Privacy Policy

This Privacy Policy ("Policy") describes how Digital Renaissance Inc. ("Migrossa", "we", "us", or "our"), a corporation organized under the laws of the Province of Ontario, Canada, collects, uses, discloses, and protects Personal Data when you access or use the Migrossa platform at migrossa.com and related services (the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree, do not use the Service.

1. Scope and Applicability

This Policy applies to Personal Data of all Service users, including residents of the European Economic Area ("EEA"), the United Kingdom ("UK"), Switzerland, Canada (including Quebec), and the United States (including California). Where applicable, this Policy supplements rights granted under the General Data Protection Regulation ("GDPR"), the UK GDPR, the Personal Information Protection and Electronic Documents Act ("PIPEDA"), Quebec's An Act to Modernize Legislative Provisions as Regards the Protection of Personal Information ("Law 25"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA").

2. Personal Data We Collect

2.1 Information You Provide

• Identity Data: name, email address, telephone number, date of birth, country of citizenship, country of residence.
• Case Data: education history, employment history, language test results (IELTS, CELPIP, TEF, and equivalents), family composition, criminal history (where you disclose it), prior visa refusals, and travel history.
• Documents: files you upload to the Document Vault, including passport scans, transcripts, language test reports, police certificates, and employment letters.
• Billing Data: billing address. Payment card information is processed by a PCI-DSS compliant payment processor and does not transit Migrossa servers.

2.2 Information We Generate

• Eligibility Data: computed scores (including Comprehensive Ranking System scores), program matches, risk flags, and scenario tags produced by our rule engine.
• AI-Generated Content: personalized immigration analyses produced by our large language model pipeline using your Case Data.
• Agent Activity Logs: timestamped records of automated browser-agent actions, including target URL, step status, and structured outputs (e.g., confirmation numbers issued by government portals).
• Audit Records: append-only logs of account activity, maintained for dispute resolution and regulatory records-request response.

2.3 Information from Integrated Services

• Authentication: your verified email address and basic profile information when you sign in.
• Payment confirmation: confirmation that a charge succeeded plus the last four digits of your payment card for receipts.
• Gmail OAuth: where you elect to connect Gmail for the Job Hunter feature, a send-only OAuth token. We do not access inbox contents.
• Browser-agent runtime output: structured results produced by a browser-agent session you authorize (e.g., a confirmation number issued by a government portal).

2.4 Categories of Data We Do Not Collect

• Gmail inbox contents (OAuth scope is send-only).
• Government-portal credentials (browser agents pause at login screens for in-session user authentication).
• Payment card numbers, CVV, or expiry (handled exclusively by our PCI-DSS compliant payment processor).
• Biometric data, social insurance numbers, Aadhaar numbers, or analogous identifiers (these are entered by the user directly into the government portal when required).

3. Purposes of Processing

We process Personal Data for the following purposes:

• (a) Provide and operate the Service, including generating immigration analyses and operating browser agents at your direction;
• (b) Process payments and issue receipts (with our payment processor acting as a separate data controller for payment information);
• (c) Detect, prevent, and investigate fraud, abuse, and unauthorized access;
• (d) Respond to support requests, regulatory inquiries, and lawful requests for information;
• (e) Improve the Service using aggregated, de-identified usage data; and
• (f) Comply with applicable legal obligations.

4. Legal Bases (EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following legal bases under Article 6:

• Article 6(1)(b) (Contract): processing necessary to deliver the Service you have requested.
• Article 6(1)(c) (Legal Obligation): processing required to comply with applicable law (e.g., tax recordkeeping).
• Article 6(1)(f) (Legitimate Interests): processing necessary for our legitimate interests in detecting fraud, securing the Service, and improving our products, balanced against your rights and freedoms.

Special categories of data (including criminal history disclosures relevant to immigration eligibility) are processed only with your explicit consent under Article 9(2)(a) or where necessary for the establishment, exercise, or defense of legal claims under Article 9(2)(f).

5. Automated Processing and Artificial Intelligence

The Service uses automated processing and artificial intelligence as core functionality.

5.1 AI Models and Retention

Migrossa's AI pipeline combines a large language model for report generation, vector-embedding models for our retrieval-augmented reference index, and a browser-automation runtime for agent workflows. Across all three layers, the following retention rules apply:

• No training on User Content. Our AI infrastructure is configured so that your prompts and completions are not retained for model training, fine-tuning, or any other secondary purpose — by Migrossa or by any model provider we engage. Where applicable, zero-retention API headers are set on every request.
• Embedding queries sent to the retrieval layer are processed in real time. Under our enterprise arrangements, queries are not retained beyond the duration of the request for any training purpose.
• Browser-agent sessions generate a session recording so you can audit what the agent did on your behalf. Recordings are retained for a short window (currently seven days) and then automatically purged.

5.2 No Solely Automated Legal Decisions

The Service's AI output is informational. It does not constitute legal advice and does not produce final immigration determinations. Before any application is filed, the output is reviewed by you and, where applicable, by an independent regulated professional. You may request human review of any AI-generated content by emailing [email protected].

6. Browser-Agent Authorization

When you initiate a browser-agent session, you authorize Migrossa to (a) open the designated website in a controlled session, (b) populate forms with values from your Case Data, and (c) pause and return control to you for any payment, signed consent, final submission of a government form, CAPTCHA challenge, multi-factor authentication step, or any field requiring credentials or sensitive identifiers. You retain final authority over agent actions and may terminate a session at any time from your account dashboard.

7. Disclosure of Personal Data

Migrossa does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising. Personal Data is disclosed only:

• (a) to sub-processors under Data Processing Agreements (see Section 8);
• (b) to independent regulated immigration professionals where you elect a consultant match; their processing is governed by their own engagement letter and applicable professional rules;
• (c) to government authorities or other parties where required by law, legal process, or to protect Migrossa's rights; and
• (d) to acquirers in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

8. Sub-processors

Migrossa engages third-party service providers to operate the Service. Each is bound by a written Data Processing Agreement that limits processing to Migrossa's instructions for the specific purpose of operating the Service. The categories of sub-processors are:

• Application hosting and edge delivery
• Database and real-time data services
• Authentication and session management
• Payment processing
• AI model providers (large language model and vector embeddings)
• Browser-automation runtime for agent workflows
• Transactional email delivery
• Durable background-job execution
• Authoritative DNS and content-delivery network
• Gmail OAuth (only where you explicitly connect Gmail)

A current list of sub-processors, including specific entities and jurisdictions, is available on request by emailing [email protected]. Enterprise customers signing a Data Processing Addendum receive the full list as a schedule to the DPA.

9. International Data Transfers

Personal Data may be processed in jurisdictions outside your country of residence, including (where applicable) the United States. Where users are located in the EEA, UK, Switzerland, or Canada, cross-border transfers to sub-processors are protected by:

• Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) for transfers from the EEA;
• UK International Data Transfer Addendum to the EU Standard Contractual Clauses for transfers from the UK;
• Federal Act on Data Protection (Switzerland) for transfers from Switzerland; and
• PIPEDA accountability principles for transfers from Canada.

Where additional safeguards are required, we apply supplementary technical and organizational measures including encryption in transit (TLS 1.2 or higher), encryption at rest (AES-256), and access controls.

10. Data Retention

We retain Personal Data for the periods set out below:

• Case Data and AI-Generated Content: for the duration of your account, plus 30 days following account closure.
• Audit Records: seven (7) years following the relevant transaction, to support records requests by immigration authorities (including IRCC, USCIS, UKVI, Bundesamt für Migration und Flüchtlinge, and Department of Home Affairs).
• Agent Activity Logs: eighteen (18) months.
• Payment Records: seven (7) years following the transaction, in accordance with applicable tax and accounting laws.
• Aggregated, De-identified Analytics: indefinitely.

11. Your Rights

Subject to applicable law and verification of your identity, you have the right to:

• Access — receive a copy of Personal Data we hold about you;
• Rectification — correct inaccurate or incomplete Personal Data;
• Erasure — request deletion of Personal Data, subject to the Audit Record retention period in Section 10;
• Restriction — request restriction of processing;
• Portability — receive Personal Data in a structured, commonly used, machine-readable format;
• Objection — object to processing based on legitimate interests;
• Withdraw Consent — withdraw consent for any processing based on consent, without affecting prior lawful processing.

To exercise any of these rights, contact [email protected]. We respond within 30 days, extendable by an additional 60 days for complex requests with notice to you.

11.1 Supervisory Authority Complaints

EEA and UK users have the right to lodge a complaint with their local supervisory authority (EDPB member list). Canadian users may complain to the Office of the Privacy Commissioner of Canada. Quebec residents may complain to the Commission d'accès à l'information du Québec. California residents may complain to the California Attorney General.

11.2 California Residents (CCPA)

California residents have the right to know the categories of Personal Data we collect, the sources from which the data is collected, the business purposes for which we use it, and the categories of third parties with whom we share it. California residents have the right to opt out of "sales" and "sharing" of Personal Data as those terms are defined under the CCPA; Migrossa does not sell or share Personal Data as so defined.

11.3 Quebec Residents (Law 25)

Quebec residents have additional rights under Law 25, including the right to data portability and the right to be informed of any automated decision-making affecting them. The AI processing described in Section 5 is the only automated processing within scope of this Policy.

12. Security

Migrossa implements technical and organizational measures designed to protect Personal Data, including:

• TLS 1.2 or higher for all data in transit;
• AES-256 encryption at rest (provided by infrastructure sub-processors);
• Short-lived authentication tokens with encrypted refresh tokens;
• Minimum-necessary OAuth scopes;
• Logging of administrative actions on user accounts.

In the event of a data breach affecting Personal Data, we will notify affected users within 72 hours of discovery (or sooner where required) and report to applicable supervisory authorities under PIPEDA, GDPR Article 33, and other applicable rules.

13. Children's Privacy

The Service is not directed to children under the age of 16. Migrossa does not knowingly collect Personal Data from any person under the age of 16. If you believe a child has provided Personal Data, contact [email protected] and the data will be deleted.

14. Cookies and Tracking Technologies

We use only essential cookies necessary for the operation of the Service: authentication session cookies, CSRF tokens, and a locale preference cookie. Migrossa does not use third-party advertising cookies and does not embed cross-site tracking technologies. Product analytics uses hashed user identifiers and does not enable individual re-identification.

15. Changes to this Policy

Migrossa may update this Policy from time to time. Material changes will be communicated by email to your account and by in-product notice at least 30 days in advance of the effective date. Continued use of the Service following the effective date constitutes acceptance of the updated Policy.

16. Contact

For privacy-related inquiries, including requests to exercise the rights described in Section 11:

[email protected]
Digital Renaissance Inc.
Toronto, Ontario, Canada

This Policy and the Terms of Service together constitute the entire agreement governing your use of the Service.