Privacy Policy

Effective date: August 7, 2026

This privacy policy explains how Landly processes personal data for the Landly web application, mobile companion app, account services, relocation planning tools, document workflows, AI Guide, support, security, Early Access contract administration, and privacy requests.

The current Open Beta is free and capacity-limited. Landly does not collect payment-card details, create a paid subscription, or send checkout data to a payment provider during this phase. The absence of a price does not reduce your privacy rights or Landly's data protection obligations.

Controller And Contact

Landly LTD, UIC 208838502, registered office at 25 Vitosha Blvd., fl. 2, 1000 Sofia, Bulgaria, is the controller for the service described in this policy. Additional provider-identification details are published in Landly's Legal Notice. You can contact Landly about privacy or data protection questions at privacy@landly.to.

Landly has not published a Data Protection Officer contact at this time. If Landly appoints a Data Protection Officer or is required to publish another designated privacy contact, those details will be added to this policy. Until then, privacy questions should be sent to the email address above.

Personal Data We Process

Registration and legacy waitlist data

For current Open Beta registration, Landly processes the account email address, email confirmation status and timestamps, access status, and security metadata needed to activate the account. For legacy waitlist requests, Landly also retains the moving-to city, contact acknowledgement, request status, duplicate request count, and any message metadata you chose to send. The contact acknowledgement is not analytics or marketing consent.

Account and authentication data

Email address, Supabase account ID, authentication/session records, password reset events, plan status, and account security metadata.

Profile and relocation planning data

Information you add to plan a move or stay, such as origin and destination, move timeline, household context, language level, employment context, budget ranges, tasks, and progress. The general profile uses birth year rather than a full date of birth. Child planning profiles may contain an optional birth year, Germany-plan inclusion, and move or join status supplied by the adult account holder. General onboarding asks only whether you are an EU, EEA, or Swiss citizen: Yes, No, or Not sure; it does not store a specific nationality or Residence document there.

Optional personalization and accessibility preferences

Interest IDs you explicitly save for optional For you recommendations, the current completed-interest state, a minimal activation or stop record with notice and catalog version but no Interest IDs, active recommendations you marked Not interested, and short-lived reset retry evidence without raw Interest or content IDs. Accessibility presentation choices stay on your device by default. Landly creates an account copy only if you choose Sync across devices.

Document and user content

For a required or result document, you may save a user-confirmed and unverified availability status, storage location, and optional expiry details. If you explicitly use Google Drive Picker, Landly stores the selected display name and opaque Drive file identifier, not the file. The short-lived authorization stays in the browser and is not retained by Landly. Files uploaded to the former Document Vault are processed only as legacy Landly copies for recovery and deletion.

Early Access contract and withdrawal evidence

Terms version, contract identifier, acceptance and conclusion timestamps, contract email, token-free confirmation template and delivery proof, termination or supersession events, and any withdrawal statement and receipt evidence. A withdrawal bearer token and its verification material are excluded from data exports and are never stored inside the email template snapshot.

AI Guide and support context

When you use Landly Guide, Landly processes your question, selected relocation context such as city or visa context, generated answer text, source references, quota counters, and safety/refusal metadata.

Privacy, consent, and account-request records

Consent choices, consent history, data export and deletion requests, request status, timestamps, and pseudonymized request metadata such as HMAC-hashed IP address or user-agent values used for auditability and security.

Community participation data

Community questions, task feedback, candidate tips, votes, reports, Playbook reuse submissions, Spotlight story data, cohort interest joins, consent records and timestamps, moderation state, reason codes, report metadata, and safe routing metadata. Public Community display is pseudonymous or editorial by default and does not include your email, exact address, employer, document names, nationality, or children's ages.

Technical, security, and usage metadata

API request metadata, device or browser information, approximate network metadata, error and security logs, rate-limit counters, and cache records needed to run, protect, and troubleshoot Landly.

Maps and location-related context

Landly stores the cities, countries, location-related interactions, and map choices you use. Third-party map services may process tile requests when map surfaces are used. Precise device location is processed only if a feature asks for it and you allow it.

Purposes And Legal Bases

Operate the capacity-limited Free Open Beta registration and confirmed-email activation flow, administer selected accounts, and manage legacy waitlist requests and updates.

Steps requested by you before a possible contract, GDPR Art. 6(1)(b), for registration, confirmation, activation, or responding to a legacy request; legitimate interests, Art. 6(1)(f), only for capacity administration, duplicate handling, security, and abuse prevention.

Provide Landly accounts, workspaces, tasks, maps, saved planning flows, optional user-initiated Google Drive references, and legacy file recovery or deletion.

Contract performance, GDPR Art. 6(1)(b), only to the extent objectively necessary to perform the document-tracking, optional Drive-linking, legacy recovery, or other service operation you request.

Generate the core relocation or stay plan you explicitly request using only profile context objectively necessary for that requested workflow.

Contract performance, GDPR Art. 6(1)(b), only to the extent the processing is objectively necessary for the requested core service. Optional recommendation personalization is handled separately below.

Show optional For you recommendations from Interests you explicitly save and, if requested, synchronize accessibility presentation choices across your devices.

Consent, GDPR Art. 6(1)(a). Save and Sync across devices are the affirmative choices. Clear interests, Reset recommendation preferences, or turning sync off stops the corresponding processing without blocking unrelated Landly use.

Conclude, confirm, administer, terminate, or receive a withdrawal from the free Early Access contract and keep the evidence required for those events.

Contract performance and pre-contract steps, GDPR Art. 6(1)(b), for the service lifecycle; legal obligations and legitimate interests, Art. 6(1)(c)/(f), for mandatory consumer notices and the establishment, exercise, or defence of legal claims.

Operate Community contributions, moderation, safety reporting, and abuse prevention.

Consent for public contribution and reuse, GDPR Art. 6(1)(a); legitimate interests for moderation, safety, quality, and abuse prevention, Art. 6(1)(f); legal obligation where applicable, Art. 6(1)(c).

Protect Landly, prevent abuse, enforce rate limits, debug incidents, and keep audit trails.

Legitimate interests, Art. 6(1)(f). Landly pursues the concrete interests of protecting authenticated accounts, preventing automated abuse, maintaining service reliability, investigating security incidents, and demonstrating accountable handling of privacy requests.

Handle data access, export, correction, restriction, objection, and deletion requests.

Legal obligation and legitimate interests, Art. 6(1)(c)/(f).

Send transactional contract, service, security, or privacy notices.

Contract performance, legal obligation, and legitimate interests, Art. 6(1)(b)/(c)/(f).

Send marketing messages or process optional location/personalization consents.

Consent, Art. 6(1)(a), which you may withdraw at any time.

Required And Optional Information

Providing an email address, password or another supported authentication method, and the technical data needed to maintain a secure session is required to create and use an authenticated Landly account. Without this information, Landly cannot provide the authenticated service.

The minimum relocation profile fields needed for the core plan you request, the separate Step 5 Free Early Access Terms acceptance, and the contract email are required to conclude and provide the Free Open Beta service. Registration and email confirmation alone do not conclude that contract. Additional profile details, AI Guide questions, map interactions, document status and reminder details, and optional consent-based settings are provided by choice. Paid checkout is not available during this phase.

Interest-based For you recommendations and account synchronization of accessibility presentation choices are optional. Interests are activated only when you choose Save. Accessibility choices remain on the current device unless you separately choose Sync across devices. These choices do not change prices, required tasks, eligibility, marketing, or legal outcomes.

Community participation is off by default and required for end-user public contribution or reuse actions. Viewing curated or public Community snippets does not require Community participation consent, though analytics still follows the analytics consent choices described in this policy.

You can change optional website cookie choices in . Essential storage remains required for service operation and to remember your choice. More detail is available in the Cookie Policy. Marketing cookies are not currently used.

Document tracking records the availability status and optional location or expiry details you enter. It does not inspect document contents, perform OCR, extract text or MRZ data, verify authenticity, or file a document.

On a configured Documents task surface, Landly loads Google's Identity Services and Drive Picker libraries so the optional action is ready. It requests no Google account authorization until you explicitly choose the Google Drive action. Google then handles account selection and shows files in an on-demand dialog. You may also upload a local file into your own Google Drive there. Landly stores only the selected display name and opaque file identifier. The file remains with Google; Landly does not download it or retain the OAuth access token. There is no background Drive connection. Removing the Drive link removes the reference from Landly but does not delete the Google Drive file. Manually choosing Google Drive as a location without using the picker remains only a label.

Processors And Third-Party Services

Landly uses service providers to operate the service. They process personal data only for the relevant service purpose. Landly keeps a public list of core operational providers on the Subprocessors page and updates this policy when provider changes materially affect how personal data is processed.

Vercel

Frontend hosting, CDN, and web delivery for the Next.js application.

Render

Backend API hosting and Valkey cache infrastructure.

Supabase

PostgreSQL/PostGIS database, authentication, JWT/session handling, and Supabase Storage for legacy document objects uploaded before new document storage was closed.

Resend

Transactional email delivery for Early Access contract confirmations, service, security, or privacy notices where enabled.

Google Workspace / Gmail

Business email hosting, mailbox handling, and support/privacy correspondence where Landly receives or sends email through Google Workspace or Gmail.

Google Drive / Google Identity Services

Optional, user-initiated selection or upload of a file in the user’s own Google Drive. Landly receives only the selected display name and opaque file identifier and does not retain Google OAuth tokens or download file contents. Google also handles the user’s Google Account and Drive service under Google’s own terms and privacy policy.

MapTiler

Map tile delivery and map-related request processing when map surfaces are used.

PostHog Cloud EU

Consent-based web and usage analytics for page views and service usage signals.

Anthropic

AI model processing for Landly Guide, support, planning, or safety workflows where Anthropic models are enabled.

OpenAI / ChatGPT

AI model processing for Landly Guide, support, planning, or safety workflows where OpenAI or ChatGPT-based services are enabled.

The current mobile companion app does not include advertising, tracking, crash-reporting, or analytics SDKs, and it does not run App Store billing, Google Play billing, in-app purchases, or mobile checkout.

International Transfers

Landly is an EU-oriented service. Some providers may process data outside the European Economic Area, depending on provider operations and support access. Where this happens, Landly relies on appropriate safeguards such as data-processing agreements, EU Standard Contractual Clauses, adequacy decisions, and EU-US Data Privacy Framework participation where available.

Retention

Landly keeps personal data only as long as needed for the purposes described in this policy, including account operation, contractual services, security, legal compliance, accounting, dispute handling, and privacy-request auditability.

  • Account, workspace, profile, task, and document records are kept while your account is active or while needed to provide the requested service.
  • Early Access contract, confirmation-delivery, termination, and withdrawal evidence is kept for five years after the contract is superseded, withdrawn, or otherwise ended. A later withdrawal from an older contract restarts that period. A documented legal hold may pause deletion only while the related claim, authority request, or incident requires the evidence. Active delivery leases and retry schedules are cleared when delivery resolves. Minimum delivery evidence, including attempt counts, final attempt timestamps, and provider receipt identifiers, remains with the contract evidence until the same deletion date.
  • A child birth year, plan-inclusion choice, and move or join status are kept only with the relevant Scenario or account and have no separate raw-value history. The coarse EU, EEA, or Swiss citizenship orientation is kept only while current and is replaced or removed when corrected or cleared.
  • Device-local accessibility choices remain until you reset them or remove application storage. A synchronized account copy is deleted when you turn sync off, reset that account copy, or delete the account; Landly keeps no preference history.
  • Saved Interest IDs remain until you edit, clear, or reset them, or delete the account. Removed IDs are deleted in the same operation and are not kept as Interest history. Active Not interested suppressions remain only until Show again, Undo, Reset, or account deletion.
  • The separate Interest activation record contains only the activation or stop state, notice and catalog version, and timestamps. It contains no Interest IDs, IP address, or user agent. It remains while Interest processing is active and is deleted no later than 30 days after you clear or reset Interests or otherwise stop that processing.
  • Personalization reset retry evidence contains keyed hashes, operation type, counts, and expiry rather than raw Interest or recommendation IDs. It expires after 18 hours and is deleted no later than 24 hours.
  • Files uploaded before Landly closed new document storage, their task links, and their storage lifecycle metadata remain only for user recovery and deletion. Account deletion removes task links, tombstones those legacy document records, and purges backing objects unless a lawful exception requires limited audit retention. Landly does not inspect legacy file contents or add OCR for this migration.
  • A document availability status and its optional location or expiry details, plus an optional Google Drive display name and opaque file identifier, remain only with the relevant task, plan, and active account. Remove Drive link deletes the two Drive reference fields without affecting the file. Undo deletes the complete status and cancels pending expiry reminders; task, plan, or account deletion also removes it.
  • Account deletion requests are handled within a reasonable period and, where GDPR applies, within 30 days unless a lawful exception requires a different timeline.
  • Security and audit records may be retained for longer where required by law or necessary to establish, exercise, or defend legal claims.
  • Community UGC content may be retained while your account is active. Account deletion removes or anonymizes public author links, deletes raw vote and report signals where applicable, and keeps bounded moderation queue or audit metadata only where needed for safety, accountability, legal compliance, or legal claims.
  • Export download links and private export artifacts expire after 24 hours. Terminal export-request metadata is deleted after 30 days.

Your Rights

Where GDPR or similar privacy law applies, you may have the rights below. Some rights can be limited by lawful retention, security, fraud-prevention, accounting, or legal-claim requirements.

  • Access a copy of your personal data.
  • Correct inaccurate or incomplete personal data.
  • Request deletion of your account or specific data where legally available.
  • Restrict or object to certain processing.
  • Receive portable data where technically and legally available.
  • Withdraw consent for consent-based processing without affecting earlier lawful processing.
  • Complain to a competent supervisory authority.

To request account deletion, use the in-app deletion flow or the public Account Deletion resource. For other privacy requests, contact privacy@landly.to.

You may also complain to the EU data protection supervisory authority responsible for Landly LTD in Bulgaria, the Commission for Personal Data Protection (CPDP), or to another competent EU supervisory authority available to you.

Automated Decision-Making

Landly does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Landly Guide and other AI-assisted outputs are informational and assistive: they do not determine visa eligibility, immigration outcomes, healthcare rights, tax obligations, or other legal entitlements.

Pre-publication Community moderation screening may automatically queue or hide content for safety review, but it does not produce legal or similarly significant effects. Reported content is handled through Landly support and review paths.

Document availability status is supplied by you and is not a verification, eligibility decision, or legal determination.

Security

Landly uses technical and organizational measures designed to protect personal data, including encrypted transport, access controls, service-role separation, short-lived signed URLs for recovery of legacy document files, audit logs, HMAC-based pseudonymization for selected request metadata, input validation, rate limits, a least-privilege Google `drive.file` authorization, and provider-neutral storage boundaries. Google browser credentials must be restricted to approved origins; Landly stores no Google client secret or refresh token in this flow.

Children

Landly is not directed to children and is intended for adults who are evaluating, planning, or managing relocation and stay workflows. Service and legal eligibility requirements, including account minimum-age rules, may vary by service, location, and applicable law.

An adult account holder may add only the minimum child-planning information described above. Landly does not create child accounts, ask for a child's full legal name or full date of birth in the general profile, or use child information for marketing or recommendation ranking.

Updates

Landly may update this policy when services, processors, mobile capabilities, legal entity details, jurisdiction, language requirements, or other legal requirements change. If a change materially affects your rights or choices, Landly will use a reasonable notice method for affected users.

Related Legal Pages