Privacy Policy

1. Data controller and scope

• Data controller: Antonio Samuel Martín Polo, trading under the business name Autonomio and the brand ImmigraFlow (hereinafter, the “Provider”)
• Tax ID (NIF): 50555557Q
• Address: Calle de las Laderas 16B, 28490 Becerril de la Sierra, Madrid, España
• Email: hello@immigraflow.io
• Website: immigraflow.io

ImmigraFlow is a platform for law firms that handle immigration case files. This policy explains how the Provider processes the data for which it is the controller: that of the firms that contract ImmigraFlow and their users, and that of the people who visit the website or contact the Provider.

The data of each firm’s clients (case files, documents, messages) is decided and controlled by the firm, which is their controller. The Provider processes that data only on the firm’s behalf, as processor, under the Data Processing Agreement. If you are a client of a firm that uses ImmigraFlow, the firm is the one that informs you about the processing of your data and the one before whom you can exercise your rights (section 8).

2. Data we process

2.1. Firms and their users

• Identification and contact: name, email, phone number and role of each user; the firm’s name, tax ID and address.
• Access: login credentials (the password is stored encrypted by the authentication provider) or sign-in with Google.
• Subscription billing: plan, modules, amounts and payment status. Payments are processed by Stripe; the Provider does not store card data.
• Support and communications: queries, incidents and conversations with the support assistant.
• Use of the Platform: activity and technical logs and, if the user accepts analytics cookies, usage data as described in the Cookie Policy.

2.2. Visitors and contacts

• Forms: the data you provide when requesting information, registering for a webinar, subscribing to the newsletter or starting a free trial (name, email, phone number, firm and message).
• Source of the visit: the campaign or link through which you reach the website, which is stored in your browser session and linked to your record only if you register.

2.3. Data collected automatically

• Browsing data: IP address, browser type, language and pages visited.
• Cookies: as described in the Cookie Policy.

3. Purposes of the processing

• Provision of the service: setting up and maintaining the firm’s account and its users’ accounts, and providing the contracted service.
• Billing: charging the subscription and issuing invoices.
• Support: handling queries and incidents, including through an artificial intelligence assistant.
• Service communications: notices about the account, security, the free trial and changes to the Terms.
• Commercial communications: the newsletter and webinars, to those who subscribe, and news about ImmigraFlow to client firms. All of them include a way to unsubscribe.
• Analytics and campaign measurement: understanding how the website and the Platform are used and measuring advertising results, only with your consent.
• Security: preventing fraud and abuse and logging technical errors to fix them.
• Legal compliance: tax, accounting and any other applicable obligations.

4. Legal basis for the processing

5. Processors and recipients

The providers that process data on the Provider’s behalf are the same ones listed as sub-processors in clause 10 of the Data Processing Agreement. Each one is involved only in the service indicated:

In addition, if you accept advertising cookies, Google Ireland Limited (Google Ads) and Meta Platforms Ireland Limited (Meta pixel) receive data about your browsing on the website to measure campaigns, as controllers of their own processing. The Spanish Tax Agency and other public bodies receive the data that the law requires to be reported to them.

5.1. WhatsApp channel

If a firm activates the WhatsApp channel, messages with its clients pass through the Provider’s integration server (DigitalOcean, Frankfurt) and through WhatsApp’s servers, using the firm’s own WhatsApp number and account. That processing is decided by the firm and is governed by the Data Processing Agreement and by section 9 of the Terms and Conditions. The channel is optional and the firm can deactivate it at any time; messages remain in the Platform even if the channel stops being available.

6. International transfers

Some of the providers in section 5 are established in the United States or provide the service from there; in particular, the application runs on Vercel servers in the United States, and the artificial intelligence functions go through OpenRouter and the provider of each model, which may be located outside the European Economic Area. These transfers rely on the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914) or, where the provider is certified, on the EU-U.S. Data Privacy Framework. The location and safeguard used by each provider are set out in the table in section 5.

7. Data retention

• Firm account and its users: for as long as the account exists. When the subscription ends, the account switches to read-only mode for 12 months, after which its data is automatically erased, following an email notice to the account owner and administrators at least 30 days in advance. The firm may request erasure earlier, which is carried out within a maximum of 30 days.
• Data of each firm’s clients: kept by the Provider on the firm’s behalf, under clause 15 of the Data Processing Agreement: automatic erasure 12 months after the subscription ends, notified to the firm at least 30 days in advance, earlier erasure if the firm requests it, within a maximum of 30 days, and retention for 6 years of the invoices the firm issued and its VeriFactu records, unless the firm indicates otherwise. Documents the firm deletes are permanently removed after 30 days.
• Subscription billing: 6 years, in accordance with Article 30 of the Spanish Commercial Code (Código de Comercio).
• Contact, demo and webinar forms: the time needed to handle the request; erased when you request it.
• Newsletter: until you unsubscribe.
• Analytics: a maximum of 13 months. The duration of each cookie is set out in the Cookie Policy.
• Backups: the database provider’s daily backups are kept for 7 days, and the external database backup for 30 days. The external copy of the files removes deleted documents 30 days after they leave the main storage.
• Questions to the artificial intelligence assistants: the questions you ask the client-portal query assistant, the legal research assistant or the support assistant are stored after personal data is automatically removed (detected names, document numbers, emails, phone numbers and IBANs) for a maximum of 180 days, to improve the answers. Each firm sees only its own questions; the Provider may analyse the questions of all firms together, but only on that cleaned text, and only to improve the service. They are never used to train third-party models: the artificial intelligence providers are configured with no data retention.

8. Your rights

Under the GDPR and the LOPDGDD (the Spanish Data Protection and Digital Rights Guarantee Act), you can exercise the following rights:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate data.
• Erasure: request deletion when the data are no longer necessary.
• Restriction of processing: request that it be restricted in certain cases.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest and to commercial communications.
• Withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise them, write to hello@immigraflow.io stating your name and the right you wish to exercise. We will respond within one month. If you are a client of a firm that uses ImmigraFlow, contact your firm directly; if you write to us, we will forward your request to it.

If you believe your rights have not been properly addressed, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es.

9. Security

The Provider applies technical and organisational measures appropriate to the risk, including:

• Encryption of communications (TLS/HTTPS).
• Encryption at rest of the database and files, and additional encryption of electronic certificates and credentials.
• Isolation between firms through row-level security policies on all tables, and role-based access control within each firm.
• Database and files hosted in the European Union, with daily backups.
• Technical error logging without identifying data.

The details are set out in clause 9 of the Data Processing Agreement.

10. Minors

ImmigraFlow is aimed at professionals, not at minors. Data of minors that a firm includes in its case files (for example, children in a family reunification case) is processed by the firm as controller, and by the Provider only on its behalf, under the Data Processing Agreement.

11. Mercurio Chrome extension

The Mercurio Chrome extension fills in the forms of government electronic offices with the firm’s clients’ data. It processes that data on the firm’s behalf, under the Data Processing Agreement, and it also processes the following data:

11.1. Data processed by the extension

• Session: the authentication token is stored in the extension’s local storage in the browser (chrome.storage.local) until the user logs out.
• Client data: the client’s name, NIE/NIF, address and application data, which the extension requests from the Platform only to fill in the form and does not store in the browser.
• Form description: a compact description of the office form’s fields (labels, field types, nearby text), without any personal data the page may contain. It is sent to the server to match the fields and discarded afterwards.
• Electronic certificates: only the holder’s name and the certificate’s tax ID, to fill in the filer’s details. Encrypted certificate files (.p12) never leave the server.
• Incident reports: when the user requests it, a screenshot of the office page that failed, saved in the case file.
• Operation log: each form fill-in (form type, number of fields filled, duration) is logged for internal auditing.

11.2. Processing by artificial intelligence

To match the form fields with the client’s data, the ImmigraFlow server sends the field description and the client’s data to an AI model (Gemini, by Google, with Claude, by Anthropic, as a fallback) through OpenRouter. The AI returns the matches and the data is not stored beyond the operation.

11.3. Extension permissions

12. Amendments

The Provider may update this policy. Any change will be published on this page with its date, and significant changes will be communicated to firms by email.

13. Contact

For any query about data protection:

• Email: hello@immigraflow.io
• Postal address: Antonio Samuel Martín Polo, Calle de las Laderas 16B, 28490 Becerril de la Sierra, Madrid, España