Privacy policy

Plain Spain is the trade name we work under, and Plain Spain is the controller of everything described on this page. The address for anything to do with your data is [email protected]. A person reads that inbox.

We work from Spain, and that is why the GDPR governs this page. The rule follows the controller, not the visitor and not the server: it makes no difference whether you are writing from Denver, Cape Town or Valencia, or which country the machine serving this page sits in.

The eligibility check collects nothing. Your six answers are packed into the page address so the result can be reloaded or sent to your partner, and that is the whole of it. No account, no email address, nothing written to a database of ours.

Writing to us at [email protected] collects exactly what any email collects: the address you wrote from, whatever you chose to tell us, and anything you attached. It lands in our mailbox and stays there like the rest of our mail. Nothing on this site posts a message to our server on the way — your mail leaves your own provider and arrives at ours, and the first we see of it is the message itself.

The other way in is the sign-up form, and it asks for one thing: an email address. Submitting it opens an account and a case in your name and sends you a link to set a password — so unlike writing to us, it does write to our database before you are a client. If you never open the link, what stays is that address, an unopened invitation, and an empty case.

Paying collects less than you would think. Checkout happens on Stripe's own page, so a card number never reaches our server. What comes back to us is the package you bought, how many people it covers, the amount, the email address you paid with, and Stripe's reference for the payment — and, when you tick the box accepting our terms, the version you accepted, the moment you accepted it, and the IP address and browser you accepted from — kept with the payment record as the record of the contract.

A case in the portal is where the real file lives. We hold your account (name, email address, a scrambled form of your password, never the password itself), a sign-in record with the time, your browser's user-agent string and your IP address, the case itself (which visa, which route, the dates that decide things), every person in the household (name, date of birth, nationality, passport number and expiry, NIE once Spain issues one), every document uploaded by you or prepared by us, the messages between us, our own notes on the case, and a log of who did what and when.

Our notes are part of your file. If you ask for a copy of what we hold, they are in it.

A Spanish residence application asks for a criminal-record certificate, a medical certificate, private health insurance, bank statements, and birth or marriage certificates for the household. Some of those get extra protection under the GDPR: the medical certificate and the insurance are health data under Article 9, and the criminal-record certificate falls under Article 10, along with the signed good-conduct declaration the Digital Nomad file adds to it.

We do not hold them on your consent, and we would rather say why than quietly claim one. Consent has to be a free choice, and there is no free choice on offer when no consulate will look at your file without those certificates. What we rely on instead is Article 9(2)(f): special-category data may be handled where it is needed to establish, exercise or defend a legal claim. Your application is the legal claim. You are asking a government to grant you the right to live in Spain, and the immigration regulation it will be judged under is what puts those certificates on the list — they are not an extra we talked you into, they are the claim itself. The criminal-record certificate and the good-conduct declaration sit under Article 10 for the same reason.

So there is no consent here for you to withdraw, and this page is not going to pretend otherwise. What you can always do is tell us to stop: that ends the application, the case closes, and the file then follows the deletion rules further down. What nobody can do is run the application without those documents.

Uploads (any file type, up to 20 MB each) go into an object-storage bucket rather than into the database. In production that bucket is Cloudflare R2. The only route out is the portal's own file handler, which checks on every single request whether the person asking is on that case; an identifier belonging to someone else gets exactly the same answer as one that never existed.

Answering your email: the steps you asked us to take before there is a contract, and our own interest in replying to people who write to us (Article 6(1)(b) and 6(1)(f)).

Running your case, which is the service you bought from us: the contract between us (Article 6(1)(b)).

The medical certificate and the insurance: Article 9(2)(f), because the application they are for is a legal claim and they are what it needs. The criminal-record certificate and the good-conduct declaration: Article 10, on the same footing. Not consent, for the reason given above. All four are used to assemble the application you hired us to assemble, and for nothing else.

Invoices and payment records: a legal obligation we do not get to opt out of (Article 6(1)(c)).

The acceptance record: performing the contract and proving it (Article 6(1)(b)).

Sign-in records: keeping the portal running and hard to abuse (Article 6(1)(f)).

There is no profiling here and no automated decision-making. The eligibility check is a decision tree you run in your own browser, and it leaves no record behind.

The consulate or the Spanish immigration office sees your application when it is filed. That is the point of the exercise, and on most routes it is you who hands it over in person.

A sworn translator (traductor jurado) sees the documents that need translating, and only those. Spain requires the translation to be certified by a translator on the Foreign Ministry's list, so this step cannot be done in-house.

Four suppliers touch data on our behalf: a payment processor for checkout (Stripe), an email service for the messages the portal sends (Resend), the host our server runs on, and Cloudflare, which does two jobs rather than one — it stores your uploaded documents (R2) and it is also the network your request reaches us through, which means it terminates the encryption on every page of this site, the portal included. Analytics is a fifth, but only where the deployment has it switched on: it is Plausible, which sets no cookie and stores no identifier, and where it is not configured no analytics script loads at all.

That is the complete list. No advertising networks, no data brokers, no lead resale. We do not sell your data, and there is no version of this business in which that would make sense.

Some of those suppliers process data outside the EU. We use a supplier only where its data-processing terms carry the European Commission's standard contractual clauses for such transfers.

Email to us: until it stops being useful. Ask, and we delete yours.

Your documents: five years from the day your case closes, and then they are deleted. Five years rather than five months because renewals reuse most of the same documents and people do come back for one.

The medical certificate, the criminal-record certificate and the good-conduct declaration go sooner than that. Once the authority has decided, they have done the job they were collected for, so the portal deletes them within a day of the decision being recorded. If an appeal is running they stay until it is finished, because that is still the same claim. Keep your own copies before that deletion. Whether a certificate can be reused for a later application depends on the document and filing office; deletion from this portal does not mean it has expired.

Those two rules run once a day, on their own, and what they delete is documents: the stored file, plus the record saying which version it was, so the case history still shows that a document was there and the day it went. The case itself is not on a timer — the applicant details it was built on, the messages and the payment records stay until a person decides otherwise, which is why the portal's account page has a button that opens a request rather than one that pretends to erase a file on the spot.

What "Request account deletion" does, precisely: a colleague deletes every document on the account from storage, and your sign-in details — name, email address and password — are overwritten, so the account can no longer be used or traced back to you. The case record behind it stays: the applicant details the file was built on, the messages, the appointments and the payment records. If you want those gone as well, write and say so. A person answers that one, because it is a judgement about obligations that outlive an account rather than something a button can decide.

Payment and invoice records: as long as Spanish commercial and tax law obliges us to keep them. That is longer than either of us would choose, and it is not a choice we have.

Sessions: a portal session lasts thirty days from sign-in, however often it is used. Signing out deletes it on the spot.

You can ask for a copy of what we hold, have it corrected, have it deleted, have its use restricted, take it elsewhere in a portable form, and object to us holding it. There is no consent on this page to withdraw, because nothing here runs on one — the bases are the contract between us and the ones listed above it.

Two of those already have buttons. Your account page in the portal has "Download all my documents", which builds a ZIP of everything you uploaded and everything we prepared, and "Request account deletion", which opens a request a person answers within five working days.

For anything else, write to [email protected]. We answer within a month. Article 12(3) lets a controller extend that by two further months for a genuinely complicated request; if we ever have to, we will tell you inside the first month and say why.

We may ask you to prove who you are before we hand over a file full of passports and bank statements. That check protects you, not us.

Tell us first, at [email protected]. Most of what goes wrong with data is a mistake somebody can fix the same day.

If that gets you nowhere, you can complain to the Agencia Española de Protección de Datos, Spain's supervisory authority, at aepd.es. Article 77 also lets you complain to the authority where you live or work, which for most of our clients is closer to hand than Madrid.

The date at the top is the date this text last changed. If we change something that affects a case in progress, we email the people it affects instead of leaving you to find it here.