Privacy notice

Version 1, last updated 29 October 2026

Draft for legal review. This document describes how the Intlgrate prototype works and must be reviewed by a qualified adviser, and completed with the operating company's details, before public launch.

Who we are

Intlgrate is operated by [Company name], registered in England and Wales under company number [number], at [address]. We are the controller of the personal information described here. You can contact our data protection lead at [privacy email].

What we collect

Account details: your name, email address, password (stored only as a secure hash by our authentication provider) and account type.
Onboarding details: university, country of origin, preferred language, study stage, arrival status and the support areas you choose.
Optional immigration details: visa category, visa and course dates and settlement concerns, only if you choose to add them.
Wellbeing information: mood, stress and sleep check-ins, feelings you select and reflections you write. This can be health information, which is special category data.
AI companion conversations: the messages you send and the replies you receive, if you keep history switched on.
Community content: posts, replies, reports and blocks.
Organisation staff details: for university and agency users, your organisation and role.
Technical information: security logs, error logs and essential cookies.

Why we use it, and our lawful bases

To provide your account and the core service (contract).
To store and use wellbeing and optional immigration information for your own support (your explicit consent). You can withdraw consent by deleting the information or your account.
To share anonymous, aggregated statistics with an organisation you connect to (your consent, given separately for each type of sharing). Aggregates are never shown for groups of fewer than 5 students.
To keep the platform safe, including moderation, rate limiting, crisis signposting and audit logs (legitimate interests).
To meet legal obligations (legal obligation).

We do not use nationality, ethnicity, visa category or immigration status on their own to make decisions about you. We do not sell your information or use it for advertising.

Who we share it with

Supabase hosts our database and authentication in the European Union.
OpenAI processes companion messages to generate replies. Messages are sent from our servers, not your browser. This involves a transfer outside the UK, which must be covered by appropriate safeguards such as the UK International Data Transfer Addendum. [Confirm processor terms and retention settings before launch.]
Universities and agencies only receive what is described in the sharing choices you accept, and never your conversations, check-in notes or immigration details.

How long we keep it

By default, AI conversations are kept for 12 months, check-ins for 2 years, and security audit logs for 6 years. You can delete conversations, check-ins and optional details sooner at any time. Deleting your account removes your personal information, except where we must keep a minimal record of the deletion itself.

Your rights

You have the right to access, correct, delete, restrict or object to the use of your information, to data portability, and to withdraw consent. You can download your data and delete your account in Settings, or contact us. You can complain to the Information Commissioner's Office at ico.org.uk.

Security

Data is encrypted in transit and at rest by our hosting provider. Access is controlled by role and by row-level security, so each organisation can only reach its own data. AI keys are held on our servers only.