Privacy Policy

MigrationGoal ("we", "our", "us") is an online platform that helps individuals assess their immigration eligibility against official government criteria. We are a data transparency tool, not a legal or immigration advice service.

For privacy enquiries, contact us at: privacy@migrationgoal.com

We collect the following categories of personal data:

Account Data: Your email address and full name, provided when you create an account via our email OTP sign-in system. We do not store passwords.

Profile & Assessment Data: The information you enter in the eligibility form — including education level, work experience, language proficiency, financial situation, and other details used to generate your report. This data is stored so you can save progress and revisit your assessments.

Payment Data: Payment processing is handled entirely by Paddle. We store a payment reference ID and the status of your transaction. We do not store your card number, CVV, or any raw payment instrument data.

Usage Data: Standard server logs including IP address, browser type, pages visited, and timestamps. This data is used for platform security and performance monitoring.

We use your data exclusively to:

Authenticate your account via email OTP Save your eligibility profile so you can resume and revisit assessments Generate your eligibility reports based on official immigration criteria Deliver your report by email upon purchase Process payments via Paddle Send service-related communications (report delivery, OTP codes) Monitor platform security and prevent abuse

We do not use your data for advertising, third-party marketing, or profiling beyond immigration eligibility assessment.

We process your personal data on the following legal bases (under GDPR and equivalent laws):

Contract performance: Processing your form data and payment to deliver the report you purchased. Legitimate interest: Operating our platform securely, preventing fraud, and improving the service. Consent: Sending you emails beyond report delivery (where applicable). You may withdraw consent at any time.

We share your data with the following third-party services only as necessary to operate the platform:

Paddle.com Market Ltd. — payment processing. Paddle's privacy policy: paddle.com/legal/privacy Resend — transactional email delivery (OTP codes, report emails) Cloud hosting providers — for platform infrastructure (database and server hosting)

We do not sell your data. We do not share your data with immigration consultants, governments, or data brokers.

We retain your data as follows:

Account and profile data: Retained while your account is active. You may request deletion at any time. Report data: Reports are retained permanently on your account so you can access them at any time. You may request deletion. Payment records: Retained for 7 years to comply with financial record-keeping obligations. Server logs: Retained for 90 days for security monitoring.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you. Correction: Request correction of inaccurate data. Deletion: Request deletion of your account and associated data. Portability: Request your data in a machine-readable format. Objection: Object to certain types of processing. Restriction: Request that we limit how we process your data.

To exercise any of these rights, contact us at privacy@migrationgoal.com. We will respond within 30 days.

We use the following cookies:

Authentication cookie (httpOnly): A secure, httpOnly session cookie containing your JWT token. This is strictly necessary for the platform to function. It cannot be read by JavaScript and is not accessible to third-party scripts. LocalStorage: We store your non-sensitive profile progress (form state) in your browser's localStorage so you can resume where you left off.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

We take appropriate technical and organisational measures to protect your data:

All data is transmitted over HTTPS (TLS 1.2+) Authentication tokens are stored in httpOnly cookies (not accessible to JavaScript) Passwords are not stored — we use email OTP authentication only Payment data is handled exclusively by Paddle and never touches our servers Database access is restricted to authenticated services only

We may update this Privacy Policy from time to time. We will notify you of material changes by email (to the address associated with your account) and by posting the updated policy on this page with a revised "Last updated" date. Continued use of the platform after such changes constitutes acceptance.