Privacy Policy

1. Who we are

startabroad.ge is operated by Midheaven LLC, based in Tbilisi, Georgia, which is the data controller for the personal data described in this policy. We have not appointed a formal Data Protection Officer. Privacy questions and requests go directly to support@startabroad.ge. We do not have an establishment or appointed representative in the EU or EEA.

2. What data we collect

Account and contact details (name, email, phone); intake information for your relocation (nationality, country of residence, travel and housing preferences); identity and immigration documents you upload (passport, admission letters, contracts); and payment records. Some of this is special-category data under Georgian LPDP and GDPR Art. 9: passport and biometric identity images, health-insurance information, and (only if you choose roommate matching) religious practice and dietary requirements.

3. Why we use it and our legal basis

We process ordinary personal data to provide the service you purchase (performance of a contract) and to run our business (legitimate interests, balanced against your rights). We process special-category data only on your explicit, specific, opt-in consent, recorded per purpose. You can decline any special-category purpose and still use the rest of the service.

4. AI processing and international transfers

We use AI services to draft and check paperwork, including reading identity documents. Some of these run outside Georgia and the EEA, and some may be in jurisdictions without an adequacy decision. We minimise and mask the data we send to those providers wherever the task allows it, work toward data-processing agreements with each provider, and only send special-category data to a non-adequate jurisdiction where you have given explicit consent that also covers the transfer (Art. 49 derogation).

5. Who we share data with

Government authorities where required to progress your application, and the processors who host or power the service: our database and file storage providers, our email provider, our payment provider, the AI providers described above, and Cloudflare, which provides bot-protection (Turnstile) on our forms and, where used, our CDN. If you choose to sign in with Google, Google processes the account details it shares with us for that purpose under its own privacy policy. Cloudflare’s handling of Turnstile data is described in its Turnstile Privacy Addendum. We do not sell your personal data.

6. How long we keep it

We keep account and application data for as long as your account is active and as required by law. Raw identity images in object storage are purged on a 30-day cycle once they are no longer operationally needed for your active application.

7. Your rights

You can access and export your data, request erasure, withdraw a consent, and ask us to correct or stop certain processing. To exercise any of these, email support@startabroad.ge — we respond within 10 working days. You may also complain to the Personal Data Protection Service of Georgia.

8. Cookies and sessions

We use a strictly necessary session cookie to keep you signed in. Our forms use Cloudflare Turnstile to tell human visitors from bots; Turnstile can set its own cookie and processes some technical data (such as your IP address and browser signals) under Cloudflare’s Turnstile Privacy Addendum. If a page errors, we may record a masked screen replay of that session (via Sentry) to help us fix the bug — text and form inputs are hidden by default, and this only happens on an actual error, not for ordinary visits. We do not use analytics or marketing cookies.

9. Security

We use encryption in transit, scoped access controls, rate limiting, and audit logging. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.

10. Data breaches

Where a breach is likely to risk your rights, we notify the supervisory authority within 72 hours and affected users without undue delay.

11. Changes

We may update this policy; the version and date above change when we do, and we record which version you consented to.

12. Contact

Questions or requests: support@startabroad.ge.