded documents and check results in order to operate the service, review Robin's checks and help you when you ask. They do this only when needed for those purposes. We do not share your documents with anyone else unless the law requires it.

No system is perfectly secure. If we discover a breach that affects your data, we will tell you, and any authority we are required to inform.

10. Your rights and how to exercise them

You can:

• See and correct your data. Most of it is visible in the app (your profile, answers, documents and messages), and you can change your name and password in Settings.
• Delete documents at any time from Documents in the app.
• Delete your account and all its data from Settings, using Delete my account. This is immediate and cannot be undone. Any active subscription is cancelled at the same time, and your Stripe customer record is deleted. Payment records that Stripe must keep for tax remain.
• Export your data: use Download my data in Settings to get a copy as a JSON file, a common format you can take to another service. You can also email privacy@i-migrate.ai.
• Withdraw your consent for sensitive data or AI processing: delete the documents or your account, or write to us.
• Choose which emails you get: switch plan reminders and tips on or off in Settings, or from the link at the bottom of any email. Account and payment emails are sent while you have an account.
• Stop WhatsApp messages: reply STOP (or BAJA) to any of our WhatsApp messages, or switch WhatsApp off in Settings. Your number and the record of our WhatsApp messages are included when you download your data.
• Ask a person to review your automated results, as described in section 7.
• If the EU GDPR or the UK GDPR applies to you, you also have the right to object to some processing, to ask us to restrict it, and to complain to your data protection authority. We would rather hear from you first, but you can complain at any time.

Send any request from Requests and complaints (i-migrate.ai/legal/requests) or to privacy@i-migrate.ai. We confirm it by email, may ask you to confirm your identity first, and reply within one month.

If you are not satisfied with our answer, you can complain to the Information Commissioner's Office in the UK (ico.org.uk), the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

11. Children

i-migrate.ai is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to privacy@i-migrate.ai and we will delete it.

12. Changes to this policy

We may update this policy. If a change is material, we will email you at least 30 days before it takes effect. The date at the top shows the current version.

13. Contact

Northbeams Inc., 2261 Market St #76418, San Francisco, CA 94114, United States.

Privacy requests: privacy@i-migrate.ai. Everything else: hello@i-migrate.ai.

Our person in charge of the protection of personal information, as Quebec law requires, is our Chief Executive Officer. You can reach them at privacy@i-migrate.ai.