UK GDPR Privacy Notice
Last updated: October 2026 • Compliant with UK GDPR, Data Protection Act 2018 & PECR
This Privacy Notice explains how Migraflow Platform (“Migraflow”, “we”, “us”, or “our”) processes and protects your personal data when you visit our website, register an account, or deploy our database migration agents.
01. Data Controller Information
The data controller responsible for personal data processed through Migraflow is:
02. Local Architecture & Zero-Cloud Data Principle
Migraflow operates an agent-centric architecture. When you execute an ETL database migration, the migration engine runs locally inside a Docker container within your private infrastructure. Customer database rows, credentials, and sensitive payload data stream directly between your source and target databases through DuckDB/Polars streaming. They are never transmitted to, stored in, or processed by Migraflow central cloud servers.
03. What Personal Data We Collect & Why
| Category | Data Fields | Lawful Basis (UK GDPR) |
|---|---|---|
| Account & Auth | Full Name, Email Address, Bcrypt Hashed Password, Google OAuth Subject ID | Art. 6(1)(b) Contract |
| Agent Metadata | Agent Name, OS/Architecture, Heartbeat timestamps, Schema metadata snapshots (table/column names only) | Art. 6(1)(b) Contract |
| Migration Plans | Plan titles, transformation expressions, execution job status, row counts | Art. 6(1)(b) Contract |
| Security & Logs | Audit logs, masked email traces, IP addresses, rate-limiting tokens | Art. 6(1)(f) Legitimate Interest |
| 3D Visuals & Analytics | Interactive Spline 3D canvas assets, optional UI responsiveness telemetry | Art. 6(1)(a) Consent (PECR) |
04. Third-Party Sub-Processors & AI Minimization
We integrate with trusted third-party providers under strict data processing agreements:
- Google OAuth & Gmail SMTP: Used for optional Google Single Sign-On and transactional security emails (such as 5-minute expiring password reset links).
- AI Diagnosis Providers (Google Gemini / OpenAI): When an execution error occurs and AI diagnosis is triggered, our built-in CredentialSanitizer strips all database connection URIs, passwords, private keys, constraint values, and email addresses prior to prompt synthesis.
- Spline CDN: Delivers 3D visual assets on the landing page only after you provide affirmative consent in our Cookie Consent Banner.
05. Storage Limitation & Data Retention
In compliance with UK GDPR Article 5(1)(e), we enforce strict retention schedules:
- User Account Data: Retained while your account is active. Deleted immediately upon self-service account deletion.
- Temporary Local Staging (DuckDB): Cleaned up automatically upon job completion, failure, or cancellation.
- Access & Refresh Tokens: Access tokens expire after 15 minutes; refresh tokens rotate and expire after 7 days.
- Password Reset Tokens: Expire after 5 minutes in Redis and are deleted immediately upon single use.
06. Your Data Subject Rights
Under Chapter III of the UK GDPR, you have comprehensive rights regarding your personal data:
07. Lodging a Complaint with the ICO
If you have concerns about our processing of your personal data, we invite you to contact our Data Protection Office at privacy@migraflow.io.
You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 • Website: ico.org.uk