Privacy policy

The controller of your personal data is [COMPANY NAME, ADDRESS, NIP], the operator of immigratetopoland.com (we, us). For anything concerning your data write to hello@immigratetopoland.com with “Privacy” in the subject line. We process personal data under Regulation (EU) 2016/679 (the GDPR) and the Polish Act of 10 May 2018 on the Protection of Personal Data.

• Account data: your e-mail address and, if you provide it, your name. Sign-in is handled by our identity provider Clerk; we do not see or store your password.
• Wizard answers: what you tell the questionnaire in order to get your route. This includes your nationality, whether you are in Poland, your current basis of stay and its expiry date, the purpose of your application, and depending on the route: your contract type, gross salary, level of education, years of experience, job title and employer name, your study programme and institution, your family situation (sponsor type, relationship, whether the marriage is registered, whether you have a spouse and how many children), your business form and figures, your voivodeship, housing and insurance type, whether you hold a PESEL, a Profil Zaufany and an e-Doręczenia mailbox, and optionally your first name.
• Onboarding profile (Journey): if you use the free journey product, a wider version of the same idea: where you are and what you want, your education, experience, skills and languages, your job preferences or study field, your savings and timing, your family situation, your passport details relevant to your route, and the e-mail address we send your plan and reminders to. We ask for it because the plan, the job matches and the deadlines cannot be computed without it. We do not ask for and do not want passport scans, PESEL numbers or contracts for the free journey either.
• Journey content: your computed plan (pathway, reasons, budget, timeline), the stage you are at, the key dates you enter, the tasks you tick off, saved job offers, and, if you turn them on, your reminder and job-alert preferences.
• Case content: the checklist, plan, guides and templates generated from your answers, the items you tick off, and any text you type into templates.
• Purchase and subscription data: the package or subscription bought, amount, date, the Stripe customer, payment and subscription identifiers, and the record of your consent to immediate delivery or to the AI Job Scout terms (its version and time). Card numbers are entered on Stripe’s pages and never reach us.
• Technical data: IP address, browser and device information, server logs and the cookies and local app storage described in sections 9 and 13.
• Correspondence: what you send us by e-mail, and our replies.

We do not ask for and do not want passport scans, PESEL numbers, contracts or other documents: the Service works without them, and you should not send them to us by e-mail. Nationality is processed because the rules differ by nationality; we do not process it to draw conclusions about ethnic origin, and we process no other special categories of data intentionally.

• Running the Free Check and your Case (generating and showing your route, checklists, plans and templates; keeping your progress): performance of a contract, article 6(1)(b) GDPR.
• Accounts, purchases, receipts and invoices: performance of a contract, article 6(1)(b), and compliance with tax and accounting obligations, article 6(1)(c).
• Recording your consent to immediate delivery and other consumer-law confirmations: legal obligation, article 6(1)(c), and our legitimate interest in proving compliance, article 6(1)(f).
• Security, fraud prevention, error diagnosis and improving the Service (including aggregated statistics on which routes and documents are most common): legitimate interest, article 6(1)(f). You may object at any time (section 8).
• Answering your messages: legitimate interest in communicating with you, article 6(1)(f), or performance of a contract where the message concerns your Case.
• Service e-mails about your Case or Journey (purchase confirmations, deadline and appointment reminders, weekly job alerts you turned on, changes to the rules affecting your route, expiry of your access period, a restore link if you ask for one): performance of a contract, article 6(1)(b). Every reminder and alert e-mail carries an unsubscribe or settings link.
• AI Job Scout (deep job searches, offer translation, drafted e-mails, the coach chat): performance of a contract, article 6(1)(b), for a subscriber, and your explicit consent, article 6(1)(a), to processing by our AI sub-processor before its first use, described in section 11.
• Marketing e-mails, if we ever send them: only with your consent, article 6(1)(a), which you can withdraw at any time through the link in each e-mail. We do not send marketing without it.

We use a small number of processors, each bound by a data-processing agreement:

• Clerk (Clerk, Inc., USA): account creation, authentication and session management.
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payment processing, receipts, fraud prevention, and the AI Job Scout monthly subscription. Stripe is an independent controller for the payment transaction itself; see Stripe’s privacy policy.
• Resend (Resend, Inc., USA): sends every transactional e-mail (welcome, deadline and appointment reminders, weekly job alerts, restore links, receipts) and stores a short delivery log (recipient, subject, status). Every e-mail it sends on our behalf carries a one-click unsubscribe or settings link.
• DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): powers AI Job Scout. See section 11 for what we send it and why.
• CBOP and Adzuna: not our processors but the sources of the job offers shown in the free job finder and AI Job Scout; see section 12.
• Hosting and database: [HOSTING PROVIDER, REGION], which stores the application and its database.

We also disclose data where the law requires it, for example to tax authorities or on a lawful request from a court or public authority. We never sell personal data, never share it with advertisers, and never transmit it to the Office for Foreigners, a voivodeship office or any other immigration authority: you alone file your application.

Clerk, Stripe and Resend may process data in the United States. Transfers are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses with supplementary measures.

If you use AI Job Scout, your job-search profile is sent to DeepSeek and processed in the People’s Republic of China, a country without an EU adequacy decision. This transfer takes place on the basis of the European Commission’s standard contractual clauses with supplementary measures, and only after you give the separate consent described in section 11. You can decline AI Job Scout to avoid this transfer entirely, and every other part of the Service works without it. You can ask us for a copy of any of these safeguards.

• Account, Case and Journey data: for as long as your account or journey exists. If you delete your account, your Cases and Journeys are deleted with it, subject to the periods below. Cases and Journeys that were never purchased and not opened for 12 months may be deleted earlier.
• E-mail delivery logs (Resend): up to 12 months, to diagnose delivery problems and prove that a reminder or restore link was sent.
• AI Job Scout usage and reports: kept for the length of the subscription plus 12 months, to show your usage against the monthly limits and to let you revisit past research; deleted sooner on request.
• Purchase and subscription records, receipts and invoices: 5 years from the end of the tax year in which the purchase or the last subscription payment was made, as required by Polish tax and accounting law.
• Consent records and complaint files: until the limitation period for claims expires, generally 6 years from the end of the year of purchase.
• Server logs and technical data: up to 12 months, unless needed longer for a security investigation.
• Correspondence: up to 3 years after the last message, unless it belongs to a complaint file.

Data is transmitted over TLS and stored in access-controlled infrastructure. Access is limited to people who need it to run the Service. Passwords are never handled by us; payment card data is never handled by us. We keep the data we hold to the minimum the Service needs, which is why we ask you not to send documents.

Under the GDPR you may, at any time and free of charge:

• ask for access to your data and a copy of it;
• ask us to correct inaccurate data (most wizard answers you can correct yourself);
• ask us to delete your data, or delete your account yourself;
• ask us to restrict processing while a dispute is being resolved;
• receive the data you gave us in a machine-readable format (portability);
• object to processing based on our legitimate interests;
• withdraw a consent you have given, without affecting processing before the withdrawal.

Write to hello@immigratetopoland.com; we answer within one month. You also have the right to lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority of the EU country where you live.

We use only cookies and browser storage that are necessary to run the Service: keeping you signed in (set by Clerk), recognising the browser that created a case before sign-up (itp_anon), remembering a currency you picked (itp_currency), keeping an unfinished questionnaire on your device, protecting forms against abuse, and completing payments (set by Stripe on its own pages). We do not use advertising cookies or cross-site tracking. [If an analytics tool is added, name it here together with its legal basis.]

You can delete or block cookies in your browser; blocking the necessary ones will prevent you from signing in.

To show prices in your own currency from the first page view, our server derives your country from the IP address of your request using a country-level database held on our own server (GeoLite2 country data). The lookup happens in memory; the IP address is not stored, sent to any third party or linked to your case. If you choose a currency yourself, that choice is kept in a cookie named itp_currency for one year; it contains only the currency code. Exchange rates are fetched by our server from a public rates service without any data about you.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

AI Job Scout is an optional, separately paid feature that uses DeepSeek V4 Flash, a model operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China), to run deeper job searches, translate Polish offers, draft application e-mails and answer your questions.

• We send DeepSeek only your job-search profile: your skills, target sector or field, city preference and route type. We never send your name, e-mail address or exact address.
• DeepSeek states that it processes personal data, including API traffic, in China, and that it may use such data to train and improve its own models, without a documented exemption for paid API use. See DeepSeek’s own privacy policy for its full terms.
• We ask for your explicit, separate consent before the first time AI Job Scout is used on your Journey, recording its date and version. You can withdraw it at any time by cancelling the subscription, which stops all further use.
• Usage is capped by fixed monthly and daily limits per feature (research, chat, drafts, translations), enforced before each call, so that no more of your data is sent than the feature needs.

The free job finder and AI Job Scout show job offers ingested from the Central Job Offers Database (CBOP, praca.gov.pl, run by Poland’s public employment services) and, where configured, Adzuna. These organisations are independent controllers of the offer data they publish, not our processors; we store no personal data belonging to the employer or any contact person from these sources, and every offer links back to its original listing. We do not vet employers who post these offers: see our terms of service for what that means for you.

The journey app is a Progressive Web App: when you install it, your browser keeps a service-worker cache of the app’s files on your device so it loads quickly and works with a weak signal, and may keep a small amount of your journey data (such as your current stage and tasks) in local storage so the app is usable offline. This data stays on your device and is cleared when you uninstall the app or clear your browser’s site data for immigratetopoland.com; it is not a separate copy held by us.

The eligibility engine applies published rules to your answers automatically, in the same way for everyone, to produce information: a suggested route, a checklist, a plan. It makes no decision that has legal effects on you or similarly significantly affects you within the meaning of article 22 GDPR. The only decision on your application is made by the voivode, outside our Service. We do not profile you for advertising.

The Service is intended for adults. A parent or legal guardian may prepare a child’s application in their own account; we do not knowingly create accounts for people under 18.

We update this policy when our processing, our providers or the law change. The date at the top shows the current version; account holders are notified by e-mail of material changes. Earlier versions are available on request. See also our terms of service.