Privacy Policy

Last updated: September 25, 2026 · Data controller: Jose Ricardo Diaz Garcia. Contact: support@xpatspain.es.

1. What we collect

Free diagnostic (chat): the messages you type. The free diagnostic requires no signup, no email, and no identity documents. We ask you not to share passport numbers, financial account numbers, or document uploads during the free phase.
Paid packages: the personal data needed to prepare your documents — such as your name, nationality, date of birth, address, employment and income details, family composition, and the consulate you will file at. We collect only what the deliverables require.
Payments: processed entirely by a third-party payment platform acting as Merchant of Record, identified at checkout and on your receipt. We never see or store your card details. The platform's privacy policy applies to the payment transaction and is presented at checkout.
Technical data: standard server logs (IP address, timestamps) used for security and rate limiting.
Site analytics: we use Umami Cloud to count page views, referral and campaign sources, and broad events such as opening the route chat, viewing pricing, and clicking a checkout link. The tracker respects Do Not Track and does not use cookies or collect chat text, email addresses, customer identities, or full URL query strings. A checkout click is not a completed purchase. Umami processes this analytics data in its EU region; see Umami's privacy notice.

2. How we use your data

To run the diagnostic and answer your questions.
To prepare your personalized document package (paid tiers).
To provide support during your package's support window.
To protect the service against abuse and fraud.
To understand which pages and campaign sources bring visits and where visitors stop before checkout, so we can improve the site.

We do not sell your personal data. We do not use your data for third-party advertising.

3. AI processing

Conversations and document-preparation tasks are processed using large-language-model services provided by Anthropic (the Claude API). Your messages are transmitted to Anthropic's API to generate responses. Per Anthropic's commercial API terms, API inputs and outputs are not used to train their models by default. See Anthropic's commercial terms and privacy policy.

4. Retention

Free diagnostic conversations: retained only as long as needed to operate the service and improve its quality, then deleted or anonymized.
Paid case data and deliverables: retained for the duration of your support window plus 90 days, so we can honor corrections and re-reviews, then deleted except where a longer period is legally required (e.g., invoicing records held by the Merchant of Record).
Server logs: rotated within 30 days.
Umami Cloud analytics: retained for 6 months under the current Hobby plan.

5. Sharing

We share data only with the processors needed to run the service: Anthropic (AI processing), the payment platform named at checkout (payments, as independent Merchant of Record), our hosting provider (Hetzner Online GmbH (Germany)), and Umami Software, Inc. (site analytics, hosted in its EU region). We do not share your data with immigration authorities, consulates, or any third party — you file your own applications.

6. International transfers

Our processors may process data in the United States and the European Union. Where required, transfers rely on the processors' standard contractual safeguards.

7. Your rights

Depending on your jurisdiction (including GDPR if you are in the EU/EEA and Peru's Personal Data Protection Law No. 29733), you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise any of these rights, write to support@xpatspain.es. We respond within the legally required timeframe.

8. Security

Data in transit is encrypted (HTTPS/TLS). Access to case data is restricted. No system is perfectly secure; if a breach affecting your data occurs, we will notify you as required by law.

9. Children

The service is not directed at anyone under 18. Dependent minors' data is provided by their parent or guardian solely for document preparation.

10. Changes

We may update this policy; material changes will appear here with a new date.