What we collect, why, who we share it with, how long we keep it and how to have it deleted. CV files are processed in memory and never stored.
Don’t put passport numbers, BRP or eVisa details, refusal letters, National Insurance numbers or bank details into Ask AI, the CV Checker, posts or messages. Remove them from your CV before you upload it.
The controller of your personal data is ImmigrationGPT, an independent service. Contact us about anything in this policy at contact [at] immigrationgpt.co.uk.
You must be 18 or over to have an account. We don’t knowingly collect data about children.
| What | Why | Legal basis |
|---|---|---|
| Name, email and profile picture from sign-in | Your account | Contract |
| Your network profile: display name, headline, visa route, journey stage, nationality, employer, city, skills, languages | The member network, and suggesting people, questions and employers | Contract; explicit consent for nationality (see section 3) |
| Posts, questions, answers, visa experiences and votes | Showing them publicly as you asked | Contract |
| Messages and connections | Delivering them | Contract |
| Companies you follow, job alerts, your visa timeline | Alerts and reminders you set up | Contract |
| Licence alerts without an account: your email and the employer you chose | One email to confirm, then an email when that employer's register entry changes. Each email has a link that stops the alerts and deletes your address for them | Consent |
| Weekly register email without an account: your email and whether you want new sponsors as well as revoked licences | One email to confirm, then one email each Monday with the week's changes on the sponsor register. Each email has a link that stops it and deletes your address for it | Consent |
| Employer checks bought without an account: the purchase (company, amount, date and Stripe’s payment reference), a cookie in the browser you bought it in, and the email you give Stripe | Opening the report in the browser you bought it in, sending you one receipt (the email is used for that and then deleted), and moving the report to one account if you sign in | Contract |
| Ask AI questions and answers | Answering you and keeping your chat history | Contract |
| CV text, job advert and report | The CV Checker (section 5) | Contract |
| Company page claims: your work email, a note about your role, and our decision | Confirming that you can manage a company page (section 8) | Legitimate interests |
| What you write on a company page you manage: text, logo, links, open roles, and a log of each change | Showing it on the company page, and undoing changes that break our rules | Contract |
| Ad campaigns: the ad, its image, your email, and daily totals of views and clicks | Checking, running and reporting on your ad (section 8) | Contract; legal obligation for payment records |
| Law firms and advisers we email about the solicitor directory: the firm name and the business email it publishes on its own website | One email offering a directory listing, and handling the reply. If the firm says no, we delete the name and keep only the address on a do-not-contact list. If it does not reply, we delete both after 12 months | Legitimate interests |
| Enquiries to solicitors | Sending them to the firms you choose | Contract, at your request |
| Purchases, including the time you agreed to start straight away and gave up your right to cancel and the version of our terms that applied | Payment, receipts that confirm your order, and tax records | Contract; legal obligation |
| Reports, moderation decisions, blocks | Keeping the network safe and meeting our duties under the Online Safety Act 2023 | Legitimate interests; legal obligation |
| IP address, device and security logs | Security, preventing fraud and abuse | Legitimate interests |
| Analytics and advertising cookies | Measuring use of the site and showing ads | Consent, which you can change at any time |
| Weekly round-up and marketing emails | Sending them if you opted in | Consent |
Your nationality can reveal your ethnic origin, which is a special category of data under UK GDPR. It is optional. We only use it if you add it, relying on your explicit consent, and it is hidden from other members until you choose to show it to your connections or to everyone. You can clear it at any time from your profile, which withdraws your consent. Your visa route and journey stage are hidden by default in the same way, and your visa timeline is always private.
Please don’t share health, religious or criminal-record information in posts or messages.
When you post a question, answer or post, an AI screen checks it for scams, personal details and unregulated advice. If it flags something, a person reviews it before it is published; the screen never closes an account on its own. Messages that mention money together with a visa or sponsorship show a scam warning. We suggest people, questions and employers from your profile and activity. You can object to suggestions based on your activity by emailing us.
When someone reports content, a moderator reviews it. If a message is reported, the moderator can read that conversation. The person reported is not told who reported them. We keep report records for 2 years after a report is closed so we can deal with repeated abuse, and longer only if we need them for a legal claim or the law requires it. Where the law requires it, for example for child sexual abuse material, we report content to the authorities.
When you send an enquiry, only the firms you choose see it. A firm gets your email address and answers when it opens your enquiry, and from then on it is responsible for that data as a separate controller under its own privacy notice. For firms that register: your work email, SRA number and firm details are used to run your account, your firm profile is public, and we check your SRA number against the SRA’s Solicitors Register.
To manage a company page, you give us a work email and we send a code to it. Someone at ImmigrationGPT may read your claim, your note and the email address to decide it. When you manage a page, what you write is public and shows as written by the employer. We keep a log of each change, so we can undo one that breaks our rules. If you delete your account, you stop managing the page, and what you wrote stays as the company’s content without your name on it.
When you buy an ad, a person at ImmigrationGPT reads it before it goes live. We count how many times it is seen and clicked each day. These counts are totals: we don’t record who saw or clicked it, and the ads don’t use cookies. Stripe takes the payment.
We don’t sell your data. We use these providers, who process it for us under contracts that protect it:
| Provider | What for | What they receive |
|---|---|---|
| Hetzner (Germany) | Hosts our servers and databases | Everything we store |
| Cloudflare | Delivers the site and protects it from attacks; Turnstile checks you are not a bot | IP address, device and request data |
| Auth0 (Okta) | Sign-in | Name, email, profile picture, sign-in events |
| Stripe | Payments | Payment details, email, country, what you bought |
| Anthropic | Ask AI answers and the free CV check | Your question, CV and advert text |
| xAI | Writing the fixes in a paid CV report, reading a job offer you paste, and the automatic screen on posts, questions and answers | Your CV and advert text, the text you submit |
| Google (Gemini) | Turns Ask AI questions into search vectors so we can find the right GOV.UK sources | The question text |
| Langfuse (EU) | Monitoring the quality, speed and cost of AI answers | Ask AI questions with your account ID; for CV and moderation calls only token counts and cost |
| ZeptoMail (Zoho, EU) | Sending account, receipt and notification emails. We queue them with Novu software on our own servers | Your email address and the email content |
| Google (Gmail) | Internal alerts to our team, such as a new newsletter sign-up | Your email address |
| Umami (hosted by us) | Counting visits and which features are used, without cookies; recordings of a sample of visits to see where pages are hard to use | Pages viewed, referring site, browser, device type and country; for recorded visits, clicks, scrolling and page layout. What you type is never recorded, and account, message, CV and solicitor pages are left out of recordings. No cookies, no stored IP address |
| Google Analytics and AdSense | Measuring use of the site and showing ads, only with your cookie consent | Cookie IDs, device data, pages viewed, approximate location |
Search, recommendations, notifications and realtime updates run on our own servers, not with third parties. We also share data where the law requires it, for example with the police under a valid request.
Some providers above process data in the United States or elsewhere outside the UK. Where they do, the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by the ICO’s International Data Transfer Agreement or Addendum.
Essential cookies keep you signed in and protect forms; they don’t need consent. One of them, igpt_ec, lets the browser you bought an employer check in open that report without an account. It holds a signed list of those purchases and lasts a year. Analytics and advertising cookies (Google Analytics and AdSense) are off until you agree to them. You can change your choice at any time: .
You can ask for a copy of your data, ask us to correct or delete it, restrict or object to how we use it, ask for it in a portable format, and withdraw consent at any time. Most of this you can do yourself in your settings, including deleting your account. For anything else, email contact [at] immigrationgpt.co.uk. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put it right first.
Data travels over encrypted connections, our databases are not reachable from the internet, and only people who need access for their work have it. No system is perfectly secure; if a breach affects you we will tell you and the ICO as the law requires.
We will update this policy when what we do changes, show the date at the top, and email account holders about significant changes. See also our terms and community rules.