NLV TrackerPrivacy policy
Last updated 8 November 2026. This policy covers the NLV Tracker. The rest of the Spainguru website is covered by the spainguru.es privacy policy.
Who is responsible
The data controller is Bruno Bianchi Sarcone (Spainguru), NIF ES60008662Y, Rafaela 9, 29009 Málaga, Spain. Contact for anything about your data: hello@spainguru.es. Full details are in the legal notice.
What we collect
| Data | What it includes |
|---|---|
| Account | Your email address. If you choose "Continue with Google", Google also sends us your name and profile picture. |
| Your application | Your answers during setup (country and region, consulate, household, type of income, target move date, pets, property plans) and, for each person you add: name, date of birth, nationalities, passport expiry date, work situation, type of health cover (private or S1) and TIE expiry date. |
| Your progress | What you tick, document issue dates, appointments, visa, entry and insurance dates, trips abroad, budget amounts, cities you're considering, your notes and the documents you add yourself. |
| Document links (optional) | Web addresses you paste to scans kept in your own Google Drive, Dropbox or similar, with an optional label. We store only the address, never the file, and we don't open it. |
| Collaborators (optional) | The email address and name of anyone you invite to work on your tracker, and when they joined. |
| Community timeline (optional) | If you choose to share it: your consulate, household type, application and decision dates, outcome, and any tip you write. |
| Payments | Stripe handles the payment. We receive your plan, its status and dates, amounts, invoices and your Stripe customer reference, plus the billing name, address and any tax ID you give Stripe. We never see or store your card number. |
| How you use the tracker | Pages you open and key actions (for example opening a locked item, the upgrade page or a partner link), with the date. This is recorded on our server for signed-in users and doesn't use cookies. |
| How you found us | The campaign tag or referring website of the link you followed to sign up (for example "newsletter" or "facebook"), saved once with your account. No cookie is used for this. |
| Invitations | If you invite a friend or were invited: your invitation code, who invited whom, whether the friend paid (not how much) and the reward given. The person who invited you only sees how many friends joined, not who. |
| Messages | Feedback, reports of consulate changes and emails you send us. A log of the emails we send you and whether each was delivered, opened or a link in it was clicked (through our email provider, Resend), so we can fix delivery problems and see which reminders help. |
| Technical data | Our hosting providers process your IP address and browser details to deliver the pages and protect the service, and keep them in short-lived security logs. The tracker itself doesn't store your IP address. |
We don't ask for passport numbers, document scans or medical information. The health cover field only says whether you use private insurance or an S1 form.
Other people in your household. If you add your partner, children or other family members, make sure you're entitled to share their details with us (for example because they agree, or you're the parent or guardian). We use them only to build your household's checklist and dates.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running the tracker for you: your checklist, validity checks, dates, calendar file and share links. | Contract (art. 6.1.b). |
| Email reminders of your dates, and alerts when your consulate changes an official requirement. You can switch both off in the timeline page. | Contract for reminders; legitimate interest in warning you about changes that affect your application (art. 6.1.f). |
| Payments, invoices and tax records. | Contract, and legal obligation to keep accounting and tax records (art. 6.1.c). |
| Support, fixing problems and keeping the service secure. | Legitimate interest (art. 6.1.f). |
| Improving the tracker and deciding which features and services to offer, mostly from aggregate statistics on usage, signup sources and partner clicks. The Spainguru team can see the information in your account for these purposes, under a duty of confidentiality. | Legitimate interest (art. 6.1.f). You can object at any time by writing to us. |
| The Spainguru newsletter. | Consent (art. 6.1.a): only if you tick the box; unsubscribe from any email. |
| Showing your community timeline to other applicants without your name or email, and in aggregate statistics on spainguru.es. Tips are reviewed before they appear. | Consent (art. 6.1.a): you choose to share it and can remove it at any time. |
We don't make automated decisions with legal or similar effects about you, and we don't use your data for advertising.
Who receives it
We don't sell your data. Partners never receive it from us: if you contact a partner, you decide what to tell them, and we only share aggregate figures (for example "40 clicks from the Chicago checklist this month"). If you create a share link, anyone with the link can see your summary (names, consulate, appointment, document and task status, and your document links) until you switch it off. If you invite a collaborator, that person sees and can edit your whole tracker (everything in the table above except billing) until you remove them; it's your responsibility to invite only people you trust with it. We may disclose data when the law requires it.
These providers process data on our behalf, under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt, Germany) |
| Vercel | Hosting and running the app | USA and global edge network |
| Stripe | Payments, invoices and the billing portal | Ireland and USA |
| Resend | Sending sign-in codes, reminders and alerts by email | USA |
| GetResponse | Spainguru newsletter, only if you ask for it | EU (Poland) |
| Sign-in, only if you choose "Continue with Google" | USA and EU |
When data goes to the United States, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
How long we keep it
- Your account and application data: until you delete your account. Deleting it erases everything at once; copies in our providers' backups expire on their normal cycle.
- Usage records: 24 months, then deleted automatically.
- Payment and invoice records: 6 years, as Spanish accounting law requires (Commercial Code, art. 30), kept by Stripe and in our accounts.
- Feedback, reports of consulate changes and partner-link clicks: kept without the link to your account after you delete it, for statistics.
- Inactive accounts: we may delete accounts unused for 3 years, after warning you by email.
Your rights
You can access, correct, delete, restrict or object to the use of your data, take it with you (portability) and withdraw any consent, without affecting what was done before. Most of this you can do yourself: edit anything in the tracker, use Download my data for a copy in JSON, or Delete my account. For anything else, write to hello@spainguru.es; we answer within one month. If you're unhappy with our answer, you can complain to the Spanish Data Protection Agency, aepd.es, or to the authority where you live.
Security
Connections are encrypted, there are no passwords to steal (you sign in with one-time codes or Google), each account can only reach its own data at database level, and payments go through Stripe. Access by the Spainguru team is limited to what's needed for the purposes above.
Cookies
The tracker only uses what it needs to keep you signed in and to remember your light or dark theme. Details in the cookie policy.
Children
The tracker is for adults. Children's details are only entered by a parent or guardian as part of the family's application.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the tracker before the change applies.