Skip to content
VERIGASTU

Home · Privacy policy

Privacy policy

This is a courtesy translation. The Spanish version is the one that applies.

Last updated: 15 October 2026

Prefer a video? Your privacy in Verigastu, in just over a minute (YouTube, in Spanish).

This policy explains three different things: what happens when you visit this website, what happens when you buy a read bundle and what happens when you use the app. They are kept separate on purpose, because they do not work the same way.

Who is behind this website

  • Owner: Fiscalidad y procesos automatizados, SL
  • NIF: B22991186
  • Company registration: Inscrita en el Registro Mercantil de Tarragona, sección 8, hoja T-64710, inscripción 1
  • Registered address: Calle Industria 24, 1 · 43800 Valls (Tarragona), España
  • Contact email: hola@verigastu.com
  • Telephone: +34 623 513 354
  • Websites: verigastu.com · verigastu.es · app.verigastu.es

1. When you visit this website

This website uses no cookies of its own, no analytics and no social buttons. The only third-party piece is the anti-bot check on the form (Turnstile, from Cloudflare), which only starts when you begin filling it in and may store and read technical data in your browser for that check: we explain it below.

As on any site, the server that hosts the website (Hostinger) automatically logs technical data about visits – IP address, date, browser – so that it can serve the pages and protect itself against abuse. Those logs are managed by the hosting provider under its own policy.

The form for requesting the code

It is the only place on this website where we ask you for data. We collect your name, your email address and, if you want to tell us, what you do for a living.

  • What for: to reply to you, to assess whether you fit this testing phase and, where appropriate, to send you your access code. For nothing else.
  • Legal basis: your own request – a pre-contractual relationship – and the consent you give by ticking the box on the form.
  • Where it ends up: your request is written to a file on the server where this website is hosted, in a folder that is not accessible from the internet. Every few minutes, a program belonging to the owner and hosted on Google (Google Apps Script) collects the pending requests, sends the email with the instructions from the owner's mailbox and deletes your request from that file. On some very busy days, your request waits in that file until its turn comes, in order of arrival: usually the next day and, exceptionally, a few days more. So as not to send two trial codes to the same mailbox, that program keeps, on Google, which code it has sent to each email address and when; and we record which username, such as “usuario12”, corresponds to each email address, so that we can help you. There is no marketing tool and no list you are added to.
  • How long: for as long as the testing phase lasts and for the time needed to meet legal obligations. You can ask us to delete it whenever you want.
  • What we do not do: we do not send you advertising, we do not sell your data and we do not use it to profile you. What Cloudflare receives when checking that you are a person, and in what capacity, is explained just below.

The server also keeps a hash of your IP address, not the address itself, to curb mass submissions of the form. That hash is still personal data: it is computed without a key, so the IP address it comes from could be worked out by technical means. It stops counting after an hour and is deleted from the file the next time a request is recorded.

Checking that you are a person. To curb automated submissions, the form uses Turnstile, a service from Cloudflare (Cloudflare, Inc., United States). It starts when you begin filling in the form (when you enter one of its fields), not before: if you only read the page, it is not loaded. Turnstile then processes technical signals, such as your IP address, the TLS fingerprint of the connection, your browser's User-Agent header and the website it is used from, to decide whether the person filling it in is human; it almost never asks you to do anything, and at most to tick a box. When you submit it, our server sends Cloudflare the proof of that check and your IP address to confirm it. We do not keep the proof or the result, except when the check fails because of a problem on our side: then we note the reason with your request and a person answers you. According to the Turnstile documentation (consulted on 30 September 2026), Turnstile does not access what you type in the form. Legal basis: our legitimate interest in protecting the form against automated abuse (Article 6(1)(f) of the GDPR). Cloudflare describes this processing in its Turnstile Privacy Addendum (version of 18 June 2025, consulted on 30 September 2026): it says those signals are “strictly necessary” to detect and block bots, and that it processes them as a processor to protect the website and as a controller to improve its bot detection; it does not say how long it keeps them. Its cookie policy (version of 19 October 2023, consulted on 30 September 2026) classes the cookies of its bot-verification products as strictly necessary. You can object to this processing: if you do not want to go through the check, write to us at hola@verigastu.com and we will handle your request by hand.

If you would rather not use the form, write to us directly at hola@verigastu.com: we will handle your message in the same way and for the same purpose.

The first reply you receive is automatic: that program sends it. From then on, a person answers you.

2. When you buy a read bundle

AI reads are bought in prepaid bundles. Payment is made on a checkout page run by Stripe, our payment provider, which you reach from the button on each bundle. We then email you your code or the top-up; the invoice is sent to you by Stripe. If you pay with the payment links we email you, which carry your username, the top-up happens automatically as soon as Stripe collects the payment.

  • What data: your name, your tax ID (NIF), your billing address and your email address, which you enter on the checkout page, and the details of the purchase (which bundle, how much and when). You enter your card details on that same page and Stripe handles them: the full card number does not reach us, and we do not store it.
  • What for: to carry out the purchase and send you what you have paid for; to issue the invoice, which we are required to issue because Article 2.2.a) of the Spanish Invoicing Regulation (Royal Decree 1619/2012) requires an invoice «en todo caso» (in every case) for transactions «en las que el destinatario sea un empresario o profesional que actúe como tal» (in which the recipient is a business or professional acting as such); and to meet our tax and accounting obligations.
  • Legal basis: Article 6(1)(b) of the GDPR, because «el tratamiento es necesario para la ejecución de un contrato en el que el interesado es parte o para la aplicación a petición de este de medidas precontractuales» (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract), and Article 6(1)(c), because «el tratamiento es necesario para el cumplimiento de una obligación legal aplicable al responsable del tratamiento» (processing is necessary for compliance with a legal obligation to which the controller is subject): the obligation to invoice and to keep the invoices.
  • How long: for as long as the law requires us to keep the invoice. Article 19.1 of the Invoicing Regulation requires invoices to be kept «durante el plazo previsto en la Ley 58/2003, de 17 de diciembre, General Tributaria» (for the period laid down in the Spanish General Tax Act), whose Article 66 sets at four years the limitation period for «el derecho de la Administración para determinar la deuda tributaria mediante la oportuna liquidación» (the tax administration's right to determine the tax debt by assessment); and Article 30.1 of the Spanish Commercial Code requires businesses to keep «los libros, correspondencia, documentación y justificantes concernientes a su negocio, debidamente ordenados, durante seis años, a partir del último asiento realizado en los libros» (the books, correspondence, documentation and supporting documents relating to their business, duly ordered, for six years from the last entry made in the books). We keep the invoice, and with it your data, for at least those six years; the rest of the purchase data, for as long as the relationship lasts and as those same obligations require.
  • Where: at Stripe, which collects the payment and generates the invoice, and in our accounting records. When Stripe collects a payment, it notifies the app's server so that it loads the bundle onto your code at that moment. That notice, signed by Stripe, carries all the payment details, including your name, your tax ID, your address and your email address, because Stripe sends it in full and does not let us choose which data it includes; the server neither uses nor stores them. From each payment, all it records is the username, such as “usuario12”, carried by the links in our email (never your name or the code), the bundle, the amount, the date, the Stripe payment reference and whether the top-up happened automatically or by hand; and that a given number of reads were added to your code on a given date. Which username corresponds to each purchase is also recorded in our sales record, so that we can help you.

Stripe has its own privacy policy, at stripe.com/es/privacy (version of 16 January 2026, consulted on 26 September 2026). Its Spanish text says that, «dependiendo de la actividad, Stripe asume la función de “responsable del tratamiento” o “encargado del tratamiento”» (depending on the activity, Stripe acts as controller or as processor), and that, when it acts as processor for a business, it processes the end customer's data «de conformidad con nuestro acuerdo con el Usuario Empresarial y sus instrucciones legales» (in accordance with its agreement with the business and its lawful instructions). The capacity in which it acts at each step of your purchase is set by that policy and by the Stripe terms we accept by using its service; the purposes for which it processes data on its own account, such as fraud detection, are described in that same policy. Some of that data may be processed outside the European Economic Area, with the safeguards described there.

3. When you use the app

The app is built so that your tax data stays on your device. It only passes through our server when the AI reads a supporting document: the server does not store it and passes it on to the AI provider, as explained below. Specifically:

  • No sign-up and no passwords: your code acts as your account. You do not register or create any password: you get in with a personal code that we email to you. That code identifies you, so we treat it as your account. On the app's server each code appears only under a username such as “usuario12”, without your name or your email address, and there is no database of ours holding your expenses: for each code, the server stores only what the last item in this list explains. You can ask us to delete your code and its data whenever you want: we explain how in Delete your code and its data.
  • Your expenses, your photos, your profile and your advances of funds and disbursements ledger – with the name and tax ID of the clients you record in it – are stored on your device, in the browser's own storage.
  • Location is optional. When you take the first photo, the app asks whether you also want to save the place of the expense, as evidence of where it happened. Only if you say yes – and the phone's own permission confirms it – are the coordinates recorded alongside the expense, on your device: they are not sent to any server of ours. You can switch it off whenever you want from the app menu.
  • Your voice does not reach us. We neither receive nor store any audio. The justification you dictate is transcribed by the speech recognition of your browser or your phone — Google's on Chrome and Android, Apple's on iPhone — which, depending on the browser, may process the audio on its maker's servers and under that maker's own terms. Only the text reaches the application, and that text stays on your device. If you prefer, you type the justification instead of dictating it.
  • The supporting document only passes through. For the AI to read a receipt, the image or the PDF is sent to our server, which passes it on to the artificial intelligence provider and does not store it. We send neither your username nor your code along with the document. We do not have a zero-retention agreement with that provider: according to its data retention policy (updated on 1 July 2026 and consulted on 14 October 2026), it deletes them from its systems within 30 days, and if its systems detect a use that breaks its rules it may keep them for up to two years.
  • The backup is yours. If you enable it, it goes to your own Google Drive with the narrowest permission available: the app can only see and manage the files it creates itself, not the rest of your Drive. You can withdraw that permission whenever you want from your Google account. We keep no copy on any server of ours. To connect your Drive, Google sends the authorisation to our server, which exchanges it for the keys to your Drive and returns them to the app without storing them; when they expire, the app asks for new ones the same way, and those are not stored either. Those keys stay on your device, and your files go straight from your device to your Drive, without passing through our server.
  • We only count numbers about usage. To keep count of your reads, to know what the service costs and to curb abuse – applying each code's read limit and being able to cancel one that is used against the terms of use –, the server stores, under each username and never under the code:
    • a hash of the code, which can be used to recognise it without storing it;
    • how many reads it has, how many it has used each month or has had returned, how large they are and which AI model read them;
    • whether it is active or cancelled;
    • its activations, top-ups, adjustments, cancellations and reactivations, with their dates;
    • for each payment Stripe notifies the server of, what section 2 explains: the bundle, the amount, the date, the Stripe payment reference and whether the top-up happened automatically;
    • how many reads it has in progress and, while one is under way, the time until which it is expected, which is deleted when the read finishes (or at the next one, if it is cut off);
    • in the server's technical log, a line with the username and the time for each read (with what it cost), for each check of the code, for each top-up or adjustment and for each payment notice from Stripe; that log is deleted after seven days.
    It does not store the content of any supporting document. Of the code, it stores only the hash; codes created before 1 October 2026 are also still kept, as a fallback, in the server's configuration.

The honest consequence of all this: if you lose your phone and had not enabled the backup, we cannot recover your ledger, because we never had it.

How we protect what passes through our server. Everything travels encrypted (HTTPS), and the app's server tells your browser never to connect to it without encryption (HSTS). On that server, only a hash of your code is kept, never the code itself (except the fallback for codes created before 1 October 2026 explained in the last item of the list); supporting documents are not stored; the technical log is deleted after seven days; and the Drive permission is the narrowest available. Each code's read balance, its activations and top-ups, and what is recorded about each payment are in a database located in the European Union, and viewing or changing them from the app's panel requires the owner's administrator key. Like any server, the app's server receives the IP address of each request. Cloudflare, which hosts it, counts the requests that come from each IP address to the routes that check the code, read supporting documents or connect Drive, and to those of the app's panel, and if more than 10 arrive within 10 seconds, it blocks the following ones for 10 seconds. In its dashboard, Cloudflare shows us, for 31 days, a sample of the requests that the app's server receives, including those that this limit blocks, with their IP address, according to its documentation on security analytics (updated on 15 October 2026) and on security events (updated on 2 October 2026), both consulted on 15 October 2026. We do this on the basis of our legitimate interest in protecting the service against abuse (Article 6(1)(f) of the GDPR), and we do not use your IP address for anything else, nor to find out where you are.

4. Legal basis and retention

The processing of your contact email is based on your own request (pre-contractual relationship and consent). We keep those messages for as long as the relationship lasts and for the time needed to meet legal obligations.

The anti-bot check on the form is based on our legitimate interest (Article 6(1)(f) of the GDPR), as explained in section 1. We do not keep anything from it, except the reason when it fails because of a problem on our side.

The data from a purchase is processed and kept as explained in section 2: contract and legal obligation, and the invoice for the period set by the General Tax Act and the Commercial Code.

What the app's server stores about each code and each payment, as explained in sections 2 and 3, is kept while the code is in use and for at most six years from its last movement, because top-ups are usually linked to invoices; after that it is deleted. If you ask us to delete your code and its data, we delete them sooner, except what is recorded about each payment and the top-ups and adjustments of reads on your code (they are almost always linked to a purchase, and we keep all of them), which are kept for that period, and a marker, without your name or your email address, showing that the code was deleted, which is kept with no time limit so that the code cannot be used again; the details are in Delete your code and its data. What we delete from the server's database remains for up to 30 days after the deletion in its recovery copies, which Cloudflare makes and which expire on their own.

Limiting requests to the app's server by IP address is based on our legitimate interest (Article 6(1)(f) of the GDPR), as explained in section 3; Cloudflare shows in its dashboard, for 31 days, a sample of the requests that server receives, with their IP address.

The data the app stores on your device is kept and deleted by you: the app includes the option to empty the ledger and to delete expenses one by one.

5. Recipients

We do not sell personal data. The only parties involved are the providers needed for the service to work: the web hosting (which hosts this website and the temporary file with your request), Google (which hosts the program that collects the requests and sends the reply email from our mailbox and, if you enable it, your backup on Drive) and the provider of the artificial intelligence that reads the supporting documents, which processes them in order to respond and keeps them for the period explained in section 3: 30 days, or up to two years if its systems detect a use that breaks its rules. If you buy a bundle, Stripe is also involved, as it collects the payment and generates the invoice: what it receives, and in what capacity, is in section 2. Cloudflare also hosts the app's server (the supporting documents read by the AI and the keys to your Drive pass through it without being stored, and it keeps the count of reads for each code; the read balance, activations and top-ups of each code, and what is recorded about each payment, are stored in a Cloudflare database located in the European Union) and runs the anti-bot check on the form. For the app's server it acts as a processor, under its data processing addendum (in force since 3 April 2026, consulted on 30 September 2026); in the anti-bot check, as section 1 explains, it acts as a processor and, to improve its bot detection, as a controller.

Some of that data leaves the European Economic Area. The program that collects the requests and sends the reply email is hosted on Google (Google LLC, United States), and the provider of the artificial intelligence that reads the supporting documents is also outside the EU. Each transfer has its own legal basis. The transfer to Google is covered by an adequacy decision of the European Commission (Article 45 of the GDPR): Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU-US Data Privacy Framework. Google LLC is listed as an active participant in that framework for non-HR data, checked at dataprivacyframework.gov on 24 September 2026. The transfer to the artificial intelligence provider is covered by the European Commission's standard contractual clauses (Article 46(2)(c) of the GDPR and Commission Implementing Decision (EU) 2021/914 of 4 June 2021), which its data processing agreement incorporates, checked on 24 September 2026. The transfer to Cloudflare (Cloudflare, Inc., United States), which hosts the app's server and runs the anti-bot check on the form, is covered by that same adequacy decision: Cloudflare is listed as an active participant in the EU-US Data Privacy Framework (“Active”, with its re-certification under review), checked at dataprivacyframework.gov on 30 September 2026.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to hola@verigastu.com. To delete your access code and the data we hold about it, follow the steps in Delete your code and its data: an email is enough, and we reply within one month at most. If you think we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Bear in mind that, for the data that lives on your device, you exercise access and erasure yourself, directly from the app or by clearing the site data for app.verigastu.es in your browser: we have no copy.

7. Minors

Verigastu is aimed at self-employed professionals of legal age. It is not intended for minors and we do not knowingly collect their data.

8. Changes to this policy

If the product changes in a way that affects this policy, this text will be updated and the new date shown above. The last time was on 15 October 2026, when we explained what Cloudflare does with your IP address to curb abuse and made clear that your tax data only passes through our server when the AI reads a supporting document; we also explained how long what we delete remains in the recovery copies of the database. Before that, on 14 October 2026, we explained that your code acts as your account and how to ask us to delete it, what the program that hands out the codes keeps, how long the artificial intelligence provider keeps the supporting documents and how we protect what passes through our server; on that same day we also explained that Stripe notifies the app's server of each payment, in order to load the bundle at that moment, and what is recorded from that notice.