Privacy
Effective date: 2026-10-18. This policy explains what personal data ULU People collects through this website, why, and the choices you have. You must be 18 or older to use our forms.
1. Who we are
The controller of your data is [Legal entity name, legal form, registration no.], trading as ULU People, [Registered postal address]. Privacy contact: privacy@ulupeople.com. EU/UK representative (if applicable): [name and address, or remove].
2. What we collect and why
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| The ULU Brief newsletter | Email, first name (optional), audience type, language, source page, consent record | Your consent (double opt-in). Withdraw anytime. | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. |
| Sending your custom development plan and following up | Name, work email, company, role, plan answers and generated plan | Your request (steps prior to a contract) | 12 months, or longer if we start working together |
| Sending your country guide and following up on your move | Name, email, destination, nationality (optional), reason for moving, household type and generated guide | Your request (steps prior to a contract) | 12 months, or longer if we start working together |
| Answering contact and company inquiries | Name, email, company, message | Your request / our legitimate interest in replying | 24 months after the last exchange |
| Proof of consent and opt-outs | Consent text and version, timestamp, hashed IP, browser user agent; for opt-outs a hashed email (suppression list) | Legal obligation and legitimate interest in proving compliance | Life of the consent plus 3 years. Suppression entries are kept so we never email you again. |
| Site security and anonymous statistics | Aggregated, cookieless page statistics (Vercel Web Analytics); rate-limiting by IP held in memory only | Legitimate interest | Aggregates only |
Providing data is voluntary. Without an email we cannot send the newsletter or your plan. The momentum check and plan preview work without giving us any personal data. We never make the plan or quiz result conditional on subscribing to the newsletter.
3. AI features
The development plan preview, the country guide, the ULU Brief news summaries and the chat assistant use a large language model provided by Groq, Inc. The country guide can also search the public web through Groq to cite official sources. We send only the answers you select and the optional challenge text (with emails and phone numbers stripped), never your name or email. AI output is informational, may contain errors, is labeled as AI-generated, and is not legal, immigration or tax advice. No decision with legal or similarly significant effect is made about you by automated means.
4. Who we share data with
We do not sell or rent personal data. We use these processors under data processing agreements:
- Vercel Inc. (hosting, cookieless analytics), USA
- Supabase Inc. (database) [region]
- Resend (Plus Five Five, Inc.) (email delivery), USA
- Groq, Inc. (AI inference), USA
5. International transfers
Some processors are in the United States. Transfers from the EU/UK rely on the EU-US Data Privacy Framework where the vendor is certified, and on the European Commission's Standard Contractual Clauses (and the UK Addendum) otherwise. For Brazil, transfers rely on the ANPD standard clauses or your specific consent. For Vietnam, you consent to the transfer of your data to the recipients and countries listed above when you submit a form.
6. Your rights
You can ask to access, correct, delete, restrict or port your data, object to processing and withdraw consent at any time. Every email includes a one-click unsubscribe link. Use the form below or email privacy@ulupeople.com. We reply within one month at the latest, and faster where local law requires it (Brazil 15 days, Colombia 10 to 15 business days, Mexico 20 business days).
Region-specific notes
- EU/UK: you can complain to your local data protection authority.
- Mexico: you may exercise your ARCO rights (access, rectification, cancellation, opposition) and limit the use of your data for secondary purposes such as the newsletter.
- Colombia: this policy is our Política de Tratamiento de la Información. Queries are answered in 10 business days and complaints in 15. You may complain to the SIC.
- Brazil: you may contact our data protection officer at the privacy email above and complain to the ANPD.
- Vietnam: we process your data only with your explicit consent for each purpose stated here.
- Canada: our newsletter relies on express consent you can withdraw at any time.
7. Cookies
We set one functional cookie (wbg_lang) to remember your language, and an admin session cookie only for our staff. We do not use advertising or tracking cookies, and our analytics are cookieless. If we ever add non-essential cookies, we will ask first.
8. Security
Data is encrypted in transit, access is restricted to authorized staff, IP addresses in consent records are hashed, and forms are rate-limited against abuse.
9. Changes
We will post updates here with a new effective date and, for material changes, notify subscribers by email.