Privacy policy

1. Who is responsible

OCILife, Stralauer Platz 35, 10243 Berlin, Germany. Email: [email protected]. See also our Impressum.

2. Hosting and delivery

The site runs on servers of Hetzner Online GmbH in Germany. Traffic reaches it through Cloudflare, Inc., which provides the network connection, TLS encryption and protection against attacks. Cloudflare processes your IP address and technical request data for this and may do so outside the EU; transfers to the US are covered by the EU-US Data Privacy Framework and standard contractual clauses. Legal basis: our legitimate interest in a secure, reachable website (Art. 6(1)(f) GDPR).

Our server keeps short technical logs for troubleshooting, rotated automatically and not used to identify you.

3. Country detection and the country cookie

Cloudflare tells us which country your request comes from (derived from your IP address) so we can show the right country page. We don't store your IP address or location for this. If you choose a country or dismiss the country banner, we set a cookie named ocilife_country containing only a two-letter country code for one year, so we remember your choice. It is technically necessary to provide the service you asked for (§ 25(2) TDDDG) and is never used for tracking.

4. The case check

When you use "Check my case", your answers (postal code, dates, household and passport details) are sent to our server, used to calculate your result and then discarded. We don't store them and don't ask for your name or email to use the check.

5. Waitlist

If you join a waitlist, we store your email address, the country you asked about and the date, and use them only to tell you when that country is supported. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us. We delete your entry when the country launches and we've notified you, or when you ask.

6. Contact form and email

If you contact us, we store your name (optional), email address and message to reply to you and keep them for up to 12 months after the conversation ends. Emails to [email protected] are forwarded by Cloudflare Email Routing to a mailbox hosted by Google (Gmail). Legal basis: answering your request (Art. 6(1)(b) and (f) GDPR).

7. Account and sign-in

If you create an account, we store your email address. We sign you in with a one-time link sent by email (via our email delivery provider, Resend) instead of a password; we keep only a hash of each link and it expires after 15 minutes. When you're signed in, a cookie named ocilife_session keeps you signed in for up to 30 days. It is strictly necessary for the account (§ 25(2) TDDDG). Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR). You can ask us to delete your account at any time.

8. Your documents

Documents you upload (for example passport pages or nationality certificates) are encrypted (AES-256) before they are stored on our servers in Germany, are accessible only through your account, and are deleted automatically 90 days after upload. You can delete them earlier at any time. Encrypted backups are kept for up to 7 days, so a deleted file disappears from backups within a week. We use them only to prepare and check your application. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR); passport data may include special identifiers, which we process only for this purpose.

9. Free document scan

If you use the free document scan, the two images you choose are sent once, through OpenRouter, to an AI model that reads the name and date fields so we can compare them. We only use providers that commit to zero data retention and don't train on your data. OCI Life doesn't store the images or the extracted text; only the result is shown to you. To prevent abuse we keep a one-way hash of your IP address and the time of the scan for 24 hours. Legal basis: your consent (Art. 6(1)(a) GDPR), given with the checkbox before scanning.

10. Privacy-friendly analytics

To understand which pages and steps help people, we use PostHog (PostHog Inc.) with data hosted in the EU (Frankfurt). We run it in cookieless mode: nothing is stored on your device, no cookies or local storage are used, and we don't create user profiles. We record page views and anonymous usage events, such as completing the case check, the type of result shown and the country page used, never your answers, names or email. PostHog is configured to discard IP addresses. Requests are sent via our own domain. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR). We use no advertising or third-party marketing trackers.

11. Your rights

You have the right to access, rectify and erase your data, restrict or object to processing, data portability, and to withdraw consent. Email [email protected]. You can also complain to a data protection authority, for example the Berliner Beauftragte für Datenschutz und Informationsfreiheit.