Privacy Policy
Last updated: April 2026
1. Data controller
IRPF Fácil is a personal project developed by an independent software developer. There is no legal entity or company behind this service.
2. Data processed
IRPF Fácil does not create user profiles or store conversation histories on the server. It uses Google AdSense cookies to fund the service with advertising, subject to your consent.
The only processing that may involve personal data is described in the table below:
| Processing activity | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Rate limiting (anti-abuse) | Anonymised IP (non-reversible HMAC-SHA256 hash) | Prevent service abuse | Legitimate interest — Art. 6.1.f GDPR | Maximum 60 seconds in volatile memory. Not written to disk and cannot be reversed to the original value. |
| Assistant response generation | Question text | Process the query and return an answer about Spanish income tax (IRPF) | Performance of the requested service — Art. 6.1.b GDPR | The question is processed in memory. If the response cache is active, the normalised question and response are stored in a key-value store (Upstash Redis) for up to 1 hour to reduce load on the LLM provider; they are automatically purged on expiry or when the guide is re-ingested. |
| Sending the question to the external LLM provider (only if configured) | Question text | Generate the response using a third-party language model | Performance of the requested service — Art. 6.1.b GDPR | Subject to the privacy policy of the configured LLM provider. The question does not include identifying data about the user. |
| Advertising served by Google AdSense | Cookie identifiers (NID, IDE, __gads, __gpi, _gcl_au), IP address, user agent and page URL | Display ads (personalised if you accept, non-personalised if you reject) and measure their performance | Consent — Art. 6.1.a GDPR (advertising cookies). Legitimate interest — Art. 6.1.f GDPR (non-personalised ads to sustain the service) | Subject to Google's policies (up to 24 months for advertising cookies). See policies.google.com/technologies/cookies. |
| Contact form | Name, email address, subject and message | Respond to the enquiry voluntarily submitted by the user | Consent — Art. 6.1.a GDPR | The message is forwarded to the administrator via SMTP and is not stored on the web server. Subsequent retention depends on the recipient's mailbox. |
Recommendation: do not include personal data (name, tax ID, account number, address, etc.) in questions to the assistant. Queries should be generic questions about Spanish income tax rules.
3. Cookies
This website uses first-party and third-party cookies. Strictly technical cookies are always active; all others are only activated if you accept the cookie notice.
Technical cookies (consent not required — Art. 22.2 LSSI-CE)
Necessary for the site to function. They cannot be disabled.
irpf_consent_v1(localStorage) — stores your decision on this cookie notice (accept/reject).
Advertising cookies — Google AdSense
This site displays ads served by Google AdSense (Google Ireland Ltd.). If you accept, Google may use cookies and similar technologies (NID, IDE, __gads, __gpi, _gcl_au, among others) to show personalised ads and measure their performance. If you reject, Google will serve only non-personalised ads (ads_data_redaction mode) and no advertising targeting cookies will be used.
How Google uses advertising cookies
Analytics cookies — Google Analytics 4 (optional)
If the site administrator enables Google Analytics 4, cookies (_ga, _ga_*) are used to measure traffic in aggregate. Consent Mode v2 is active: no measurement data is sent until you accept cookies.
Managing your consent
You can accept or reject non-technical cookies in the banner that appears the first time you visit the site. To change your decision later, clear the site data in your browser and the notice will be shown again.
International transfers: By accepting advertising or analytics cookies, you authorise the transfer of data to Google LLC in the United States, covered by Chapter V of the GDPR and the EU–US Data Privacy Framework.
4. International transfers
If the service administrator configures an external LLM provider based outside the European Economic Area (e.g., Groq, OpenAI or other US-based providers), the assistant's questions will be sent to that provider. In that case, the transfer will be covered by appropriate safeguards under Chapter V of the GDPR (standard contractual clauses or other recognised mechanisms). No identifying user data is transferred.
If no external LLM provider is configured, no international transfer occurs: all processing takes place on the hosting server.
5. Your rights
Under Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), you may exercise the following rights:
- Access (Art. 15 GDPR): find out what data of yours is being processed.
- Rectification (Art. 16 GDPR): request correction of inaccurate data.
- Erasure (Art. 17 GDPR): request deletion of your data.
- Restriction of processing (Art. 18 GDPR): restrict the use of your data in certain circumstances.
- Data portability (Art. 20 GDPR): receive your data in a structured format.
- Objection (Art. 21 GDPR): object to processing based on legitimate interest.
To exercise any of these rights, use our contact form clearly stating the right you wish to exercise.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
6. Changes to this policy
This policy may be updated if the way the website operates or the applicable regulations change. The date of last update always appears at the top of this page. Material changes will be communicated with a visible notice on the website.