Privacy notice

Who is responsible for your data

The data controller is [controller name: to be completed before launch]. You can contact us about your data at [privacy contact email: to be completed before launch].

ClaraPel is an unofficial guide. It is not a government service and does not give legal advice.

What we collect

We only collect what we need to help you:

• Your account: your email address and how you sign in (email and password, or Google). Your password is never stored as written: our sign-in provider keeps only a scrambled version (hash) that can't be turned back into it. If you use Google, Google shares your name and profile photo with our sign-in provider; we do not use them in the app.
• Your answers about your situation, only if you choose to give them: the name you want us to use, province and town, nationality, which documents you have, how long you have lived in Spain, whether you are registered on the padrón, and what you need help with. Every question is optional.
• Your deadlines and checklist progress: the permit expiry date you enter and the steps you tick.
• Security counters: short-lived counters that limit how often each account can save or download, deleted within a day.

What we never collect

We never ask for or store document numbers (NIE, TIE, DNI or passport), your exact address, or payment details.

Why we use it and on what legal basis

• To provide your account, deadlines and checklists you ask for: performing our service to you (GDPR Art. 6(1)(b)).
• To personalise guides using your situation answers: your explicit consent (GDPR Art. 6(1)(a) and, where your answers could reveal sensitive information, Art. 9(2)(a)). You can withdraw consent at any time by deleting your answers.
• To keep the service secure and prevent abuse: our legitimate interest (GDPR Art. 6(1)(f)).

How the app uses your answers

Your answers only decide which guides and deadlines we show you first. They never lead to a decision with legal effects about you, and we do not sell your data, show advertising or share your answers with anyone.

Who processes your data for us

We use these service providers, under data processing agreements:

• Supabase (database and sign-in): your data is stored in Frankfurt, Germany (EU).
• Vercel (website hosting): the app's servers run in Frankfurt, Germany (EU). Vercel is a US company; any transfer outside the EU is covered by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
• Google: only if you choose to sign in with Google.

How long we keep it

Your account data is kept until you delete your account. Your situation answers are kept until you delete them or your account. Security counters are deleted within one day.

Cookies and storage on your device

We only use cookies that are strictly necessary: one to keep you signed in, and, if you choose Light or Dark in Settings, one that remembers that choice in your browser for a year (choosing System removes it). If you use a checklist without an account, your progress is stored only on your device. We do not use analytics or advertising cookies.

Your rights

You can access, correct, download (portability), and delete your data, withdraw your consent, and object to or restrict processing. In My account you can download all your data, edit or delete your answers, and delete your account. For anything else, contact us at the address above.

If you believe we have not respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

Age

You must be 14 or older to create an account and give consent.

Changes to this notice

If we change this notice in a way that affects your consent, we will ask you again before using your answers.