Privacy Policy — Realocate.ai

1. Who we are

Realocate.ai is a personal project operated by Omer Alphandar ("we", "us", "our"). We provide an AI-powered relocation guidance platform accessible at realocate.ai. For privacy enquiries contact us at: omeralph1biz@gmail.com

2. What data we collect

We collect the following personal data when you create an account and use the service:

Account data: name, email address, and (if signing in with Google) your Google profile picture.
Profile data: nationality, country of origin, destination country, employment status, family status, and estimated moving date.
Usage data: task completion status, custom tasks you create, and AI enrichment requests.
Technical data: IP address, browser type, and session cookies (used solely to keep you logged in).

We do not collect payment card details directly — payments are handled by a third-party processor (see section 5).

3. Why we collect it and our legal basis (GDPR)

Purpose	Legal basis
Providing the relocation journey and task list	Performance of a contract (Art. 6(1)(b) GDPR)
Personalising tasks with AI (sending your profile to Anthropic)	Performance of a contract (Art. 6(1)(b) GDPR)
Authentication and session management	Legitimate interests (Art. 6(1)(f) GDPR)
Improving the service and fixing bugs	Legitimate interests (Art. 6(1)(f) GDPR)
Sending transactional emails (progress updates, welcome)	Legitimate interests (Art. 6(1)(f) GDPR)

4. AI processing

To generate and personalise your relocation tasks, we send a subset of your profile data (nationality, origin country, destination country, employment status, and family status) to the Anthropic API. This data is used only to generate your task content and is not used by Anthropic to train their models under our API agreement. We have signed Anthropic's Data Processing Addendum.

No sensitive personal data (passwords, payment details) is ever sent to any AI model.

5. Third parties we share data with

Anthropic, Inc. — AI task generation. Profile data only. DPA signed. See Anthropic Privacy Policy.
Google LLC — OAuth sign-in. We receive your name and email from Google if you choose to sign in with Google. See Google Privacy Policy.
Supabase / hosting provider — Your data is stored in a PostgreSQL database hosted on Supabase (EU region). Supabase is GDPR-compliant.
Payment processor (Paddle) — If you purchase a paid plan, payment is handled by Paddle.com Market Ltd, which acts as Merchant of Record. We do not receive or store your card details.
Analytics — We may use privacy-friendly, cookieless analytics (Plausible Analytics). No personal data is shared.

6. Cookies

We use strictly necessary session cookies to keep you logged in. These cookies do not track you across other websites and do not require your consent under ePrivacy rules. We do not use advertising or tracking cookies.

7. Data retention

We retain your account and profile data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Journey data (task completion history) is deleted along with your account.

8. Your rights under GDPR

If you are located in the EU/EEA or UK, you have the following rights:

Access: request a copy of the data we hold about you.
Rectification: correct inaccurate data.
Erasure: request deletion of your data ("right to be forgotten").
Portability: receive your data in a machine-readable format.
Objection: object to processing based on legitimate interests.
Restriction: request that we limit processing in certain circumstances.

To exercise any of these rights, email omeralph1biz@gmail.com with the subject line "GDPR Request". We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

9. International transfers

Anthropic is a US-based company. When we send data to the Anthropic API, it is transferred to the United States. This transfer is covered by Anthropic's Standard Contractual Clauses (SCCs) as part of our Data Processing Addendum.

10. Children

Realocate.ai is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on the platform. The "last updated" date at the top of this page will always reflect the most recent version.