Privacy Notice (GDPR)

Passimi cares about your privacy. This notice explains what personal data we process, why, on what legal basis, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR). It applies to everyone who uses the app.

Data Controller

Mi Trading Co. Ltd.
Privacy and data protection requests: legal@passimi.com
General support: support@passimi.com

We have not appointed a separate Data Protection Officer; you can send all requests directly to the address above.

Data We Process

Account data
• Email address
• Password (stored only as an irreversible hash; we never store your actual password)
• If you sign in with Apple or Google: the user identifier and email address that provider sends us

Document data
• Passport: country code, document type, issue and expiry dates
• Visa: country code, visa type, validity dates
• Residence permit: country code, permit type, validity dates
• Visa applications: country code, application status and dates

Travel data
• Entry and exit dates with country codes
• Records used for Schengen 90/180 calculations

Technical data
• Notification identifier (if you enable notifications)
• App language and theme preference
• Consent record: the version, date and language of the legal terms you accepted
• Server logs: your IP address, request time and basic device or client information, recorded automatically by our hosting provider for security monitoring, abuse prevention and troubleshooting

Data We Do Not Collect

• First or last name
• Passport, ID or document numbers
• Phone number
• Biometric data (Face ID / Touch ID verification happens entirely on your device; that data is never sent to us)
• Photos or scans of documents
• Raw GPS coordinates
• Card, bank or payment details
• Advertising identifiers or behavioural tracking data

Where Your Data Comes From

Most of the data we hold comes directly from you, as you enter it in the app.

If you choose to sign in with Apple or Google, we receive a limited set of data from that provider rather than from you: a unique user identifier and, unless you hide it, your email address. We do not receive your name, profile photo, contacts or any other information from these providers. If you use Apple's "Hide My Email" feature, we only ever see the relay address Apple generates, not your real email address.

Purposes and Legal Bases

The GDPR Article 6 basis we rely on for each activity:

1) Creating your account and keeping you signed in
Basis: Performance of a contract (Art. 6(1)(b))

2) Storing your document and travel records and calculating Schengen 90/180 days
Basis: Performance of a contract (Art. 6(1)(b))

3) Reminding you before a document expires
Basis: Performance of a contract (Art. 6(1)(b))

4) Detecting which country you are in via Travel Mode
Basis: Consent (Art. 6(1)(a)) — you can withdraw this at any time

5) Sending important announcements (for example, a visa rule change that affects you)
Basis: Consent (Art. 6(1)(a)) — you can withdraw this by turning notifications off

6) Keeping a record of the legal terms you accepted
Basis: Legal obligation (Art. 6(1)(c)) — Art. 7(1) requires us to be able to demonstrate consent

7) Keeping the service secure and preventing abuse
Basis: Legitimate interests (Art. 6(1)(f)) — our interest in protecting the service and its users against unauthorised access and misuse

Providing your account and document data is a contractual requirement: without it we cannot deliver the core features of the app. Location and notification data are entirely optional, and the app works without them.

Location — Travel Mode

Turning on Travel Mode is entirely optional. When you do, the app uses your device location to work out which country you are in.

• The country is determined on your device
• Only the country code and the date are sent to our servers
• Raw GPS coordinates are never stored or transmitted
• You can turn it off at any time in the app or in your device settings

Notifications

Enabling notifications is optional. When you do, we store a notification identifier (push token) for your device.

• This identifier does not directly identify you; it is a technical address for your device
• It is used only for document expiry reminders and important announcements relevant to you
• It is never used for advertising or marketing
• You can turn notifications off at any time in your device settings, which invalidates the identifier

Service Providers

We work with the following providers to deliver the service. A data processing agreement under GDPR Art. 28 is in place with each of them.

• Supabase — database, authentication and server infrastructure (data stored in Frankfurt, Germany)
• Brevo — account verification and password reset emails (EU)
• Expo — push notification delivery service (USA)
• Apple — push delivery (APNs) and Sign in with Apple (USA)
• Google — Sign in with Google (USA)

We do not transfer, sell or share your data with any other third party, and never for marketing purposes.

International Data Transfers

Your account, document and travel data is stored within the European Union (Frankfurt, Germany).

Some features do, however, require limited transfers outside the EU:

• Notification delivery: your notification identifier and the message text are routed to your device via Expo (USA) and Apple APNs (USA)
• Sign in with Apple or Google: authentication takes place on that provider's servers (USA)

These transfers are made on the basis of Standard Contractual Clauses under GDPR Art. 46 together with the data protection commitments of the providers concerned. You can avoid these transfers by choosing not to use the features in question.

Retention

• Account, document and travel data: kept for as long as your account is active
• When you delete your account: all of your personal data — including documents, travel records, notification identifier and consent records — is erased immediately from our active databases and is no longer accessible
• Encrypted backups: residual copies may persist in our infrastructure provider's encrypted backups for up to 30 days, after which the ordinary backup cycle overwrites them permanently
• Server logs: retained by our hosting provider for no longer than 30 days, solely for security monitoring, abuse prevention and troubleshooting
• Notification identifier: invalidated when you turn notifications off or when device access ends

Account deletion cannot be undone. If you want to keep your records, export them before you delete.

Security

• All data in transit is encrypted with TLS
• Data is stored encrypted on our servers
• Row-level security ensures each user can only access their own data
• Passwords are stored only as irreversible hashes
• Access to the app can be protected with an optional PIN and biometric unlock

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by GDPR Art. 33 and 34.

Your Rights

Under the GDPR you have the right to:

• Access (Art. 15) — find out what data we hold about you
• Rectification (Art. 16) — have inaccurate or incomplete data corrected
• Erasure (Art. 17) — have your data deleted; you can do this directly by deleting your account in the app
• Restriction of processing (Art. 18)
• Data portability (Art. 20) — receive your data in a structured, machine-readable format
• Object (Art. 21) — object to processing based on legitimate interests
• Withdraw consent (Art. 7(3)) — withdraw your location or notification consent at any time; this does not affect the lawfulness of processing before withdrawal

To exercise any of these rights: legal@passimi.com
We respond to requests within 30 days.

Right to Complain

If you believe our processing infringes the GDPR, you have the right to lodge a complaint with the data protection authority in your country (GDPR Art. 77). A list of EU supervisory authorities is available at edpb.europa.eu.

Automated Decision-Making

Passimi does not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (GDPR Art. 22). The calculations in the app are informational tools based solely on the data you enter.

Children

Passimi is not intended for users under 16 and we do not knowingly collect data from this age group. If we become aware that we hold data belonging to a user under 16, we will delete that account and its data. If you believe this is the case, please contact legal@passimi.com.

Cookies and Tracking

The Passimi mobile app does not use cookies, tracking pixels, advertising identifiers or third-party behavioural analytics. We do not track your activity across other apps or websites, and we do not build advertising profiles. Our hosting and notification providers process only the technical data described above, for operational purposes.

Changes to This Notice

We may update this notice from time to time. For significant changes we will ask you to review and accept the updated terms the next time you open the app, and we will email you at your registered address. The current version and date appear at the top of this page. We keep a dated record of previous versions.

Terms of Use

Eligibility

You must be at least 16 years old to create an account and use Passimi. By using the app you confirm that you meet this requirement and that the information you provide is accurate.

The Service

Passimi is a mobile app for tracking passports, visas and residence permits, calculating Schengen 90/180 days, logging travel and reminding you before documents expire. The app is currently free of charge. If paid features are introduced in future, they will be clearly identified, and existing free functionality will continue to be governed by these terms.

Pre-Release Software

Passimi is currently offered in a beta stage for testing purposes. It is still under active development: it may contain errors, behave unexpectedly, lose data without warning, or change significantly between versions. Features may be modified or removed.

During the beta stage, calculations and reminders are more likely to be inaccurate than in a finished product. Treat the app as a convenience tool only, keep your own independent records, and verify anything that matters with official sources before you act on it.

Important Disclaimer — Please Read Carefully

Passimi is an informational and tracking tool. It is not legal advice, immigration advice, or an official source of information. Nothing in the app is binding on any authority.

NO GOVERNMENT AFFILIATION
Passimi is a privately developed tool by Mi Trading Co. Ltd. We are independent and are not affiliated with, endorsed by, certified by or partnered with any government, immigration authority, consulate, border agency or the European Union. Showing a screen from the app to a border official or a case officer carries no legal weight.

DAY COUNTS AND COUNTERS
The Schengen 90/180 counter, residence permit day counters and residency or citizenship goal counters may produce incorrect results. Reasons include:
• Location detection identifying the wrong country, working late, or not working at all
• Location permission being off, battery saving, or background activity restrictions
• Time zone differences and border crossings around midnight
• Errors or omissions in dates you enter manually
• Transit stops, same-day entries and exits, or partial days being counted differently from one country to another

RESIDENCY AND CITIZENSHIP GOALS
Goal tracking in the app is a personal note-keeping tool based only on the data you enter. Authorities rely on their own records when assessing residence and citizenship applications, and those records may differ from the app's figures. A counter showing that you have reached a target does not mean an application will be approved.

VISA AND TRAVEL INFORMATION
Visa and visa-free information in the app may be incomplete, out of date or simply wrong. Visa rules depend not only on your nationality but also on your age, passport type, purpose of travel, length of stay, dual nationality, previous visa refusals, vaccination and health requirements, and exceptions in bilateral agreements. The app may not reflect all of these conditions.

For example, a country may grant a visa exemption only to a particular age group or only to certain passport types; the app may not show that distinction, or may show it incorrectly.

REMINDERS AND NOTIFICATIONS ARE NOT GUARANTEED
Expiry reminders and other notifications may be delayed or may never arrive. This can happen if your device is off or offline, if notification permission is revoked, because of operating system battery or background restrictions, or because of failures at the notification delivery services we depend on. Do not rely on the app as your only reminder for a document deadline.

DATA LOSS
While we take care to protect your data, we cannot guarantee that it will always be available or free of errors. Data may be lost through technical failure, sync problems, account deletion or device loss. Keep your own independent records of travel dates and document details, particularly where you may need them as evidence in an official application.

ALWAYS VERIFY WITH OFFICIAL SOURCES BEFORE YOU TRAVEL
Before travelling, always confirm the rules that apply to your specific situation with official sources for your destination — the consulate or embassy, the immigration authority, the ministry of foreign affairs, or border officials. Relying on the app does not relieve you of this responsibility.

LIMITATION OF LIABILITY
Mi Trading Co. Ltd. is not liable for any loss arising from decisions made in reliance on information, calculations or reminders in the app. This includes, without limitation: overstaying in the Schengen area or elsewhere, refusal of entry at a border, denied boarding, visa refusal, refusal of a residence permit or citizenship application, deportation, entry bans, fines, and any financial loss resulting from these.

The app is provided "as is" and "as available", without warranty of any kind as to accuracy, timeliness or completeness. To the fullest extent permitted by applicable law, we exclude liability for indirect, incidental and consequential loss.

Nothing in these terms limits or excludes liability that cannot be limited or excluded by law. This includes liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, and for damage caused by our gross negligence or intentional misconduct.

Your Responsibilities

• Enter accurate and up-to-date information
• Keep your password and device PIN secure
• Use the app in accordance with applicable law
• Do not share your account with anyone else
• Do not attempt to disrupt, reverse engineer or gain unauthorised access to the service

Intellectual Property

The Passimi app, its name, logo, design, source code and the compiled visa and travel datasets are the property of Mi Trading Co. Ltd. and are protected by intellectual property law. You may use the app for your own personal purposes. You may not copy, redistribute, sell or create derivative works from any part of it without our written permission. The data you enter remains yours.

Suspension and Termination

We may suspend or close an account that breaches these terms, is used unlawfully, or threatens the security of the service. Where possible we will tell you why. You can stop using the service and delete your account at any time. We may also discontinue the service or any feature; if we discontinue the service entirely, we will give reasonable advance notice so you can export your data.

Account Deletion

You can permanently delete your account and all of your data from the Settings menu. This action cannot be undone and takes effect immediately.

Governing Law

These terms are governed by the laws of the Republic of Korea, where Mi Trading Co. Ltd. is established. If you are a consumer resident in the European Union, this choice of law does not deprive you of the protection of the mandatory consumer protection rules of your country of residence, and you may bring proceedings in the courts of that country.

We are not obliged and are not willing to take part in dispute resolution proceedings before a consumer arbitration board. If you are an EU consumer and wish to use an out-of-court dispute resolution body, the European Commission publishes a list of accredited bodies at consumer-redress.ec.europa.eu, and the European Consumer Centres Network (ECC-Net) can assist with cross-border consumer disputes.

Language of These Terms

These terms and the privacy notice are written in English. Translations into other languages are provided for your convenience. If there is any inconsistency between a translation and the English text, the English text prevails, except where mandatory law in your country of residence requires otherwise. If anything in a translated version is unclear to you, please contact legal@passimi.com before accepting.

Severability

If any provision of these terms is found to be invalid or unenforceable, the remaining provisions continue in full force and effect, and the invalid provision will be applied to the extent it is enforceable.

Changes to These Terms

We may update these terms from time to time. For significant changes we will ask you to review and accept them in the app. If you do not accept the changes, you can stop using the service and delete your account.