Transita
Open your workspace

Privacy Policy

Last updated: August 2026

1. Data Controller

Transita is operated by Okapi Works, a company registered in Belgium, European Union. As the data controller, Okapi Works determines how and why your personal data is processed. For any privacy-related questions, please contact us at privacy@transita.app.

2. What Data We Collect

We collect only what is necessary to provide the service. Here is a precise breakdown:

  • Email address. Collected only if you voluntarily submit it via our email sign-up form (for example, to receive your personalised immigration roadmap). This is optional. We never require an email to use the quiz.
  • Quiz answers. The answers you provide during the immigration quiz are stored locally in your browser using localStorage. They are never sent to our servers unless you explicitly submit a result or sign up for a roadmap.
  • Approximate location (IP-based). When you first visit the quiz, we use your IP address to auto-detect your current country in order to pre-fill that field for your convenience. This lookup is performed via ipapi.co. We receive only a country code and discard it immediately after use. We do not store your IP address.
  • Documents you upload. If you sign in and use the document vault, the files you upload are stored for you. These are the documents a visa application asks for, so they routinely include passport scans, police certificates and proof of funds. Uploading is entirely optional and nothing is stored until you choose to upload it.

Outside the document vault we do not collect names, passport details, financial information, or any sensitive personal data categories as defined under GDPR Article 9. Uploaded documents are never shared with third parties, never served from a public URL, and every download goes through an authenticated request.

3. Why We Collect It (Legal Basis)

  • Email address. Collected on the basis of your consent (GDPR Art. 6(1)(a)). You can withdraw consent at any time by clicking "unsubscribe" in any email we send.
  • Quiz answers. Processed on the basis of contract performance (GDPR Art. 6(1)(b)) to generate your AI-matched immigration pathway results.
  • IP-based location. Processed on the basis of our legitimate interest (GDPR Art. 6(1)(f)) to improve usability by pre-filling your current country. This data is not retained.

4. How Long We Keep Your Data

  • Email addresses are kept until you unsubscribe or request deletion. We do not retain emails longer than necessary.
  • Quiz data stays in your browser (localStorage) and is never stored on our servers unless you explicitly request a roadmap. You can clear it at any time by clearing your browser storage.
  • IP-based location data is not stored at all. It is used in real-time to determine a country code and then discarded.
  • Documents attached to a pathway you stopped tracking are deleted 30 days later, but only if that pathway had nothing else on it: no filing date, no residency start date, no checked-off task and no requirement you marked as met. A route you actually worked on keeps its documents for as long as you keep the account, however long ago you stopped tracking it. The 30 days are there so an accidental removal is recoverable.
  • When you delete your account, your files are removed from storage first and your records only follow once every file is gone, so a deletion can never leave a document behind without the record that points at it. Two things survive, both because accounting law requires them: your payment records, which live with Stripe rather than with us, and creator payout records if you are an affiliate.
  • A one-way fingerprint of your email address is kept after deletion, and only that. Deleting the rows is not enough on its own, because a mailing job that was already running can put your address straight back. The fingerprint lets us recognise an address we are no longer allowed to store and refuse to re-add it. It cannot be turned back into your address.

5. Your GDPR Rights

If you are located in the European Union, you have the following rights regarding your personal data:

  • Right of access. You may request a copy of the personal data we hold about you.
  • Right to rectification. You may ask us to correct inaccurate data.
  • Right to erasure. You may ask us to delete your data ("right to be forgotten").
  • Right to object. You may object to certain types of processing.
  • Right to data portability. You may request your data in a machine-readable format.

To exercise any of these rights, contact us at privacy@transita.app. We will respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA, Gegevensbeschermingsautoriteit) at dataprotectionauthority.be.

6. Third-Party Services

We use a small number of third-party services to operate Transita:

  • Vercel Web Analytics (cookieless audience measurement). Counts page views and traffic sources without cookies and without a persistent identifier. Runs for all visitors on the basis of legitimate interest (see section 7).
  • PostHog (product analytics). Runs for all visitors, cookieless, until you accept. Before you decide, and if you decline, it records which pages were viewed and clicked while storing nothing on your device and recognising nobody, not even on a later visit, on the basis of legitimate interest, see section 7. Accepting adds cookies and a persistent identifier so we can see how one session moved through the product; declining afterwards erases what was stored and returns it to the cookieless measurement. See PostHog's Privacy Policy.
  • Meta (advertising measurement). Only loaded if you accept cookies. The Meta pixel and Conversions API report conversions so we can tell which ads work. Meta acts as an independent controller for this data. See Meta's Privacy Policy.
  • Vercel (hosting and infrastructure). Our application is hosted on Vercel. Vercel acts as a data processor under GDPR and processes data in accordance with EU data protection requirements. See Vercel's Privacy Policy.
  • OpenAI (AI matching). When you submit your quiz, anonymised quiz answers (with no personally identifying information) are sent to OpenAI's API for processing. We do not transmit your email or any identifying details to OpenAI. See OpenAI's Privacy Policy.
  • ipapi.co (IP geolocation). Used to detect your approximate country on the quiz's first step. No personal data beyond your IP address is transmitted, and we do not store the result. See ipapi.co's Privacy Policy.

7. Cookies and Local Storage

We do not use Google Analytics. What we do use falls into three groups, and the difference between them is what is stored on your device.

Stored on your device without asking (strictly necessary)

We use localStorage (a browser-side storage mechanism) for two purposes:

  • To save your quiz progress as you move through the steps, so you do not lose your answers if you accidentally navigate away.
  • To remember your answer to the cookie notice, so we do not ask again. We have to remember a refusal in order to honour it.

localStorage data never leaves your device unless you explicitly submit the quiz. You can clear it at any time via your browser's settings.

Measurement that stores nothing on your device

We count how many people reach each step (landing page, quiz started, quiz finished, results seen), so we know which parts of the site are broken or ignored. This runs whether or not you accept cookies, because it sets nothing on your device and reads nothing from it.

It records the step reached, the page path, and a run identifier that is created in memory and destroyed when you close the tab. We do not store your IP address or browser user-agent against these records; your IP is used momentarily to rate-limit abuse and is not written down. Nothing in it identifies you, and it cannot be linked back to you across visits. The same applies to Vercel Web Analytics, which is cookieless and derives an anonymous visitor hash that changes daily.

Legal basis: legitimate interest (Art. 6(1)(f)) in understanding whether our own service works. Because no information is stored on or read from your device, this does not require consent under the ePrivacy Directive.

Only if you accept (cookies and tracking)

These set cookies and a persistent identifier, so they do that only after you accept. The Meta pixel does not load at all otherwise. PostHog does keep running if you decline or ignore the notice, but cookielessly. See the cookieless list above for exactly what that means:

  • PostHog (product analytics). Accepting adds cookies and a persistent identifier so we can see how an individual session moved through the product. Without consent it still runs, but cookieless: nothing is stored on your device and you are not recognised between visits.
  • Meta pixel (advertising measurement). Sets the _fbp cookie and reports conversions to Meta so we can tell which ads work.

You can withdraw consent at any time from your profile, under "Cookies and analytics". One click puts the notice back, which is the same control that took the consent, so withdrawing really is as easy as giving it. Signed out, clearing this site's data in your browser does the same thing. Declining costs you no functionality.

8. Data Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or alteration. All data transmitted between your browser and our servers is encrypted via HTTPS (TLS). Email addresses are stored in access-controlled systems.

Where your data is stored

Your account and the records behind your workspace are stored in a PostgreSQL database run by Neon in AWS region eu-central-1, which is Frankfurt, Germany. Files you upload to your document vault are stored by Bunny.net in Falkenstein, Germany. Neither store is replicated to any other region, so data you save with us is held in Germany, and therefore inside the EU.

That covers storage. The services in section 6 process data as it passes through them, each under its own terms, and a service we add there in future would be listed there rather than here.

9. Children

Transita is not intended for use by persons under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us at privacy@transita.app and we will delete it promptly.

10. Updates to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. The current version is always available at transita.app/privacy.

11. Contact

For any questions about this Privacy Policy or your personal data, please contact us at privacy@transita.app.