Privacy Policy

Information we process

• Account information, including your email address and internal user ID.
• Authentication information, including access and refresh tokens used to keep you signed in. Native apps store sessions in iOS Keychain or Android Keystore-backed storage.
• Case information, including requirements, descriptions, statuses, progress, and update times connected to your case.
• Documents you select for a requirement, including PDFs, PNGs, JPEGs, prepared upload PDFs, filenames, file type, size, processing status, and processed PDFs.
• Notifications, including case and document messages, read status, timestamps, and the relevant requirement.
• Push delivery information, including a device notification token and delivery information when device notifications are enabled.
• Support communications sent to the public contact email address.
• Basic website technical information necessarily processed by the hosting provider to serve and protect this website.

Information we do not currently collect for these purposes

• Advertising identifiers, cross-app tracking information, advertising profiles, or analytics events and analytics SDK data in the current mobile apps.
• Personal data for sale.
• Contact lists, precise location, microphone recordings, calendar, health, or payment data.

How we use information

• To authenticate users, restore sessions, and show the correct case requirements and progress.
• To receive, verify, process, store, and provide access to supporting documents.
• To deliver in-app and optional device notifications.
• To provide support, password reset, security, fraud prevention, account deletion, maintenance, troubleshooting, and legal compliance.

Document handling

The app validates and prepares a selected file for upload. The upload is placed in private quarantine storage and the backend verifies a PDF before making it available as a processed document.

A document can be rejected or fail processing. Processed documents remain private and are accessed through short-lived links. A successful upload does not mean a document has been accepted for a citizenship case or by a government authority.

When information is shared

• Supabase for authentication, database services, private document storage, signed links, and backend processing.
• Apple Push Notification service for delivery to Apple devices when enabled.
• Firebase Cloud Messaging and Google for delivery to Android devices when enabled.
• Cloudflare for delivery and protection of the public website.
• Professional advisers, regulators, courts, authorities, or a properly managed successor operator when legally required or appropriate.

Legal bases

The operator and counsel will confirm the legal bases that apply to this service. These may include performing a contract or steps you request, legitimate interests in operating and securing the service, legal obligations, and consent where required for optional notifications.

Retention

We keep personal data only for as long as needed to provide and secure the Portal, support your application, meet legal obligations, and establish or defend legal claims. When data is no longer needed, we delete or de-identify it. Protected backup copies may remain temporarily until they are overwritten through the normal backup cycle.

Account and application data, uploaded documents, notifications, push tokens, support messages, security records, and backups may follow different retention periods. We review those periods and delete or de-identify data when its purpose expires, unless the law requires longer retention.

Security

The service uses HTTPS/TLS in transit. Native sessions are kept in platform-protected storage. Access to case data and document records is scoped to the authenticated user. Documents are stored privately and processed documents use short-lived access links.

No system can guarantee absolute security.

International processing

Good Citizenship Group is located in Croatia. Service providers may process personal data in other countries. Where required, transfers outside the European Economic Area use safeguards provided by applicable data-protection law.

Your choices and rights

• Correct account information or ask for access to personal data.
• Request deletion through the account-deletion page.
• Turn off general push announcements in the app or device notifications in operating-system settings.
• Exercise applicable privacy rights based on your location and lodge a complaint with an applicable data-protection authority where that right exists.

Children

The final policy will state the approved minimum age or intended audience. The Portal is intended for adult clients unless the operator and counsel confirm otherwise.

Changes to this policy

The effective date will be updated when this policy changes. Material changes will be communicated where required.

Contact

Good Citizenship Group is the operator. Privacy questions can be sent to [email protected].