Privacy policy
Version
Retireacross helps people choose where to retire abroad and settle there. We collect as little personal data as possible, never sell it, and show no advertising. This policy explains what we process, why, on which legal basis (EU General Data Protection Regulation, "GDPR"), and your rights.
1. Who is responsible
Data controller: Jerome Goubier, Dubai, United Arab Emirates. Contact for any privacy question or request: contact@retireacross.com.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Visiting the site without an account: IP address, browser, pages requested (server logs) | Deliver the site, security, preventing abuse | Legitimate interest (Art. 6(1)(f)) | About 14 days (log rotation) |
| Tools (country match, budget, visa checker, distance from family) without an account | Calculations run in your browser; nothing is sent to or stored by us | — | Not stored |
| Account: email address, password (stored only as a strong one-way hash), or a Google account identifier and name if you use Google sign-in; dates of creation and last login | Provide your account | Contract (Art. 6(1)(b)) | Until you delete the account; inactive accounts are deleted after 24 months without login |
| Your retirement profile, when you choose to fill it in: single or couple, age range, passport(s), country where you live now, where your family lives, budget and income range, preferences (climate, language, city size), shortlist, chosen country, checklist progress | Match countries to your situation and build your settling plan | Consent (Art. 6(1)(a)), given when you create the account (or at login after a policy change); withdrawable at any time in "My plan" | Until you withdraw consent or delete the account (withdrawal deletes this data) |
| Health needs, only if you choose to answer, in broad categories (for example "regular specialist care" or "needs a pre-existing condition covered"), never diagnoses or records | Take healthcare access and insurance into account in your country match | Explicit consent (Art. 9(2)(a)), asked separately at the moment you answer; withdrawable at any time | Until you withdraw consent, remove the answer or delete the account |
| Email address, for updates about your plan and the countries you follow (not sent yet) | Optional updates when rules or figures change for your countries | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Record of your consents (what, when, policy version, hashed IP) | Demonstrating consent (Art. 7(1)) | Legal obligation / legitimate interest | As long as the account exists |
| Audience measurement (Google Analytics 4) if you accept analytics cookies | Understand which pages help, improve the site | Consent (Art. 6(1)(a)); not loaded at all without it | Google Analytics retention set to 14 months |
| Hashed IP address and email in a short-lived log of login attempts | Protect accounts against password guessing | Legitimate interest (Art. 6(1)(f)) | 24 hours |
Please do not enter other sensitive data (religion, ethnic origin, detailed medical information, etc.) in free-text fields: we don't need it.
3. What we never ask for
Accounts are for adults. We only ask for what is useful for planning: no date of birth (an age range is enough), no passport or tax number, no photo, no medical records. If you plan as a couple, enter only what your partner agrees to.
4. Who receives data
- Hosting: Hetzner Online GmbH, servers in Germany (EU), acting as our processor.
- Google (Google Ireland Ltd / Google LLC): only if you choose "Continue with Google" (we receive your name, email and an identifier), and only if you accept analytics cookies (Google Analytics). Transfers to the US rely on the EU-US Data Privacy Framework and standard contractual clauses.
- Email delivery provider (when emails start: Brevo, Sendinblue SAS, France, EU data hosting), to send confirmation and password reset emails, bound by a data processing agreement. This policy will be updated before any email is sent.
We never sell or rent personal data and never share it with partners, agents or advertisers. When you follow a link to a partner (for example an insurer), nothing about you is passed on by us.
5. Estimates, not decisions
Our tools give estimates based on public data (costs, visa thresholds, tax rules). They involve no automated decision with legal or similarly significant effects on you. Visas, residence permits, taxes and insurance are decided only by the authorities and providers concerned.
6. Your rights
You can at any time: access your data and receive it in a portable format (download it from "My plan"), correct it, delete it (delete your account from "My plan"), restrict or object to processing, and withdraw any consent (without affecting processing before withdrawal). Write to contact@retireacross.com. We answer within one month. You can also lodge a complaint with the data protection authority of your EU country of residence.
7. Security
Encrypted connections (HTTPS), passwords hashed with Argon2id, protection against cross-site request forgery, rate limiting of login attempts, data stored in a dedicated database on servers in the EU, and least-privilege access.
8. Cookies
See our cookie policy. You can change your choice at any time via "Cookie settings" at the bottom of each page.
9. Changes
We will update this policy when our processing changes, change its version number, and, for important changes, inform account holders by email or when they log in.