migracheckBack to home

Privacy Policy

Last updated: 2026-04-06

This Privacy Policy describes how Migra-check ("we") collects, uses, and shares information when you use migra-check (the "Service").

1. Information We Collect

  • Account information: name, email address, and profile data provided through our identity provider (Auth0).
  • Organization and billing data: organization name, plan tier, usage counters, and billing metadata managed by Stripe. We do not store full payment card numbers.
  • Customer Data: SQL migration scripts and database schema metadata snapshots that you submit for analysis.
  • Usage data: logs of API calls, analyses performed, and basic diagnostic information needed to operate the Service.

2. How We Use Information

  • To provide, maintain, and improve the Service.
  • To perform risk analyses on the migration scripts you submit.
  • To bill you and enforce plan limits.
  • To communicate service-related notices and security alerts.
  • To detect and prevent fraud, abuse, and security incidents.

3. Subprocessors

We rely on the following third-party subprocessors to operate the Service. Each is bound by appropriate confidentiality and data protection obligations:

  • Amazon Web Services (AWS) — hosting, database, and object storage.
  • Anthropic — large language model inference for risk analysis. Per Anthropic's API terms, inputs submitted via the API are not used to train their models.
  • Stripe — subscription billing and payment processing.
  • Auth0 (Okta) — identity and authentication.

4. Customer Data and AI Processing

When you submit a migration script for analysis, the script and a filtered subset of your schema metadata are transmitted to Anthropic's API to produce a risk report. Please do not submit secrets, personal data, or other sensitive information inside SQL scripts. See our Acceptable Use Policy for details.

5. Data Retention

We retain Customer Data and analysis results for as long as your account is active or as needed to provide the Service. You may delete analyses and snapshots at any time through the app. Upon account termination, we will delete or anonymize your Customer Data within a reasonable period, except where retention is required by law.

6. Your Rights

Depending on your location, you may have rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the EU/UK GDPR, the CCPA, or other privacy laws. These rights may include access, correction, deletion, data portability, and objection to certain processing. Quebec residents also have rights regarding automated decision-making. To exercise any of these rights, contact our Privacy Officer at [email protected].

7. International Transfers

Migra-check is based in the Province of Québec, Canada. Customer Data and personal information are transferred to and processed by our subprocessors in the United States (notably Anthropic and AWS). As required under Quebec's Law 25, we have assessed the privacy implications of these transfers and rely on contractual safeguards (including Standard Contractual Clauses where applicable) to protect your information.

8. Cookies

We use cookies and similar technologies strictly necessary to authenticate your session and operate the Service. We do not currently use third-party advertising or cross-site tracking cookies.

9. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your data. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice.

11. Privacy Officer and Contact

In accordance with Quebec's Law 25, Migra-check has designated a Privacy Officer responsible for ensuring compliance with applicable privacy laws. For privacy questions, to exercise your rights, or to file a complaint, contact our Privacy Officer at [email protected]. If you are not satisfied with our response, you may lodge a complaint with the Commission d'accès à l'information du Québec (CAI) or, for residents outside Quebec, the applicable supervisory authority.