Short version
Who handles your data
Vladyslav Smirnov, sole trader, NIE Z0736209F — the person behind Ruta
Why
To give you your account, guide you through your procedure, prepare your official forms, book your appointment as part of the service, take payment, handle refunds and complaints, answer your emails, and keep the service running and safe
On what basis
Mostly because you have contracted the service, including the appointment booking, or asked us to take steps before you do. Legal duties for accounting, consumer matters and privacy requests. Our legitimate interest for security and for improving the service
Who else sees it
Our suppliers: the database, the hosting, the AI providers, the email providers, the payment provider and our accountant. The Administration's appointment portal, when we book your appointment, and the messaging app you choose for appointment news. Nobody else. We do not sell your data and we do not advertise to you
Sent outside the EU
Yes — to the United States. Our database stays in Frankfurt, but its provider's staff can reach it from Singapore. Both under the safeguards the GDPR requires
If you are unhappy
Tell us first. You can also complain to the Agencia Española de Protección de Datos (www.aepd.es)
1Who we are
The person responsible for your data (the "controller") is:
- Name: Vladyslav Smirnov, sole trader (empresario individual / autónomo)
- Tax number (NIE): Z0736209F
- Address: calle Tribunal de les Aigues 2, Catarroja, Valencia, 46470, Spain
- Privacy contact: privacy@rutaspain.com
We have not appointed a Data Protection Officer. None of the three cases in Article 37 GDPR applies to us. Your privacy questions go to the address above. The business owner answers them, and one other member of our team reads that address too, so that it is covered when the owner is away.
In this policy, "Ruta", "we" and "us" mean the person above. "You" means anyone who uses the service, visits the site or writes to us.
2What this policy covers
This policy explains what we do with personal data when you visit our website at rutaspain.com, use the service at app.rutaspain.com, talk to our assistant, pay for a procedure, or write to us.
Three related documents sit alongside it: the Terms and Conditions, which are the contract for the service you buy; the Legal Notice, which says who we are and how you may use the site; and the Cookie Policy, which explains what the service stores on your device, what each item is for, and for how long it stays. All four are linked at the bottom of every page of the service.
3Where your data comes from
Almost everything we hold comes from you: what you type into the assistant, what you enter when you register or pay, and what you send us by email.
Two things come from others:
- The payment provider tells us whether your payment went through and how much was charged.
- The Administration's appointment portal shows us the confirmation of the appointment we book for you: the office and its address, the date and time, and the confirmation code. We copy those details to you in the chat and by the channel you chose for appointment news, and the portal also emails its confirmation to you directly.
We do not buy data about you, we do not collect it from public registers or social networks, and we receive nothing else from the Administration about your case.
You choose what to tell us. But if you leave out something an official form requires, we cannot prepare that form, and to that extent we cannot deliver the service.
Details about other people. Some official forms ask for details about people other than you. The residence card form asks only for your parents' names. We hold those details only because the form requires them, we use them only to fill that form, and we keep them for as long as we keep the rest of your procedure.
We have no way to reach those people directly, so this policy is how we tell them. If you are named in someone else's application and you want to know what we hold about you, write to privacy@rutaspain.com.
4What we do with your data, and why
Each thing we do has its own reason and its own legal basis under Article 6 GDPR.
4.1 Giving you an account
We store your email address, your password in hashed form, and the display name you can add on your profile page. When you sign in, our sign-in provider records your sign-in sessions, with their times, your IP address and your browser, so that only you can reach your data.
To create an account you tick the box "I have read and agreed with the Privacy Policy". We record which version you accepted, in which language and on which page, with your email address and the time. It is our proof that we told you how we use your data, and we keep it after you close your account (section 9).
Legal basis: performance of your contract with us (Art. 6(1)(b)). Keeping the record of the policy you accepted after you close your account: our legitimate interest in being able to show that we informed you (Art. 6(1)(f)).
4.2 Letting you talk to the assistant before you register
You can use the assistant before creating an account. What you say is stored on our server under a random conversation identifier, and your browser keeps that identifier for 30 days from your first message. The Cookie Policy explains it.
Until you sign in, the assistant saves none of your details for a form. We keep the conversation itself.
If you sign in from the same browser within those 30 days, with a new account or one you already have, the conversation is attached to your account. If you do not, nothing ever ties it to a person: no account, no name and no email is attached to it, and it is deleted 90 days after it started (section 9).
While you are not signed in, the identifier does not bring your earlier messages back on screen. It keeps what you send in one conversation on our server, so that it can be attached to an account later.
Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b)).
4.3 Guiding you through your procedure
This is the core of the service. We store the whole conversation in your own language, and the details your procedure needs. They depend on the procedure and the official form it uses, so we cannot list every detail for every procedure. Today they are: your name and surnames, sex, date and place of birth, nationality, passport number and NIE or DNI, your address in Spain, your mobile phone number and email, your parents' names and your marital status. We also ask how you would like to hear about your appointment, for example by Telegram, WhatsApp or email, and store the handle or number you give us for it, to send you your appointment details (4.5). If a procedure needs a kind of detail not listed here, we add it to this policy before we ask for it.
Once you are signed in, the assistant picks these details out of your messages as you write, including before you buy.
We also store which procedure you are on, your answers at each step (for example the number on your appointment receipt), how far through it you are, and the assistant's working notes on your case (section 6).
When you start a new conversation, it begins with a copy of the details you have already given us, so that you do not have to answer the same questions again.
For each reply, we keep a copy of the instructions the assistant was given to write it, which include your details. We use it to check why the assistant replied as it did and whether it filled your form correctly, and for nothing else.
Legal basis: performance of your contract with us, and steps you ask us to take before it (Art. 6(1)(b)).
4.4 Preparing your official forms
We fill the official form using the details you have already given us, and give you the completed file. You review it, you sign it and you file it yourself. We never sign or file anything for you.
Completed forms are kept in private storage in Frankfurt. Only you, signed in to your account, and our team can open them. Each form carries a mark in the file's properties saying it was prepared with AI assistance, as the EU AI Act requires.
The assistant never asks you to upload documents, and the chat has no way to receive them.
Legal basis: performance of your contract with us (Art. 6(1)(b)).
4.5 Booking your appointment
Booking your appointment is part of the service you buy. A member of our team requests it by hand at the Administration's appointment portal, using your own real data. They copy the confirmation to you in the chat and by the channel you chose, with the office, the date and time and the confirmation code, and the portal also emails it to you.
This is a step of mere procedure under Article 5.3 of Law 39/2015. It gives us no power to represent you in your case, which remains yours to conduct.
We keep a record of each booking: what was requested, for whom, when, with which details, the outcome, who on our team made it, and what we sent you about it. It lets us tell you what was done in your name and answer any question about it. We keep that record even if you later close your account (section 9).
Because the booking is part of the service, it is not something you agree to separately, and it is not something you can switch off on its own. If you do not want us to book for you, you can end the procedure under the withdrawal and cancellation terms.
Legal basis: performance of your contract with us (Art. 6(1)(b)). Our legitimate interest in keeping the record afterwards (Art. 6(1)(f)). 4.6 Taking payment
When you press Pay, we record the offer exactly as it was shown to you: the service, its price, description and conditions, the withdrawal form, the version of the Terms, and the three statements you ticked. We record it with your email address and the time.
You then pay in the payment provider's own form, which opens inside our page. You give it your email and card details there, and card details never reach us. The provider tells us whether the payment went through. We store that, the amount charged, the date and the provider's reference numbers. The provider knows which service you bought, and may send you its own receipt.
We keep the invoice for each payment for our accounting, and our external accountant keeps our accounting records for us.
Legal basis: performance of your contract (Art. 6(1)(b)) for taking the payment. Our legal obligations (Art. 6(1)(c)) for keeping the record of the contract and the accounting record: consumer law, Article 30 of the Commercial Code and the General Tax Act.
4.7 Sending you service emails
We send only the emails the service itself needs: confirming your account, resetting your password, confirming your purchase, with a copy of the Terms you accepted, and acknowledging a refund request. For each purchase confirmation and refund acknowledgement, we keep a record of who it went to, which wording was used, the details filled into it and whether our email provider accepted it for sending. We do not send marketing email, and there is no mailing list.
Legal basis: performance of your contract (Art. 6(1)(b)). The purchase confirmation and the refund acknowledgement are also duties consumer law places on us (Art. 6(1)(c)).
4.8 Helping you when a person is needed
A member of our team can read your conversation and write into it, to correct or complete what the assistant told you. Every message they write shows their name.
Once your procedure has started, you can ask for a person with the Help button in the chat. You are told when a person takes over and when the conversation goes back to the assistant. We record when you asked and when it went back. Our team can also keep notes on the steps of your procedure.
Legal basis: performance of your contract (Art. 6(1)(b)).
4.9 Keeping the service running and safe
Our hosting and database providers keep technical records: your IP address, your browser, which pages were requested and when, and application logs. We use them to find faults, fix them, and protect the service against misuse. The logs can also hold your email address, the internal identifier of your account, the name of each form you download, and the assistant's short notes on a step, which can mention what you said. They do not hold the details collected for your form, and they are kept for a few days (section 9).
Legal basis: our legitimate interest in a service that works and is secure (Art. 6(1)(f)). We have weighed this against your privacy and concluded it is limited to what running the service requires. You can object — see section 11.
4.10 Improving the service
Our staff read conversations, progress data and the assistant's working notes, in our admin area or directly in our database, to understand where the service fails and make it better.
Legal basis: our legitimate interest in improving the service (Art. 6(1)(f)). You can object to this specifically, under Article 21 GDPR, without affecting the service you receive.
4.11 Answering your privacy requests
When you exercise a right, we keep your request, our answer and what we did about it. If we had to ask you to prove who you are, we keep that proof with the request, in a folder only the people who handle requests can open.
Legal basis: our legal obligation to answer you (Art. 6(1)(c), Arts. 12 and 15–22).
4.12 Handling your complaints
You can complain to us at complaints@rutaspain.com. The Help button in the chat shows the address too. When you complain, we keep your name, email address, what you complained about, our reference number, our answer and the dates. We use this to answer you and to show that we did.
Legal basis: our legal obligation to handle consumer complaints (Art. 6(1)(c)).
4.13 Handling refunds and withdrawals
To ask for a refund, or to withdraw from the contract, you write to refunds@rutaspain.com. The withdrawal form on the offer card is addressed there.
When you first write to that address, our system opens a record of your request: who sent it, when, our reference number and a link to the email in our mailbox. It sends you an automatic acknowledgement with that reference. It does this for anyone's first email, whatever it is about. Later emails stay in our mailbox with the request. We then read your email, and record why you asked, what we decided and the payment provider's reference for any refund.
Legal basis: performance of your contract (Art. 6(1)(b)), and our legal obligations as a seller to consumers and for accounting (Art. 6(1)(c)).
4.14 Answering your emails
When you write to support@rutaspain.com or info@rutaspain.com, or reply to one of our emails, we keep your message and our answer so that we can deal with your question.
Legal basis: performance of your contract, or steps you asked for before one (Art. 6(1)(b)), when your email is about the service. Otherwise our legitimate interest in answering the people who write to us (Art. 6(1)(f)).
5What we ask you not to send us
The assistant is a free-text box, so you can type anything into it. Please don't type more than your procedure needs.
In particular, we do not ask for and do not want information about your health, your religion or beliefs, your political opinions, your trade union membership, your sex life or sexual orientation, or your racial or ethnic origin. We do not need it, and we ask you not to send it. There is one exception. The social security registration form asks whether you have a disability, because that changes how the form is filled. If you use that procedure, the assistant asks you only that, yes or no, explains why, asks for no details, and uses your answer only for that form. Answering is up to you: you can leave it out and fill that box on the form yourself.
Never give us your digital certificate, your Cl@ve credentials, or any password for a government service. We will never ask for them. Anyone who does is not us.
6The AI assistant
Our service works through an artificial intelligence assistant. The chat tells you so before you send your first message, and every reply the assistant writes is labelled as its own.
Your conversation is sent to an AI provider to produce each answer. That includes what you type, the details we hold for your procedure, where you are in it, and the assistant's working notes. Section 7 says who the providers are and section 8 explains the transfer.
The assistant assesses your case. To give you the right answer for your situation, it works out, for example, which procedure applies to you and where you are in it. That is an automated assessment, and we tell you about it because you are entitled to know.
None of this decides your case. The decision on your case is taken by the Administration, which never sees these assessments and does not use them.
You can ask a person to review it. If the assistant has understood your situation wrongly, you can correct it in the chat. Once your procedure has started, you can ask for a person with the Help button in the chat. At any time, you can write to support@rutaspain.com, and a person will look at your case.
The assistant can be wrong. Anything it produces is a draft for you to check before you sign it.
7Who else sees your data
We use suppliers to run the service. Most of them process your data only on our instructions, under a written agreement that meets Article 28 GDPR, and cannot use it for their own purposes. The payment provider is different: it decides for itself how it handles payment data, as the law and the card rules require, and is responsible for that part in its own right.
We also send your name, identity number and contact details to the Ministry for Digital Transformation and the Civil Service when we book your appointment, because that is what the appointment portal asks for. They are a public authority, not our supplier.
If you chose Telegram or WhatsApp for appointment news, we also send your appointment details there. The company behind that app is not our supplier: it carries the message under its own privacy policy, which you accepted when you started using the app.
We disclose data to no one else. We do not sell it, we do not share it with advertisers, and we hand it to any other authority only where the law obliges us to.
8Data sent outside the EU
Some of our suppliers are established in the United States, and our database provider in Singapore, so your data is transferred there or can be reached from there.
Where a supplier is certified under the EU–US Data Privacy Framework, the European Commission has decided that the United States offers adequate protection for that supplier, and the transfer runs on that decision.
For our database provider we use the European Commission's standard contractual clauses, and we have assessed in writing whether the laws of the countries it works from let it keep them.
You can ask us for a copy of the safeguards that apply to you at privacy@rutaspain.com.
9How long we keep your data
Whose messages count. Where a period runs from a last message, any message counts, whoever writes it: you, the assistant or our team. Once a procedure has closed, new messages in its conversation do not change its date: they are deleted with it.
Copies of your details. A new conversation starts with a copy of the details you gave us earlier. That copy is kept, and deleted, with the new conversation.
Why six years. It is the longest period that applies: five years for a claim about the service, six for accounting records, four for tax. Keeping these records for less would leave us unable to answer a claim that is still in time.
Conversations started without an account. Until it is deleted, an unclaimed conversation is held on our server, and our staff can read it in our database for the purpose in 4.10. It is not shown in our admin area. After 30 days the browser that started it forgets its identifier, so it can no longer be attached to an account from that browser. After 90 days it is deleted with every message in it.
When you close your account we delete it, with your conversations, messages, procedures, completed forms and the offers you did not pay for. We confirm it is done only once we have checked that none of it is left, apart from anything an open matter still needs (see below).
Some records survive, and we want to be straight about why. The offer you accepted and our confirmation email, your payment and accounting records, your booking record, and any refund or complaint are kept for the six years above. From when your procedure's data is deleted or you close your account, whichever comes first, they are blocked, under Article 32 of the Spanish Data Protection Act: nobody uses them, no screen of our service shows them, and they are only available to a judge, a public prosecutor or the data protection authority if one of them asks. When the six years end they are destroyed. The record of which version of this policy you accepted is blocked in the same way once you close your account, and destroyed three years after the end of the year you closed it. Any privacy request you made is kept for the three years above, and emails you sent us for the one year above.
An open matter pauses deletion. While a request, complaint, refund, dispute or legal claim of yours is open, or while we investigate a security incident or answer a request from an authority, we keep what it concerns until the matter is closed, even past the periods above.
Copies kept by our suppliers. Some suppliers in section 7 keep short-lived copies on their own schedule, and we cannot delete them for one person:
- Technical logs at Vercel and Supabase: one day at Vercel, up to seven days at Supabase. They hold your IP address, and can hold your email address, the internal identifier of your account, the name of each form you download, and the assistant's short notes on a step, which can mention what you said. They do not hold the details collected for your form.
- Our database backups: a deleted record stays in them for up to seven days, then it is gone. They do not hold your completed forms.
- Emails passing through our email provider, Resend: 30 days, and up to seven more days in its backups.
- Payment data at Stripe, which it keeps under its own privacy policy as a controller in its own right.
The AI providers keep nothing. Our AI gateway sends your messages only to AI providers that have agreed to zero data retention, and neither the gateway nor the provider keeps them once the reply is made.
10How we protect your data
Passwords are stored hashed, never in readable form. Traffic is encrypted in transit and data is encrypted at rest. Your browser can read only your own records, which our database enforces, and our server checks each request against your account or, for a conversation started without an account, against its identifier. Completed forms are kept in private storage that only our server can reach. The admin area is limited to a named list of staff, checked on every request, and every message a staff member writes into your conversation shows who wrote it. Payment card data never touches our systems.
No system is perfectly secure. If a breach happens that puts your rights at risk, we will tell the Agencia Española de Protección de Datos within 72 hours, and we will tell you if the risk to you is high.
11Your rights
You can:
- Ask what we hold about you, and get a copy (Art. 15)
- Correct anything wrong (Art. 16)
- Delete your data (Art. 17)
- Restrict what we do with it while something is being sorted out (Art. 18)
- Take your data with you in a machine-readable file (Art. 20)
- Object to processing we do on the basis of legitimate interest, including our reading of conversations to improve the service (Art. 21)
- Ask a person to review the assistant's assessments of your case (section 6)
- Complain, to us or to the authority
What you can do yourself. You can correct your details by telling the assistant in an open chat. To correct them everywhere, including forms already made, write to privacy@rutaspain.com. You can close your account at any time on your profile page, which deletes it as section 9 explains.
How. For everything else, write to privacy@rutaspain.com. Tell us which right you want to use. We may ask you to prove who you are, so that we don't hand your data to someone else.
When. Within one month. If your request is complicated we can take two months more, and we will tell you within the first month if that happens. It is free, unless a request is clearly excessive or repetitive.
While a restriction is in force we suspend your account, so you cannot sign in to it until the restriction is lifted. We tell you before we lift it.
A conversation you had without an account. We cannot act on a request about it. Nothing we hold ties such a conversation to a person: no account, no name, no email, only the random identifier held by the browser that started it. So we cannot verify that a conversation is yours, and we cannot act on a request we cannot verify. It is deleted automatically 90 days after it started. If you signed in from the same browser within 30 days, the conversation is part of your account and every right above applies to it.
If you are not happy with our answer, you can complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can go to them directly — you do not have to come to us first.
12Children
Ruta is for adults. You must be 18 or older to use the service. We do not knowingly collect data about children. If you believe a child has given us data, write to privacy@rutaspain.com and we will delete it.
13Changes to this policy
We may update this policy. Every version has a version label and an effective date, both shown at the top of this page. If a change matters to you, we will email you before it takes effect.
Published wording is never edited in place: a change means a new version label, a new date, and all three languages republished together.
14Contact
- Privacy: privacy@rutaspain.com
- Complaints: complaints@rutaspain.com
- Refunds and withdrawals: refunds@rutaspain.com
- Help with the service: support@rutaspain.com
- By post: the address in section 1