Privacy policy
This is a courtesy translation. The Spanish version is the one that applies.
In one sentence: this website has no accounts, no tracking cookies and creates no file on you. There is only one place where you can type: the assistant. If you use it, what you write leaves your browser and reaches Google, and the server keeps a usage counter tied to your connection. Sections 1 and 2 explain this in detail.
Who the data controller is
Controller: Fiscalidad y procesos automatizados, SL
NIF/CIF: B22991186
Registry details: Registered with the Registro Mercantil de Tarragona, sección 8, hoja T-64710, inscripción 1
Registered office: Calle Industria 24, 1 · 43800 Valls (Tarragona), España
Contact email: hola@verigastu.com
Telephone: +34 623 513 354
1. When you visit this website
We use no analytics, advertising or tracking cookies, and we load no third-party resources (no fonts, no maps, no social media buttons). There is nothing to accept or reject.
As with any website, the server hosting it automatically logs technical data about each visit – IP address, date and time, page requested, browser type – for security and to diagnose faults. Those logs are generated by the hosting provider (Hostinger), which acts as data processor, and are kept for whatever period it applies.
2. When you use the assistant on the page
The assistant is optional: it only works if you open it and type something. When you send a question, this is what happens:
- The question travels to our server and from there to the Google Gemini API, which generates the reply. No copy of the conversation is kept on our server.
- So that nobody can exhaust the service, the server keeps a request counter linked to a hash of your IP address, not to the address itself. That hash is still personal data – pseudonymised, not anonymous – although we do not cross-reference it with anything. It is computed without a key, so the IP address it comes from could be worked out by technical means. It is processed on the basis of our legitimate interest in protecting the service (Art. 6(1)(f) GDPR) and is not used for any other purpose. It lives in the server's temporary files folder, which the system itself clears out.
- The conversation history lives only in your browser, in memory: it disappears when you close the tab.
That is why we ask you not to type personal data into the assistant – neither yours nor anyone else's – no NIF, no real amounts, no client names. The assistant answers questions about the product, not about your case, so it does not need them. Google's service is used on its paid tier; section 5 explains what Google does with what you type, and the applicable terms are Google's.
3. When you use the Verigastu app
The app is a different thing and is used at app.verigastu.es. The access code and the link are requested at verigastu.com. Its design is the opposite of the usual one: it has no sign-up, no passwords and no database of ours holding your expenses. You get in with a personal code, which acts as your account. Your expenses, your photos and your tax profile are stored on your own device, and the backup – if you turn it on – goes to your Google Drive, not to a server of ours. The only moment a supporting document leaves your phone is when the AI reads it: our server does not store it, but the artificial intelligence provider keeps it for up to 30 days (up to two years if it detects a use that breaks its rules). From dictation we neither receive nor store any audio: it is transcribed by the speech recognition of your browser or your phone – Google's on Chrome and Android, Apple's on iPhone – which, depending on the browser, may process the audio on its maker's servers and under that maker's own terms; only the text reaches the application. How that works is set out in the app itself and in the privacy policy on verigastu.com. To have your code and its data deleted, follow the steps in Delete your code and its data.
4. Legal basis and retention
The server's technical logs are processed on the basis of our legitimate interest in the security of the site (Art. 6(1)(f) GDPR). Use of the assistant is based on your consent: it is only activated if you open it and type. We do not keep the conversations. You can withdraw that consent at any time without giving reasons: just close the assistant and stop typing in it. Withdrawing it does not affect the lawfulness of the processing carried out before you withdrew it.
5. Recipients
We do not sell data and we do not profile anyone. Two third parties are involved, and both process the data on our behalf, as data processors. The hosting provider (Hostinger) processes the server's technical logs. Google, if you use the assistant, processes the text you type and the replies, under its data processing addendum. Its terms for the paid tier say that Google does not use the questions or the replies to improve its products. They also say that it logs them for a limited period of time, solely to detect and prevent violations of its prohibited use policy, for the safety and security of the service, and for any disclosures required by law or by regulators. Its page on abuse monitoring specifies that this log is kept for 55 days. It adds that, if its safety filters or abuse detection systems flag a question or a reply, authorised Google employees may review it. According to that same page, the log is not used to train or fine-tune any AI model other than those used specifically to enforce its policies. That is why we insist: do not type personal data into the assistant.
6. If your data leaves Europe
This happens in one case only: if you use the assistant. The text you type reaches Google through its Gemini API. Google may process it in the United States or in other countries where Google or its subprocessors maintain facilities, and that may mean a transfer outside the European Economic Area. Nothing else travels: the call is made by our server, so neither your IP address nor any identifier of yours reaches Google, only the text of the conversation.
The transfer to the United States is covered by an adequacy decision of the European Commission (Article 45 GDPR): Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework. Google's data processing addendum applies that framework to what reaches its certified entities in the United States. Google LLC is listed as an active participant in that framework for non-HR data; this can be checked at dataprivacyframework.gov, where we last verified it on 26 September 2026.
If that certification ever ceased to be active, we would say so here. In the meantime, we still ask you not to type personal data into the assistant: it does not need it, and what is not typed does not travel.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to hola@verigastu.com. In practice, this website holds hardly any data about you to hand over or delete. You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
8. Minors
This site is aimed at people who carry on a self-employed economic activity. It is not aimed at minors and does not knowingly collect data from them.
9. Changes to this policy
If anything relevant changes, this page and the date above are updated.