Privacy policy
Last updated: November 13, 2026
Data controller
AF Abogados y Peritos Judiciales SLU, tax ID (NIF) B19368802, C/ Trinidad Grund 21, 6-81, 29001 Málaga. ResiLegal is a brand of this company. Data protection contact: the email on the contact page.
What data we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Free eligibility test | Questionnaire answers, language, technical session identifier, pseudonymised IP address | Consent (art. 6.1.a) | 12 months if there is no contact; otherwise it becomes part of the case |
| Resi, the immigration AI | Questions and answers, language, guest or client identifier; for clients, case status (never documents) | Consent (guests) and performance of the contract (clients) | Guests, 90 days; clients, 24 months from the last message |
| Contact | Name, phone, email, message, company | Pre-contractual measures (art. 6.1.b) | 24 months from the last contact |
| Managing and processing the case | Identification and contact data, procedure documents (passport, municipal registration, criminal records, contracts…), official form data, payments and invoices | Performance of the contract (art. 6.1.b) and legal obligations (art. 6.1.c) | Duration of the service and legal periods (minimum 5 years; tax obligations up to 10 years) |
| Automatic document checks | Image or PDF of the document and extracted data (number, dates, holder) | Performance of the contract | Same as the case |
| Signature with a one-time code | Phone or email, code, date, IP, document hash | Performance of the contract; legal obligation | Same as the case |
| Consultations (specialist, video consultation and review with an immigration lawyer) | Appointment data, topic and — only with your consent — recording, transcript and summary | Performance of the contract; consent for recording | The audio is not kept (it is transcribed and deleted); the transcript, 90 days after the consultation; the appointment and the summary, same as the case |
| Notifications (push, WhatsApp, Telegram, SMS, email) | Number or identifier, device token, notification text | Performance of the contract; consent for news | 12 months in the notification centre |
| Calls to the switchboard | Number, date, duration and reason for the call (ResiLegal stores neither the audio nor the transcript) | Legitimate interest in assisting you (art. 6.1.f) | Same as the case |
| Mobile apps | Device session identifier, notification token, app version | Performance of the contract | While the session is open |
| Web analytics and advertising | Analytics cookie, pages viewed, click identifier (gclid) | Consent (cookies) | Analytics, 6 months; click identifier, 90 days |
Some procedures require special category data (for example, criminal records or health data in certain cases). They are only processed when the procedure requires it and with your explicit consent.
Automated decisions and artificial intelligence
The test assigns the procedure using rules, documents are checked automatically and Resi answers using artificial intelligence. None of this produces legal effects on you by itself: the decision on your application is taken by the Administration, and any incident is reviewed by a member of the team. You can ask for a person to intervene at any time. More detail on the “Use of AI” page.
Processors and recipients
- Hosting, storage and backups: Hetzner Online GmbH (Germany, European Union).
- Text artificial intelligence: Anthropic.
- Search of the legal knowledge base, calendar and video call (Google Meet): Google Cloud (European Union region) and Google Workspace.
- Consultation transcription and switchboard voice: ElevenLabs.
- Telephony: Telnyx.
- Payments: Stripe or Revolut (card and wallets) and Redsys or Stripe (Bizum). We do not store your card details.
- Invoicing: Billora.
- SMS: Altiria, Telnyx or Twilio.
- Email: Resend.
- Mobile notifications: Google Firebase Cloud Messaging and Apple Push Notification service.
- Messaging: Meta (WhatsApp) and Telegram, when you choose those channels.
- Error logging: Sentry.
- Analytics and advertising: Google, only with your consent.
- The immigration lawyers on our team, when you contract the video consultation or the case review: they access your case as independent professionals bound by professional secrecy.
- The Public Administration to which your application is submitted.
For providers located outside the European Economic Area, standard contractual clauses or another valid international transfer safeguard apply. Data is not shared with third parties for their own purposes.
Your rights
Access, rectification, erasure, objection, restriction, portability and not to be subject to solely automated decisions. You can exercise them from “My case → Privacy”, from the app or by writing to the contact email. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Security
Encryption in transit and at rest of documents and sensitive identification data, immutable audit log, two-factor access for the team, revocable device sessions and encrypted backups.