Skip to content

Privacy

What we collect, and what we never do with it.

Last updated: August 17, 2026

Who is responsible for your data

The controller of your personal data is NGO “Pamiat Maibutnoho” (ГО «Пам'ять майбутнього»), registered in Ukraine (ЄДРПОУ 40750930). You can reach us at hello@ukrainianhomecoming.com — the same address that answers your enquiry, read by the founder. Ukraine sits outside the European Economic Area, but because we deliberately offer our services to people living in the EU and the UK, we handle your data under the GDPR and the UK GDPR as well as Ukrainian data protection law. If you are in Canada, PIPEDA applies too, and nothing below falls short of it.

What we collect

What you send us: your name, email, country, and whatever you choose to tell us about your family — names, places, dates, documents. Research necessarily involves personal information about your relatives, living and deceased. We collect nothing behind your back: no advertising cookies, no cross-site tracking, no data bought from anyone else.

The legal grounds we rely on

Answering your enquiry and carrying out work you commission is performance of a contract, or steps taken at your request before one (Article 6(1)(b)). Ancestry research unavoidably touches ethnic origin, and church registers record religion — special categories under Article 9, which we process only on the explicit consent you give by ticking the box on the enquiry form. Keeping invoices is a legal obligation (Article 6(1)(c)). Cookieless visitor counts and the hidden anti-spam field in our form rest on our legitimate interest in a site that works and an inbox that is not drowned (Article 6(1)(f)). You can withdraw consent whenever you like by writing to us; that does not make what we did beforehand unlawful, but it stops the research.

The relatives in your family tree

Research is mostly about people other than you. The GDPR does not cover the dead, so most of what we find in an archive falls outside it — but living relatives we trace are covered, and they never asked to be found. So: we keep no more about them than your case genuinely needs, we do not hand you a living person's contact details before speaking to them, and when we make contact we say plainly who we are and who is looking for them. If a living relative asks us to erase what we hold about them, we do — even in the middle of a case, and we tell you why the trail stopped.

Where your data actually sits

By name, in the order your enquiry travels:

  • Vercel Inc.hosting this website (USA)
  • Anthropic PBCreading what you type into one of the free tools; nothing is kept at either end (USA)
  • Resend (Plus Five Five, Inc.)delivering the enquiry — or a tool result you asked us to send you — as an email (USA)
  • Cloudflare, Inc.holding the domain's mail records and forwarding what is sent to us (USA)
  • Google LLC (Gmail)the inbox that receives it (USA)
  • Meta Platforms Ireland Ltd.only if you write to us on WhatsApp (EU / USA)

So yes — your enquiry leaves the European Economic Area. Those transfers run on the European Commission's Standard Contractual Clauses, which each of these providers has signed, under data processing agreements we hold with them. Research files and correspondence about your case are kept by us in Ukraine, which has no EU adequacy decision, so the same clauses cover that too. Beyond these, only the subcontractors a particular case truly needs — an archive researcher, a driver, an insurer — each bound to confidentiality in writing. We never sell, rent or trade your data, and no advertising network receives any of it.

If you ask for the checklist or the guides

Asking us to email you the seven-documents checklist puts your address on a short list we use for that email and, a few times a year, a new guide. The legal ground is your consent (Article 6(1)(a)), given by sending that form; the notification email recording it is how we can show it was given. There is no profiling, no advertising network and no third party with access to the list. Reply to any of those emails with one word and you are off it — we delete the address within a month. The guide box under a tool result is the other way onto that same list: same consent, same record, same one word to leave.

How long we keep it

An enquiry that never becomes a commission: twelve months, then deleted — long enough that you can come back to us without starting from scratch. A completed case: three years after the final report, so we can still answer questions about our own work, unless you ask us to delete it sooner. Invoices and payment records: as long as Ukrainian tax law requires. The record of your consent: as long as we rely on that consent, plus three years, because we have to be able to show it was given.

Your story stays yours

We publish nothing about your family — no film, no photograph, no name — without your separate written consent. Declining changes nothing about the service you receive, and we never make a discount conditional on letting us use your story.

Analytics and cookies

There is no cookie banner on this site because there is nothing to consent to. We set no advertising cookies and run no cross-site tracking. Visitor counts come from Vercel Analytics, which is cookieless and builds no profile of you. If you arrive from one of our search ads, the name of that ad is kept in your browser tab until you close it, so that an enquiry tells us which ad brought it; it is not a cookie and goes nowhere else. If you reach us on WhatsApp instead, that conversation lives on Meta's infrastructure under Meta's terms, not ours — email us if you would rather it did not.

Your rights

Wherever you live, we apply these. You can ask us to:

  • show you a copy of everything we hold about you (Article 15)
  • correct anything that is wrong (Article 16)
  • delete it (Article 17)
  • restrict what we do with it while a question is unresolved (Article 18)
  • hand it over in a portable, machine-readable file (Article 20)
  • stop processing that rests on our legitimate interest (Article 21)
  • withdraw your consent, at any time, without giving a reason (Article 7(3))

Write to hello@ukrainianhomecoming.com and we answer within thirty days, free of charge. If we get it wrong, you can complain to the data protection authority where you live: your national supervisory authority in the EU, the ICO in the United Kingdom, the Office of the Privacy Commissioner in Canada, or the Verkhovna Rada Commissioner for Human Rights in Ukraine. We would much rather you told us first.

When this policy changes

If we change how we handle your data, this page changes with it and the date at the top changes too. If the change is significant and you have an open case with us, we write to you rather than leaving you to notice.