1. Who is responsible for your data?
The data controller for My Spanish Advisor is 123 Konsulent, Calle Pintor Sobejano 70, 30710 Los Alcázares, Spain, NIF ESY6488390N (“we”, “us” or “My Spanish Advisor”).
For privacy questions or to exercise your rights, use our . Please do not email copies of passports, TIE cards or other sensitive documents unless we ask for a secure method.
2. What information do we collect?
- Account details: name, email address, encrypted sign-in credentials, account identifiers and records showing which version of our terms and privacy information you accepted.
- Your Spain profile: nationality, EU status, current country, destination region, intended arrival date and preferred language.
- Roadmap and portal information: steps, completion status, appointments, dates, locations, references and notes you choose to save.
- Documents: files you upload, filenames, file type and size, your requested task, and any explanation, translation, draft reply or form guidance created for you.
- Advisor questions: questions you submit, generated answers and official source links. Your profile is included only when you actively choose personalisation for that answer.
- Support and technical information: messages you send us, security and audit records, IP address, device/browser information and essential cookie or session data needed to operate and protect the service.
Please upload only what is necessary. Documents can contain sensitive information about you or other people. Remove unnecessary pages or details where practical.
3. Why do we use it?
We do not sell your personal data. We do not use uploaded documents to advertise to you, and we do not make decisions that have legal or similarly significant effects on you solely by automated means.
4. How AI features use information
When you ask the Advisor a question, the question is sent to our AI service provider to create an answer. If you actively choose personalisation, a limited set of relevant profile and roadmap facts is included. The interface tells you what will be shared before you choose.
Our Advisor request is configured not to store the generated API response with the AI provider. We do not use your account content to train our own AI model. AI providers may still temporarily process data for security and abuse prevention under their applicable service terms.
Document analysis may require sending the uploaded content to an AI or document-processing provider once that feature is active. We will show a clear notice before such processing. Your original file remains private to your account and is never sent to a Spanish authority by My Spanish Advisor.
5. Who receives your data?
We use carefully selected service providers acting on our instructions, including:
- Supabase for authentication, database and private file storage.
- Vercel for website hosting, delivery, security and technical logs.
- OpenAI for Advisor or document-assistance features when you use them.
- Email and support providers when you contact us or receive an essential account message.
We may also disclose information when required by law, to protect users or the service, or in connection with a properly managed business transfer. We do not submit documents, forms, applications or replies to public authorities on your behalf unless a future, separate service expressly says so and you approve it.
6. International transfers
Some providers may process information outside Spain or the European Economic Area. Where required, we use a lawful transfer mechanism such as an adequacy decision or approved Standard Contractual Clauses, together with suitable technical and organisational safeguards. You may contact us for more information about the safeguards relevant to your data.
7. How long do we keep it?
- Your account, profile, roadmap, appointments and uploaded documents are kept while your account is active, until you delete individual content or your account.
- Consent and security records are kept as needed to demonstrate choices, protect the service and meet legal obligations.
- Support correspondence and technical logs are kept only as long as reasonably needed to resolve the issue, maintain security and handle legal claims.
- If paid services are introduced, legally required invoice and accounting records may need to be retained after account deletion.
When you use “Delete account and data”, the account and member-owned information are deleted from the active system. Limited encrypted backups and provider security logs may remain for their normal protected backup or legal-retention cycle before being overwritten or anonymised.
8. Your rights
Depending on the circumstances, you may ask us to:
- give you access to your personal data;
- correct inaccurate or incomplete data;
- delete data;
- restrict or object to particular processing;
- provide portable data you supplied to us; and
- withdraw consent at any time, without affecting earlier lawful processing.
Use our . We may ask for information needed to verify that the request belongs to you. We normally respond within one month, subject to the extensions allowed by law.
You may also complain to the Spanish Data Protection Agency (AEPD) ↗, although we would appreciate the chance to resolve the matter first.
9. Account deletion and security
You can delete your account from Portal → My Account → Delete account and data. This removes your sign-in, profile, roadmap, appointments, uploaded documents and document requests from the active service. You may also contact support if you cannot sign in.
We use access controls, private storage, encrypted connections and row-level permissions intended to keep each member’s information separate. No internet service is completely risk-free. Use a unique password, protect your email account and tell us promptly if you suspect unauthorised access.
10. Cookies and similar storage
We currently use only cookies or browser storage necessary for sign-in, account security and core site functions. These essential technologies do not require marketing consent. If we later introduce optional analytics or advertising technologies, we will update this policy and request consent where required before activating them.
11. Children and changes
The member service is intended for adults aged 18 or over. Do not create an account for a child or upload a child’s information unless you have lawful authority and it is genuinely necessary.
We may update this policy as the service or law changes. We will show the new effective date and give appropriate notice of material changes. Where the law requires renewed consent, we will ask for it.