Legal · How we treat your data

Privacy Policy.

We are paranoid about your documents and quiet about your data. Here's exactly what we do and don't do with the things you give us.

Effective · 22 May 2026 Version 2.1 Replaces v 2.0 (Jan 2026)
In short — what to know
  • We collect the minimum we need to walk your move — name, email, phone, the documents you choose to upload, and the things you tell the AI.
  • Your documents are encrypted at rest with AES-256. Only you and the support engineer you explicitly grant access to can see them.
  • We never sell your data. We never share it with consultants, universities, or any third party without you saying so, in writing, per request.
  • Delete your account any time. It wipes your profile, documents, and chat history in 30 days. No clawback, no "are you sure" guilt trips.

Who we are

Settl Abroad Ltd. is a private company registered in England and Wales (company no. 15820341) with our registered office at 14 Little Alma Street, London EC2A 4HP, United Kingdom. We operate Settl Abroad from London, Berlin, and Bengaluru.

When this policy says "we," "us," or "Settl Abroad," that means Settl Abroad Ltd. When it says "you," that means anyone using settlabroad.com or the Settl Abroad web app.

Data controller
Settl Abroad Ltd., London EC2A 4HP, UK
UK / EU rep
The DPO at Settl Abroad Ltd. is the registered representative for UK GDPR and EU GDPR.
India SPDI rep
For India's DPDP Act, the same DPO acts as our Grievance Officer.
Reach the DPO
help@settlabroad.com

What we collect

We try to collect as little as possible. Here is the full list.

Things you give us directly

  • Identity: your full name, date of birth (so we can verify you're 16+), and a profile photo if you choose to add one.
  • Contact: email address (required) and one mobile number (required, for WhatsApp support).
  • Move context: the destination, university, programme, start term, visa status, and budget you share during onboarding.
  • Documents: any file you upload — passport, offer letter, blocked-account confirmation, transcripts, language tests, and so on.
  • Chat content: every message you send the AI and every reply it gives.
  • Payment: billing name, billing address, and card details handled by Stripe — we never see your full card number.

Things we collect automatically

  • Device: browser type, operating system, screen size, language preference.
  • Usage: which pages you visit, which features you use, how long you stay, what fails for you. We use this to make the app less frustrating.
  • IP address: for security, fraud prevention, and approximate region (we don't use it to pinpoint your home).

Things we do not collect

  • We don't run third-party advertising trackers. There is no Facebook Pixel, no Google Ads tag, no TikTok pixel.
  • We don't collect your address book, photos, or location beyond IP-derived region.
  • We don't ask for your social media accounts.

Why we collect it

Each piece of data has a job. If it doesn't have one, we don't collect it.

Identity
To create your account and address you by name in chat.
Email
To sign you in, send verification, password resets, and product updates you opt into.
Phone
To send the OTP at signup and provide WhatsApp support. We never SMS you marketing.
Move context
To give the AI the background it needs to answer you precisely — and so we don't ask the same question twice.
Documents
To verify the things we need to verify (your visa terms, your block account, your offer) before you act on them.
Chat content
To answer your questions and to improve the AI's accuracy on the corridor we cover. See §5 on what we do and do not do with this.
Payment
To charge your subscription and refund it if you cancel within 7 days.
Usage
To find and fix what's broken, slow, or confusing.

The legal basis for processing varies by data type. Most of it is contract (we can't deliver the service without it). Marketing emails are consent (you tick the box). Security telemetry is legitimate interest. Where consent applies, you can withdraw it at any time from your profile settings.

How long we keep it

We keep your data only as long as we need it.

Active account
While your account exists, we keep everything you've given us so the AI knows you.
After you delete
30 days, then it's permanently erased from production and from rolling backups within 60 days more.
Cancelled subscription
We keep your data for 12 months in case you resubscribe. After that, we ask if you want us to delete it.
Payment records
7 years, because UK and EU tax law requires it. Held only by us and by Stripe.
Support tickets
2 years, then erased.
Server logs
90 days for security investigations, then rotated out.

Who we share with

The shorter the list, the better. Here is ours.

Processors — the few we use

  • Stripe, Inc. — payments and billing. Stripe holds your card details; we don't.
  • Amazon Web Services (Frankfurt region) — hosting, encrypted storage, and backups. EU data residency.
  • OpenAI — powers the AI. Chat content goes to OpenAI's API to generate replies; under our agreement, OpenAI does not train its base models on Settl Abroad customer data.
  • Twilio — sends the SMS OTP at signup. Twilio receives only your phone number and the code.
  • Postmark — sends transactional email (verification, password reset, billing receipts). Postmark sees only your email address and the message.
  • PostHog (self-hosted in Frankfurt) — product analytics. No external sharing. We anonymise IPs at ingestion.

Every processor signs a Data Processing Agreement with us before they touch your data.

Plain language We never share your documents, your chat history, or your move context with universities, consultancies, advisors, or anyone else — unless you click the share button on a specific document for a specific person. That action is logged in your audit trail and the share is revocable at any time.

When we're legally required to share

If a UK or EU court compels us, or if Indian authorities issue a valid legal request under the DPDP Act, we comply. We'll tell you about the request unless we are legally prohibited from doing so. We've never received one.

How we secure it

  • Encryption at rest: AES-256 for documents in S3; column-level encryption for sensitive fields (phone, visa numbers, blocked-account references).
  • Encryption in transit: TLS 1.3, HSTS preloaded, modern cipher suites only.
  • Access controls: SSO + 2FA for every team member. Customer document access is logged and reviewed weekly.
  • No production data in development: engineers never load real user data onto their machines.
  • Bug bounty: we run a private programme. Reports to help@settlabroad.com.

We have an incident response plan. If a breach affects you and creates a risk to your rights, we will tell you within 72 hours of discovering it — what happened, what we know, and what you should do.

Your rights

Under UK GDPR, EU GDPR, and India's DPDP Act, you have the following rights. We honour them regardless of where you live.

  • Access: ask for a copy of everything we hold on you. We send it in machine-readable format within 30 days.
  • Correction: fix anything inaccurate. The profile edit screen lets you do most of this without writing to us.
  • Deletion: erase your account and everything in it. One tap in profile settings; 30 days to full erasure.
  • Restriction: ask us to stop processing your data while you contest something.
  • Portability: export your chat history, documents, and context as a single ZIP.
  • Objection: tell us to stop using your data for legitimate-interest processing (e.g., usage analytics).
  • Withdraw consent: for anything based on consent — like product-update emails — opt out from your profile or any email footer.
  • Complain to a regulator: the UK ICO (ico.org.uk), an EU supervisory authority, or the Indian DPB.

To exercise any of these, write to help@settlabroad.com or use the data-rights form in your profile. We reply within 7 working days.

Cookies & tracking

We use cookies sparingly. On your first visit we ask which categories you're okay with.

Essential
Sign-in session, CSRF protection, cookie-consent preferences. Always on — the site can't run without them.
Analytics
PostHog (self-hosted). Records anonymised page views and feature usage. You can refuse and the app still works.
Marketing
None. We don't run them.

You can change your cookie preferences at any time from your profile → privacy.

Children

Settl Abroad is for people 16 and older. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, write to help@settlabroad.com and we will delete the account.

Cross-border transfers

Most of your data lives in Frankfurt, Germany (EU). Some processors (OpenAI, Twilio, Postmark, Stripe) operate from the US. When data moves out of the UK or EU, we rely on the European Commission's Standard Contractual Clauses (2021) and, where required, the UK International Data Transfer Addendum.

If you sign up from India, your data is transferred to the EU under the DPDP Act's permitted-territory mechanism. We do not transfer Indian personal data to countries the Indian government has restricted.

Changes to this policy

We update this policy when we add features, change processors, or fix language that's unclear. When we make material changes, we'll:

  • Bump the version number at the top of this page.
  • Email you at least 30 days before the change takes effect.
  • Post a summary of what changed and why.

You can always read previous versions at settlabroad.com/privacy/archive.

Get in touch

Questions, requests, complaints — anything privacy-related — go to one place.

Email
help@settlabroad.com
Post
The DPO, Settl Abroad Ltd., 14 Little Alma Street, London EC2A 4HP, UK
India Grievance Officer
help@settlabroad.com
WhatsApp
Same number you use in-app, for non-sensitive questions only.

We reply within 7 working days. If we're slow, write again — the previous message may have hit a filter.

This is not a contract — it's a promise.

The contract is in our Terms of Service. This Privacy Policy describes how we behave even when you're not looking.