Privacy Policy

SettleMalta ("we", "us") helps individuals prepare their Malta residence documents. This policy explains what personal data we process, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is the data controller

SettleMalta is the data controller for the personal data you provide through this service. For any data-protection request, contact us at privacy@settlemalta.app.

2. What data we process

• Account data: your email address, used to sign you in via a magic link.
• Checklist data: the answers you give about your situation (e.g. pathway, employment status) and your document progress.
• Documents you upload: files you choose to store in your private vault (for example a passport copy, work contract, or proof of address). These can include sensitive identity documents.

You decide what to upload. You are never required to upload a document to use the checklist.

3. Why we process it (lawful basis)

• To provide the service (performance of a contract with you): building your checklist, saving progress, and storing the documents you upload.
• With your consent: storing identity documents in your vault. You give this consent explicitly and can withdraw it at any time by deleting the documents or your account.

4. Where your data is stored

Your data is stored on our behalf by Supabase, on infrastructure located in the European Union. Uploaded documents are kept in a private storage bucket, accessible only to your own authenticated account.

5. Who we share it with

We do not sell your data and we do not share your documents with third parties. We use processors strictly to run the service: Supabase (database, authentication, file storage). If document classification is enabled, document text may be processed by Anthropic solely to detect a document type; it is not used to train models. We are not affiliated with Identità or the Government of Malta, and we never submit anything on your behalf.

6. How long we keep it

We keep your account and documents for as long as your account is active. You can delete individual documents at any time, or delete your entire account and all associated data from your checklist page. On deletion, your data is removed from our database and storage.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority (in Malta, the Information and Data Protection Commissioner, idpc.org.mt).

To exercise any of these, use the delete option in the app or email privacy@settlemalta.app.

8. Changes to this policy

We may update this policy. Material changes will be reflected by the "last updated" date above.