Migrantsbook ("we", "us", "our") is a free community platform designed to connect and support members of the Myanmar migrant community in Thailand and nearby countries. You can use the platform as a worker, employer, recruitment company, Myanmar employment agency, government official, news reporter, advertising agent, or NGO partner.

This policy explains what information we collect, why we collect it, and how we handle it. If you have any questions, you can contact us any time at privacy@migrantsbook.com.

We comply with data protection laws in Myanmar, Thailand, and any country where our users live — including the EU's GDPR, California's CCPA, Japan's APPI, the UAE's PDPL, Saudi Arabia's PDPL, and Thailand's PDPA.

We use your information exclusively to operate and enhance the platform:

• Job matching — showing worker profiles to employers (only after you apply or opt in) and job listings to workers
• Delivering chat messages and notifications
• Welfare support — sending your violation reports to government officials who can help
• Disaster alerts — notifying you about emergencies near you
• Verification — checking employer, recruiter, and agency documents before they can use the platform
• Preventing abuse, moderating reported content, and ensuring community safety
• Analyzing usage patterns to improve the platform

We do not show third-party advertising, and we do not sell your personal information to anyone.

Some optional features on the platform require payment — such as profile boosts, featured job listings, recruiter subscriptions, and verification fees. All payments are processed securely through our payment provider (Stripe).

We do not store your card numbers, bank details, or wallet credentials on our servers. Payment processing is handled entirely by the payment provider under their own security and privacy standards.

We use trusted third-party services to host and operate our platform. These providers process data on our behalf and are contractually prohibited from using your data for their own purposes:

• Base44 — database, authentication, file storage, and hosting (your account, content, and documents live here)
• Google — optional Google Sign-In, Sheets integration, and Calendar sync
• Stripe — payment processing for paid features
• Firebase Cloud Messaging (Google) — delivery of push notifications on mobile apps
• Twilio / Infobip — SMS and OTP verification

None of them are permitted to use your data for their own advertising.

Every user has a role, and each role can only see what it needs:

• Employers can see your worker profile and application — but only after you apply to their job, or if you turn on "work independently" in your settings
• Recruitment companies can see profiles of workers linked to them, to help with job placement
• Myanmar employment agencies can see profiles of workers linked to them, to manage deployment records
• Government officials can see welfare reports and aggregated statistics (no individual names unless a report involves you)
• Admins and moderators can see submitted content and registration documents — only to review and approve them

Your chat messages are visible only to the people in the conversation, and to our moderation team if a conversation is reported. We disclose information outside the platform only when the law requires it.

We collect your approximate location (region or city) to send you natural disaster alerts. You have two options:

• Enter your location manually in your profile, or
• Allow your device to share your location

You can turn off location at any time in your settings — but you will no longer receive region-specific alerts. We do not store your precise GPS after an alert is delivered.

We take data security seriously. Your information is encrypted during transmission and while at rest. Identity documents (passports, visas, work permits) are encrypted with AES-256 and stored separately. Access to production data is strictly limited to the core team operating the platform.

• Encrypted storage for personal documents
• Role-based access logs so we can track who viewed what
• Secure API endpoints and regular security reviews

No system is perfectly secure. Please use a strong password and log out after each session, especially on shared phones.

We retain your data as long as your account remains active. Here is how long we keep different types of data:

• Worker profiles and documents — until you delete your account, or after 2 years of inactivity
• Recruiter and agency license documents — until account deletion, or 5 years for regulatory audit
• Job applications — 1 year after the job closes
• Welfare violation reports — 5 years (legal requirement)
• Disaster alert logs — 1 year
• Usage analytics — anonymized after 6 months

You may delete your individual listings and posts at any time. If you request account deletion — from your profile settings or by emailing us — we will delete your account and associated personal data within 30 days. Residual copies in encrypted backups are permanently purged within 90 days, subject to legal retention requirements.

You have control over your information. Depending on where you live, you have the right to:

• Access — see what personal data we hold about you
• Correct — fix inaccurate or incomplete information
• Delete — request that we delete your data
• Restrict — limit certain processing, like location for alerts
• Object — opt out of non-essential processing
• Portability — receive your data in a machine-readable format
• Withdraw consent — take back consent you previously gave, at any time
• Complain — file a complaint with your local data protection authority

You can also edit your profile, turn notifications and location on or off, and sign out at any time. You may revoke Google Sign-In access from your Google account's security settings.

Your data may be stored on servers outside Myanmar or Thailand. When we transfer data across borders, we make sure it is protected according to the laws that apply to you — for example, the EU's Standard Contractual Clauses, Japan's PPC guidance, or Saudi Arabia's SDAIA requirements.

We do not sell or share personal information for cross-context behavioral advertising.

We may update this Privacy Policy from time to time. If we make any material changes, we will notify you by posting the updated policy on this page and noting the change within the app before it takes effect.

We encourage you to review this page periodically. Continued use after a change means you accept the updated policy.

If you have any questions, concerns, or data requests, please reach out to us: