Privacy Policy

LeyApp S.L., domiciled in Spain. Contact: privacy@leyapp.es

We collect: registration data (name, email, encrypted password), professional profile data (bar membership number, specialties, languages, rates), usage data (pages visited, access times), and payment data (processed by Stripe — we do not store card details).

We use your data to: manage your account, connect clients with lawyers, process bookings and payments, verify bar memberships, send service communications, and improve the platform.

We process your data based on: contract performance (Art. 6.1.b GDPR), consent (Art. 6.1.a), legitimate interest (Art. 6.1.f) for service improvements, and legal obligations (Art. 6.1.c).

We retain your data while your account remains active. After account deletion, we keep legally required data for the mandatory period (at least 6 years for accounting and tax records, under Article 30 of the Spanish Commercial Code). Messages you exchange with the LeyApp team in the live support chat are deleted one year after the chat is closed.

You can delete your account in Settings or in the mobile app. You must confirm your identity first (password, or a code sent by email), and you cannot delete it while bookings, payments, refunds, complaints or payment disputes are still open, or while you own an organisation. Your account is deactivated straight away and you are signed out on every device; a lawyer profile is hidden from search. You have 30 days to restore it by signing in or using the link in our email; we remind you 7 days and 1 day before. After 30 days we erase your name, email, phone, saved payment methods, profile photo, verification documents and devices, and we send a final email. We keep booking, payment and invoice records for 6 years (Article 30 of the Spanish Commercial Code), linked to an anonymous account; invoices keep the name and tax details they were issued with. Chat messages are kept for up to 5 years for the defence of legal claims. Lawyers you consulted keep their own case records under their professional duties. If an account was banned or suspended when it was deleted, we keep a one-way hash of its email address to prevent it from registering again.

You have the right to: access your data, rectify it, erase it (right to be forgotten), restrict or object to processing, and data portability. Contact: privacy@leyapp.es

LeyApp is intended for users aged 14 or older. In Spain, a person aged 14 or over can consent to the processing of their own personal data (Article 7 of Organic Law 3/2018, LOPDGDD; see also Article 8 GDPR). If you are between 14 and 18, you may register and book consultations, but some services may require authorisation from a parent or legal guardian. If you are under 14, you may not use LeyApp directly; a parent, guardian or other legal representative must act on your behalf.

Guardian consent records. When a booking or a sponsorship is made on behalf of a minor or a person under legal representation, we record the representative's name, the type and number of their identity document, the date and time of the consent and the IP address it was given from (for bookings, in shortened form), so that we can demonstrate that consent was given (Article 7(1) GDPR). We keep these identifying details for five years from the date the consent was recorded and then erase them. This period matches the general five-year limitation period for personal claims in Spain (Article 1964.2 of the Civil Code) and covers the three-year limitation period for the most serious data-protection infringements (Article 72 LOPDGDD).

Sponsored consultations for minors or persons under legal representation are also covered by our Sponsored Consultation Terms.

We use essential cookies for site functionality and authentication. We do not use third-party tracking or advertising cookies. Because we only use Essential Cookies right now, you do not have to accept tracking or advertising scripts on our banner. If we ever add analytics, the banner will give you a clear 'Reject All' button. See our cookie policy for details.

Our main database is hosted in the European Union (Supabase, Paris region, France). Some of the providers listed under "Sub-Processors" are established in, or process data in, countries outside the European Economic Area, mainly the United States. When personal data is transferred outside the EEA, we rely on one of these safeguards:

- EU–US Data Privacy Framework (DPF): transfers to US companies certified under the DPF are covered by the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795).

- Standard Contractual Clauses (SCCs): the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, included in the provider's data processing agreement.

Video and voice calls (Daily). The server of every call is in Daily's Frankfurt (Germany) region, but Daily processes usage and technical data about calls in the United States and uses sub-processors there. Daily, Co. appears as an active participant on the Data Privacy Framework List, and its data processing agreement includes SCCs for any transfer the DPF does not cover. See "Video and Voice Calls".

The safeguard used for each provider is shown in the list below. You can ask us for more information about these safeguards at privacy@leyapp.es.

We use the service providers below to run LeyApp. Most act as processors on our behalf under a data processing agreement (Article 28 GDPR); where a provider acts as an independent controller, we say so. For each one we show what it does, what personal data it receives, where it processes it and the transfer safeguard (see "International Transfers").

Infrastructure

Supabase Inc. — database, user authentication and file storage. Data: all account, profile, booking, message and document data. Location: EU (Paris, France). Supabase Inc. is a US company; any access from outside the EEA is covered by SCCs.

Vercel Inc. — website hosting, server functions and content delivery. Data: IP address, technical request data and logs, and the content of requests our servers process. Location: global network; Vercel's main processing facilities are in the United States. Safeguard: DPF and SCCs. If you accept analytics cookies, Vercel Web Analytics and Speed Insights also receive page-view and performance data.

Upstash, Inc. — rate limiting and short-lived counters that protect the platform from abuse. Data: IP addresses and user identifiers used as counter keys, which expire after at most 24 hours. Safeguard: SCCs.

Functional Software, Inc. (Sentry) — error monitoring. Data: technical error data, IP address, browser and device information, and short session replays in which on-screen text and form inputs are masked. Location: EU (Frankfurt, Germany) for error data; account metadata in the United States. Safeguard: DPF and SCCs.

Cloudflare, Inc. (Turnstile) — bot protection on some forms. Data: IP address, browser (user-agent) and connection information. Safeguard: DPF and SCCs.

Payments

Stripe Payments Europe, Ltd. (Ireland) — card and other online payments, fraud prevention and payouts to lawyers. Data: name, e-mail, payment-method details (entered directly with Stripe; we never see full card numbers), amounts, booking reference, IP address and device data. Transfers to Stripe, Inc. (United States): DPF and SCCs.

Redsys Servicios de Procesamiento, S.L. (Spain) — Bizum payments. Data: Bizum phone number, amount and order reference. Location: Spain.

Klarna Bank AB (publ) (Sweden) — only if you choose to pay with Klarna where it is offered. Klarna processes your data under its own privacy notice.

Communications

Resend (Plus Five Five, Inc.) — sending transactional e-mails. Data: e-mail address, name and e-mail content (for example booking details), plus delivery events. Location: United States. Safeguard: DPF and SCCs.

Push notification services — if you enable browser notifications, they are delivered through the push service of your browser's vendor (for example Google, Mozilla, Apple or Microsoft). The notification content is encrypted so that only your browser can read it.

Daily (Daily, Co., United States) — in-app video and voice calls: consultations booked as a video or voice call, and video calls for product demonstrations that we hold with people who request one. Data: the name shown in the call, a pseudonymous user identifier and random identifiers for the call room and session; IP address and device, browser and network data needed to connect the call and measure its quality, and technical error reports from Daily's call software; and the audio, video and screen-sharing streams while the call takes place, which are not recorded. Location: we set the server of every call to Daily's Frankfurt (Germany) region; with our current set-up, audio and video travel directly between the participants' devices or, if that is not possible, through relay servers of Daily's network providers (Cloudflare and Twilio). Daily states that its primary processing operations take place in the United States, and it lists the United States as the location of all the sub-processors of its video service (see "Video and Voice Calls"). Safeguard: DPF; Daily's data processing agreement, which forms part of its terms of service, provides for SCCs where the DPF does not apply. For the usage data it collects to operate, secure and optimise its service (for example, logs of connections and activity), Daily acts as an independent controller under its own privacy policy.

Sign-in, calendars, maps and translation

Google LLC — Sign in with Google (if you choose it), Google Calendar sync for lawyers who connect it, and address autocomplete (Google Maps Platform). Data: see "Third-Party API Services"; for address autocomplete, the text you type in the address field. Google acts as an independent controller for Google Maps Platform. Safeguard: DPF.

Microsoft Corporation — Sign in with Microsoft (if you choose it) and Outlook calendar sync for lawyers who connect it. Data: name and e-mail address; for calendar sync, the start and end times of calendar events and the LeyApp consultations we add to the calendar. Safeguard: DPF.

Apple (Apple Distribution International Ltd., Ireland) — Sign in with Apple (if you choose it). Data: name and e-mail address (or Apple's relay address). Apple's onward transfers are covered by SCCs.

DeepL SE (Germany) — machine translation of messages in the live support chat, only when you or our team use the translate option. Data: the text of the message being translated. Location: EEA. We currently use DeepL's free API, under whose terms DeepL may use the submitted text to improve its services.

Artificial intelligence

Anthropic (Anthropic Ireland, Ltd.; processing by Anthropic PBC in the United States) — the AI assistant and AI search suggestions (see "AI Assistant and Live Support Chat"). Data: the text of your messages to the assistant and limited context, or the text of your search. Safeguard: SCCs.

Mistral AI (France) and OpenAI (OpenAI Ireland Ltd.; processing in the United States) — standby AI providers, used only if Anthropic is unavailable. Data: as for Anthropic. Safeguard for OpenAI: SCCs.

Public authorities

Where the law requires it, we send invoice records to the Spanish Tax Agency (Agencia Estatal de Administración Tributaria). It receives them as a public authority, not as our service provider.

We will update this list when we add or replace a provider, and we will change the "Last updated" date at the top of this policy. You can ask for a copy of the relevant safeguards at privacy@leyapp.es.

We protect your data with SSL/TLS encryption, hashed passwords, data isolation via Row-Level Security (a database feature ensuring your data can only be seen by you and your authorized lawyer), and encrypted backups.

LeyApp uses Google APIs for two purposes:

1. Sign-in with Google (OAuth). When you choose to sign in with Google, we request the `email` and `profile` scopes to create and authenticate your LeyApp account. We store your email address, full name, and profile picture URL.

2. Google Calendar sync (optional, lawyer feature). When a verified lawyer chooses to connect their Google Calendar from LeyApp Settings, we request two additional scopes: - `https://www.googleapis.com/auth/calendar.readonly` — to read existing events on the connected calendar so we can mark those time slots as busy in LeyApp and prevent double-bookings. - `https://www.googleapis.com/auth/calendar.events` — to create a single calendar event for each LeyApp consultation that the lawyer accepts. The event title is `LeyApp: Consulta con [client name]`, the description is `Consulta reservada a través de LeyApp`, and the start and end times are set in Spain's peninsular time zone (Europe/Madrid).

Data handling. We do NOT store the content, attendees, or descriptions of the calendar events we read — only the start and end times needed to mark slots as busy. We do NOT share Google user data with any third party, do NOT use it for advertising, do NOT sell it, and do NOT use it for any purpose other than the calendar sync feature you explicitly enabled. Access tokens and refresh tokens are stored in our database encrypted at rest.

Revocation. A lawyer can disconnect their calendar at any time from LeyApp Settings → Calendar, which immediately deletes the stored tokens. They can also revoke LeyApp's access from https://myaccount.google.com/permissions at any time.

LeyApp's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

AI assistant. The assistant in the Help panel is an AI system, not a person. It answers questions about the platform and does not give legal advice.

- Where your conversation is kept. Only in your browser's local storage: up to the last 50 messages, for 24 hours from your last message, so that it survives page changes. Ending the conversation deletes it. LeyApp does not store the conversation on its servers and does not e-mail you a copy; you can save one yourself with the share button.

- What is sent to the AI provider. To generate each answer we send the last 12 messages of the conversation, your interface language, whether you are using LeyApp as a client, lawyer or administrator, and which section of the site you are on. We do not send your name or e-mail address. Our provider is Anthropic; if it is unavailable, the request may go to a standby provider (Mistral AI or OpenAI). See "Sub-Processors".

- What the providers do with it. Anthropic does not use our requests to train its models and deletes them within 30 days, unless they are flagged for a breach of its usage policy, in which case it may keep them for up to 2 years. OpenAI does not use requests sent through its API to train its models and keeps them for up to 30 days for abuse monitoring.

- What we log. For each answer our servers record only technical usage data (number of tokens, estimated cost and the model used), not the content of your messages. To prevent abuse, we keep message counters: per-minute counters keyed by IP address, and daily counters keyed by your user identifier if you are signed in. They expire after at most 24 hours.

- AI search suggestions. If a lawyer search returns no results, the text you typed in the search box may be sent to Anthropic to suggest other searches.

Talking to a person (live support). Where this option is available and you are signed in, you can ask the assistant to put you in touch with the LeyApp team.

- Your messages with the team are stored in our database (Supabase, EU) and can be read by you and by LeyApp administrators. If you tick the box to share your conversation with the assistant (it is unticked by default), its last 10 messages, up to 4,000 characters, are attached.

- A chat with no new messages for 7 days is closed automatically. The content of the messages, and any attached assistant conversation, is deleted one year after the chat is closed; we keep only a record of who took part and when.

- If you or a team member use the translate option, the text of that message is sent to DeepL.

- If nobody is available and you leave a message instead, it is saved as a support ticket (including the shared assistant conversation, if you ticked the box) and we reply by e-mail.

Legal basis. Answering your questions and handling your support requests is necessary to provide the service you ask for (Article 6(1)(b) GDPR); for visitors without an account, it is based on our legitimate interest in helping people use the platform (Article 6(1)(f) GDPR).

In short: neither LeyApp nor our call provider records your calls; we keep a record of who joined and for how long; and, because the two devices connect directly, each participant's device receives the other's IP address.

When a lawyer offers it, a consultation can be held as a video or voice call inside LeyApp. We also use the same tool for product demonstrations with people who request one. Calls run through our provider Daily (see "Sub-Processors").

What we do not do. We do not record, transcribe or caption calls. Recording, transcription and captions are not enabled for any call room, and no participant receives the permissions needed to turn them on. LeyApp staff cannot join calls. Participants must not record a call without the consent of everyone else in it (see the Terms of Service).

What is processed during a call.

- Your name as shown on your LeyApp profile (for a demonstration, the name you gave us) and a pseudonymous identifier. We send them to Daily when you join.

- Your IP address and device, browser and network data, which Daily needs to connect the call and measure its quality. Daily's call software also sends technical error reports to Daily.

- Your audio, your video and any screen you share. They are transmitted in real time, encrypted in transit, and not stored.

- If you use "Check my connection" before joining, a short test stream (up to 30 seconds) is sent to Daily's servers to measure your connection.

How calls are connected, and your IP address. We set the server of every call to Daily's Frankfurt (Germany) region. With our current set-up, the audio and video travel directly between the two devices (peer-to-peer); if a direct connection is not possible, the encrypted streams are relayed through servers of Daily's network providers (Cloudflare and Twilio). Because the devices connect directly, each participant's device receives the other's IP address, from which an approximate location or the internet provider can sometimes be inferred. This is a platform setting and cannot be changed from the call. If you do not want to share your IP address with the other participant, choose another type of consultation that the lawyer offers. We remind you of this on the screen before you join.

What LeyApp keeps (the call record). For each consultation call we store who was invited and in what role, when each person joined and left, how long they were in the call, the kind of device (web, iOS or Android), how the call ended, technical events such as reconnections, reminders sent to the other participant and errors, an overall connection-quality summary, any rating you give at the end, and the date and version of the call information you confirmed before joining. Daily sends us the join and leave times. After the call, a one-line summary (type of call, duration and, where known, the name of the person who ended it or did not join) is added to the booking chat. To investigate abuse, we also store a shortened version of your IP address (with the last part removed) each time you ask to join; it is deleted automatically after 30 days. For a demonstration, we keep only the name and expiry time of the call room and the time and version of your confirmation, with your demonstration request.

Who can see the call record. The call record belongs to the booking and can be seen by the people who can see the booking: the client, the lawyer, members of the lawyer's team who have access to the lawyer's bookings, the sponsor if the consultation is sponsored, and LeyApp administrators. Only administrators see the shortened IP addresses, failed attempts to join, the connection-quality summary and the ratings.

Chat during a call. The chat in the call is the booking conversation. Messages and files sent there are ordinary booking messages and follow the same rules (see "Deleting Your Account"); the call does not create a separate chat.

How long we keep it. The call record is kept for as long as the booking it belongs to (see "Data Retention" and "Deleting Your Account"). The shortened IP address is deleted after 30 days.

Legal basis. Connecting you to the call and transmitting it is necessary to provide the consultation service you booked under our Terms of Service (Article 6(1)(b) GDPR); for a demonstration, it is a step you asked us to take before entering into a contract (also Article 6(1)(b)). We keep the call record, the ratings and the shortened IP address on the basis of our legitimate interest in being able to show whether a consultation took place, resolving disputes about it, keeping calls working well and preventing abuse (Article 6(1)(f) GDPR). You can object to processing based on legitimate interest by writing to privacy@leyapp.es (Article 21 GDPR).

When a third party ("Sponsor") pays for your legal consultation through LeyApp, additional data processing applies.

Legal basis: Your explicit consent (GDPR Art. 6(1)(a)). You must actively accept the sponsorship invitation and set your privacy preferences before any data is shared with the Sponsor.

Data shared with Sponsors: Only what you permit. Payment confirmation is always visible to the Sponsor. Booking status updates are shared only if you allow it. Specific lawyer progress notes are shared only if you allow it AND the lawyer explicitly chooses to share each individual note ("double-gate" model). Internal notes, document requests, and your private communications with the lawyer are never shared with the Sponsor.

Your rights: You may withdraw consent at any time by revoking the sponsorship from your dashboard. This immediately stops all data sharing with that Sponsor. You may also request access to all data shared with your Sponsor, or request deletion of sponsorship records (subject to legal retention requirements).

Retention: Sponsorship data is retained for 90 days after the last sponsored consultation is completed, then anonymized. Audit logs are retained for 6 years under Spanish commercial record-keeping rules (Commercial Code, Article 30).

Anti-coercion protections: If you decline a sponsorship invitation, no reason is shared with the Sponsor. After declining or revoking, the same Sponsor cannot send you a new invitation for 90 days.

For privacy concerns about sponsored consultations, contact our Data Protection Officer at dpo@leyapp.es.

To exercise your rights or for privacy enquiries: privacy@leyapp.es. You may file a complaint with the Spanish DPA (AEPD) at agpd.es.