1. Who is responsible for your data
The controller of personal data processed through DocRoute is the operator of DocRoute, a private individual living in Slovakia, who runs DocRoute as a free, non-commercial project. Contact for every privacy question or request: GitHub (DocRoute issues). GitHub issues are public, so never post personal data there; you can download or delete your own data at any time on the Account page, and a private email address will be published here soon. DocRoute has no data protection officer because it is not required to have one.
This policy follows the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Slovak Act No. 18/2018 Coll. on the Protection of Personal Data.
2. What we process, why, and for how long
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Account: email address and password (stored only as a hash by our authentication provider). If you sign in with Google: your Google email, name and profile picture link sent by Google. | To create your account, let you sign in and send emails you ask for (confirming your address, resetting your password). | Contract — providing the service you asked for (GDPR Art. 6(1)(b)). | Until you delete your account. |
| Applicant profile you choose to save: destination, field, degree and intake; citizenship; country of your school; current residence status; education status; grade scale and average; languages and certificate levels; exemption evidence you select. No documents are uploaded. | To compare your profile with published admission and residence rules and build your route. | Contract (Art. 6(1)(b)). | Until you change it or delete your account. |
| Saved universities and the route tasks you tick off. | To remember your shortlist and progress across devices. | Contract (Art. 6(1)(b)). | Until you remove them or delete your account. |
| Public profile and stories (only if you create them): the name you choose, an optional photo and short text about you, and the stories you send with their countries, year, reason for moving and optional university or employer. This information is visible to everyone on DocRoute once published; your email and applicant profile are never shown. | To show your story and profile on the Stories page so others can learn from your move. | Contract — publishing what you asked us to publish (Art. 6(1)(b)). Please do not include health, religion or other special-category data. | Until you delete it or your account. Stories we decline or hide stay visible only to you until you delete them. |
| Answers to route questions and your move date when you are not signed in. These live only in the page address (URL) and on your device; we do not save them in our database. | So the route can be built and shared as a link without an account. | Contract (Art. 6(1)(b)). | Not stored by us, apart from technical logs below. |
| Waitlist (only if you press “I want the full route” and tick the consent box): your email address, which route you were viewing (for example study in Slovakia), the time you agreed and the version of the consent text. | To email you once if a fuller version of the route launches, and to count how many people want it for each route. | Your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time (see section 5); this does not affect what was done before. | Until we send that one email, until you withdraw, or at most 12 months after you joined, whichever comes first. Then deleted. |
| Feedback you send with the feedback form: a rating from 1 to 5 and/or your text, the page address without the part after “?”, and the time. We do not ask who you are; please do not write personal details. | To find mistakes and improve DocRoute. | Legitimate interest in improving the service (Art. 6(1)(f)). | At most 24 months. |
| Visit statistics, only if you choose “Accept all” on the cookie banner: page address without the part after “?”, referring site, country or region, browser, operating system and device type. No cookies; a visit is recognised by a hash that is discarded after 24 hours. We see only totals. | To see which pages are used and where people get stuck. | Your consent (Art. 6(1)(a)), which you can withdraw on the Cookies page at any time. | Aggregated by Vercel under its Web Analytics terms. |
| Technical data: IP address, browser type, the page requested (including its address), time and errors, recorded automatically by our hosting and database providers. | To deliver pages, keep the service secure and fix errors. | Legitimate interest in a secure, working service (Art. 6(1)(f)). | For the providers' standard log periods (typically days to a few weeks). |
| Messages you send us by email. | To answer you, fix reported mistakes and handle your requests. | Legitimate interest in answering you (Art. 6(1)(f)); legal obligation for data-protection requests (Art. 6(1)(c)). | As long as needed to deal with the matter, at most 3 years. |
Giving us data is voluntary. Without an email address we cannot create an account, but you can still explore universities and build routes without one.
We do not ask for special categories of data (such as health, religion or ethnic origin). Citizenship and residence status are needed because the rules depend on them; please do not enter anything the forms do not ask for.
Public profile and stories
A public profile and stories are optional. Your photo is cropped and re-saved in your browser before upload, which removes hidden photo data such as GPS location. Stories are read by the operator before they appear. Anyone can read and copy what is published, so share only what you are comfortable with. You can change or remove your name, photo and stories on your Account page and on Share your story; deleting your account removes them all.
3. Automated matching
DocRoute automatically compares your profile with published rules and shows statuses such as “meets” or “missing information”. This is information for you only. It is not a decision about you, has no legal effect and is not sent to anyone, so Article 22 GDPR on automated decisions does not apply. Admission and residence decisions are made only by universities and authorities.
4. Who helps us run DocRoute
We do not sell or rent personal data and do not share it for marketing. These providers process data for us, under their data processing terms:
- Supabase, Inc. — Database, file storage and sign-in (stores your account, profile, saved universities, progress, public profile, photo and stories, waitlist emails and feedback). Their privacy policy
- Vercel, Inc. — Hosting: delivers the website, records technical logs and, only with “Accept all”, counts visits (Web Analytics). Their privacy policy
- Google LLC / Google Ireland Ltd — Only if you choose “Continue with Google”: confirms your identity to us. Their privacy policy
- Wikimedia Foundation — University and country photos are loaded from upload.wikimedia.org, so your browser sends your IP address to Wikimedia when it shows a photo. No account data is shared. Their privacy policy
Some of these providers are based in the United States or may process data there. Such transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses (GDPR Art. 46) included in the providers' data processing terms.
We may disclose data to a public authority only where the law requires it.
5. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it (Art. 15);
- have incorrect data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict processing (Art. 18);
- receive your data in a machine-readable format (Art. 20);
- object to processing based on legitimate interest (Art. 21).
Most of this you can do yourself: edit your profile at any time, and use Download my data or Delete my account on the Account page. Deleting your account removes your account, profile, saved universities, progress and waitlist entries made with the same email from our database immediately; copies in our providers' backups are overwritten within their backup cycle. For anything else, email GitHub (DocRoute issues). We answer within one month.
Leaving the waitlist
You can withdraw your waitlist consent at any time, as easily as you gave it: enter the email below and it is deleted at once. For your privacy, the page does not say whether the email was on the list.
You also have the right to lodge a complaint with a supervisory authority. In Slovakia this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk. You can also contact the authority in the EU country where you live.
6. Age
Accounts are for people aged 16 or older. If you believe a younger person created an account, write to us and we will delete it.
7. Security
Connections are encrypted (HTTPS). Each saved record is protected by database rules so that only you, when signed in, can read or change it. Waitlist emails cannot be read through the website at all; only the operator sees them. Passwords are never stored in readable form. No system is perfectly secure; if a breach likely puts your rights at risk, we will notify the authority and, where required, you.
8. Cookies
DocRoute uses strictly necessary cookies and browser storage, for example to keep you signed in, and cookieless visit statistics only if you choose “Accept all”. Details are in the Cookie Policy.
9. Changes
We will update this policy when what we do with data changes, for example if paid features or new providers are added. The date at the top shows the current version; important changes will be announced on the site before they apply.