Privacy Policy

migr8 is built on a simple privacy principle: we collect the minimum data required to run the Service and never touch your cloud credentials or source code beyond the moment of deployment.

This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. It applies to all users of migr8myapp.com.

The data controller for your personal information is migr8 (operated by Krtitva Technologies FZ LLC), based in Ras Al Khaimah, United Arab Emirates. You can reach our privacy team at pb@krtitva.com.

We collect the following categories of personal data:

If you choose to connect a GitHub repository or a GCP/Azure account to a specific project, we store the resulting access token encrypted at rest, scoped to that project only. This lets you return to a project later without reconnecting every time — a different project can use a completely different GitHub account or cloud account, and connecting one project never grants access to another.

• What we store: an encrypted OAuth token (GitHub) or refresh token (GCP/Azure), plus non-secret metadata you can see yourself — the connected account's display name, and any cloud project/subscription you selected.
• Access controls: these encrypted values are never readable through our normal application database access — only a narrow server process, used solely to mint a short-lived access token when you use the connection, can decrypt them.
• Your control: disconnect any project's connections at any time from that project's Admin page. Disconnecting deletes the stored token immediately.

The following data is never written to our database, never logged, and never leaves your browser session:

• AWS credentials, and manually-entered service account keys — AWS access keys & secret keys are always re-entered per session and never stored (we store only the non-secret access key ID as a convenience, if you ask us to remember it for a project). Manually pasted GCP service-account JSON or Azure client secrets are held in browser state only, sent directly to the relevant cloud provisioning API, and zeroed from memory after the deployment request completes.
• GitHub personal access tokens used to push output — the separate token you can paste to push a generated migration package to a new repository is used once and never stored. (This is different from connecting GitHub as a project's source repository — see "Per-Project Connections" above.)
• Source code content — We read and package your source code transiently during a migration run. We do not store or retain source code on our servers after the deployment request has been dispatched.
• Payment card numbers or banking details — Payments are processed by Stripe. We never see or store your full card number. We may store a Stripe customer ID and the last four digits for billing display purposes.

We use the data we collect to:

• Create and manage your account
• Provide the Service — running migration jobs, tracking deployment status, and surfacing results in the UI
• Send transactional emails (e.g., deployment completion notifications, account security alerts)
• Diagnose errors and improve reliability and performance of the Service
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal data. We do not use your data to train AI or machine learning models. We do not serve targeted advertising.

We share personal data only with the following categories of recipients, and only as necessary to provide the Service:

We implement industry-standard technical and organizational measures to protect your personal data, including:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted (AES-256) by Supabase
• Row-Level Security (RLS) policies ensure each user can only access their own deployment records
• Cloud credentials are never serialized to disk, logs, or the database
• Access to production systems is restricted to authorized personnel only

No security measure is 100% effective. If you discover a security vulnerability, please report it responsibly to pb@krtitva.com.

We retain personal data only as long as necessary to provide the Service or as required by law:

• Account data is retained until you request account deletion
• Deployment records are retained until you delete them or until account deletion
• Usage telemetry is retained for 90 days in aggregated form and 30 days for individual events
• After account deletion, residual backups may persist for up to 30 days before being purged

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — request that we delete your personal data (subject to legal retention obligations)
• Portability — receive your data in a machine-readable format
• Objection — object to certain processing activities
• Withdrawal of consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at pb@krtitva.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

We use a minimal set of cookies and local storage to operate the Service:

• Strictly necessary cookies — session management and authentication. These cannot be disabled without breaking the Service.
• Analytics — we may use privacy-respecting analytics (no cross-site tracking, no fingerprinting, IP anonymization). You can opt out by contacting us.

We do not use advertising cookies or cross-site tracking pixels. We do not share cookie data with advertisers.

The Service is not directed to children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us at pb@krtitva.com and we will delete it promptly.

migr8 is operated from the United Arab Emirates. If you are accessing the Service from outside the UAE, your data may be transferred to and processed in the UAE or in the regions where our service providers (Supabase, Stripe) operate.

We rely on appropriate safeguards — including our sub-processors' own transfer mechanisms — to ensure personal data receives adequate protection regardless of where it is processed.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice in the Service before the changes take effect. The "Effective date" at the top reflects the date of the most recent revision.

For questions, requests, or concerns about this Privacy Policy or our data practices, please contact: