Privacy notice
How SmartMigrate handles your personal data, and what you can ask us to do about it. Last updated 18 August 2026.
The short version
- We hold your email address and your studying, so the course works and remembers you.
- Anything about how you use the site is only recorded if you said yes to the banner. Saying no changes nothing about how the site works.
- Nothing is sold, nothing is advertised, and there is no tracking across other sites.
- Ask us for a copy of your data, or to delete it, at info@smartmigrate.eu.
SmartMigrate is in beta
The platform is being tested with a small group of invited testers. You cannot register yourself — we create the account and send you the login — and no fee is charged, so there is no payment page and no card or billing information anywhere on the site.
When the beta ends we may delete test accounts and everything attached to them. We will tell you before that happens, and you can ask for a copy of your data first.
Who is responsible for your data
The controller is SmartMigrate Kft. (bejegyzés alatt — under registration), registered seat 2626 Nagymaros, Aranyos utca 20., Hungary, trading as SmartMigrate.
The company is being registered now, and its registration number will be added here as soon as the company court issues it. Until then Kata and Mario, the founders, are responsible for your data alongside the company — so nothing in this notice, and none of your rights below, waits on the paperwork.
For anything in this notice, including any of the requests below, write to info@smartmigrate.eu. We are a two-person team, so it reaches us directly.
What we hold, and why
This is the whole list. Everything here is written down because the platform needs it for something you can see; nothing is collected in case it turns out to be useful later.
Your account
Your email address, an encrypted form of your password (we cannot read the password itself), and the date the account was created.
- Why we have it
- To let you sign in, to keep your work attached to you across devices, and to send you a link if you forget your password.
- Our legal basis
- Performance of the contract between us — without it there is no account.
- How long we keep it
- Until your account is deleted.
How your studying is going
Which sections you have read and bookmarked, your mock exam and practice runs (how many questions, how many right, the points and how long it took), which individual questions you answered right or wrong, which questions you have already been shown, and any vocabulary words you add yourself.
- Why we have it
- To show you your own progress, to put the questions you keep getting wrong back in front of you, and to stop your next mock exam repeating your last one.
- Our legal basis
- Performance of the contract — this is the course working.
- How long we keep it
- Until your account is deleted.
Your answers in the Permanent Residency Assistant
The answers you give in the eligibility check, the documents checklist and the fee calculator — only if you are signed in and only when you fill them in. Some of these questions are personal: whether you have been subject to an expulsion order, whether an authority has found you gave false information, and whether you have been the subject of a national security measure.
- Why we have it
- So that the three panels are still filled in when you come back to them, instead of starting from an empty page every visit.
- Our legal basis
- Your consent, given by filling the panel in while signed in. You can withdraw it at any time by deleting the answers — the button is on the panel itself.
- How long we keep it
- Until you delete them, or until your account is deleted.
What you type into search
The words of the search, tidied up and shortened to 200 characters, how many results it found, and which language you were reading in.
- Why we have it
- A search that finds nothing tells us, in your own words, which question our material does not answer. It is how we decide what to write next.
- Our legal basis
- Your consent, given in the banner. Say no and nothing is recorded.
- How long we keep it
- 180 days, then deleted automatically.
The fact that you signed in
Two things only: which account, and when. No IP address, no browser, no device — the table has two columns and a test that keeps it that way.
- Why we have it
- To know how many people are using the site and whether they come back. Nothing else on the platform can answer that.
- Our legal basis
- Your consent, given in the banner.
- How long we keep it
- 400 days, then deleted automatically.
Where you are in the beta questions
While the site is in beta we ask each tester what they think of it: once after your first session, once after your third. So that the questions arrive at the right moment and only once, we keep a count of how many times you have signed in, when you last did, and the date each of the two emails was sent to you. It is a single line that gets overwritten — not a list of your visits — and it holds nothing about what you did while you were here.
- Why we have it
- To ask you for feedback twice, at the two moments when it is worth asking, and never to ask you the same thing twice.
- Our legal basis
- Our legitimate interest in finding out whether the thing we built works, while it is still being built (Article 6(1)(f)). Reply to either email and we will stop asking — the count is kept regardless of the analytics banner, because otherwise the question would only ever reach the people who said yes to it.
- How long we keep it
- Until your account is deleted.
Password reset links
When you ask for a password reset we store an encrypted form of the link we emailed you, and when it was used.
- Why we have it
- So that a reset link works once, expires after an hour, and cannot be re-used by anyone who finds the email later.
- Our legal basis
- Performance of the contract, and our legitimate interest in keeping accounts secure.
- How long we keep it
- Deleted within 7 days of being used or expiring.
Web server logs
Our web server records each request it answers, including the IP address it came from, the address requested and the time.
- Why we have it
- To keep the site up, to find faults, and to stop abuse — the rate limits that keep one script from swamping the site are counted per IP address.
- Our legal basis
- Our legitimate interest in the security and availability of the service (Article 6(1)(f)).
- How long we keep it
- Short-lived: they are rotated on the server and are never used to build a picture of an individual.
What we do not collect
- No payment or card details — nothing is charged during the beta and there is no payment page.
- No advertising, no advertising networks, no profiling, and nothing is ever sold or traded.
- No tracking of you across other websites.
- No location data, no contacts, no access to files on your device.
- No special-category data is asked for anywhere: not your health, ethnicity, religion, politics or sexual orientation.
The Permanent Residency Assistant
The three panels in Moira, the Permanent Residency Assistant — the eligibility check, the documents checklist and the fee calculator — ask you questions about your own situation, and a few of them are questions nobody wants stored carelessly.
If you are not signed in, nothing you type there leaves your browser. No request is made, nothing is saved on your device, and closing the page forgets it.
If you are signed in, your answers are saved to your account so the panels are still filled in when you come back. Only you can read them; they are never pooled, analysed or included in any statistics; and our analytics dashboard is blocked from that table by name. Each panel has a delete button, and using it removes the answers immediately.
The eligibility check gives you information, not a decision. It has no legal effect, it is not a promise about what an authority will do, and there is no automated decision-making of the kind Article 22 of the GDPR is about anywhere on this site.
Analytics, and the choice you are given
The banner asks one question, and your answer decides three things: whether your searches are recorded, whether your logins are counted, and whether Google Analytics runs at all.
If you say no, or close the banner without answering, nothing happens. Google is never contacted — the Google script is not part of the site until you consent, so there is not even a request telling Google you were here. The two tables above are not written to.
If you say yes, Google Analytics records which pages are visited. Google necessarily sees your IP address in order to answer the request; that is what consenting to it means, and it is why the banner names Google rather than calling it "analytics". We deliberately strip the query string from every page address we send, so the words you type into search are never handed to Google — those stay in our own database, under the retention above.
You can change your mind at any time by clearing this site's data in your browser; the banner will ask again.
Who else sees your data
Nobody buys it, and it is not shared for anyone else's purposes. The only outside parties involved are the ones needed to run the service:
- Tárhely.Eu Szolgáltató Kft. (1144 Budapest, Ormánság utca 4.; cégjegyzékszám 01-09-909968) — our hosting provider. The platform and its database run on a server we rent from them and administer ourselves, in their data centres in Budapest. They also operate the domain name for smartmigrate.eu. As the operator of the machine they could technically reach what is on it, which is what makes them our data processor; they may use it only on our instructions and never for their own purposes.
- Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland) — our email provider. Proton Mail delivers the password reset emails, and sees your email address and the message. Switzerland has an adequacy decision from the European Commission, meaning it is recognised as offering protection equivalent to the EU's.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — Google Analytics, and only if you consented. Google acts as our processor and may transfer data to the United States; those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and on Google's standard contractual clauses.
We would also disclose data if the law required it of us — a court order, for instance. Nothing of that kind has been asked for.
Where your data is kept
Your account, your studying and your residency answers are stored in Budapest, Hungary, on a server rented from Tárhely.Eu, and are not copied outside the European Economic Area.
Two things leave it, and only those two. Password reset emails pass through Proton in Switzerland, which has an adequacy decision from the European Commission. And if — only if — you consented to analytics, Google may process page views in the United States under the EU–US Data Privacy Framework. Nothing else goes anywhere.
How we protect it
Passwords are stored only in an encrypted form that cannot be turned back into the password. The whole site is served over an encrypted connection. Your session cookie is unreadable to scripts. Changing your password immediately ends every other session on your account. Administrative access to the server is possible only over a private network — there is no public administrative door to knock on.
No system is perfect, and this one is young. If something does go wrong and your data is at risk, we will tell the Hungarian supervisory authority within 72 hours and tell you directly where the law requires it.
Your rights
Under the GDPR you can ask us for any of the following. Write to info@smartmigrate.eu from the address on your account and we will answer within one month, free of charge.
- Get a copy
- Ask us for a copy of everything we hold about you.
- Fix it
- Have anything wrong or out of date corrected.
- Delete it
- Ask us to delete your account and everything attached to it. During the beta we do this by hand — write to us and we will confirm when it is done.
- Take it with you
- Ask for your data in a machine-readable file, or ask us to send it to another provider.
- Pause it
- Ask us to stop using your data while a complaint or a correction is being sorted out.
- Object
- Object to anything we do on the basis of our legitimate interest, such as the server logs.
- Change your mind
- Withdraw consent for the analytics at any time — clear this site’s data in your browser and the banner will ask again. Withdrawing does not undo what was already collected, and it changes nothing about how the site works for you.
If you are not happy with our answer
Tell us first — it is usually something we can fix the same week. You also have the right to complain to the Hungarian data protection authority, or to go to court.
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
ugyfelszolgalat@naih.hu · naih.hu
Children
SmartMigrate is written for adults applying for residence in Hungary. It is not aimed at children and we do not knowingly create accounts for anyone under 16.
Changes to this notice
When what we do changes, this page changes with it, and the date at the top moves. If a change affects you materially — a new purpose, a new recipient, a longer retention — we will email you about it rather than quietly editing the page.