Privacy Policy

The controller of your personal data is:

TRIBUTAI has appointed an external and independent Data Protection Officer (DPO), the firm LetsLaw, which oversees the processing of personal data. You can contact the DPO at the mailbox dpo@tributai.es, which is only for data protection. For everything else, write to soporte@tributai.es.

To exercise any of the rights recognised by the GDPR (access, rectification, erasure, restriction, portability, objection, not to be subject to automated decisions — Art. 22), write to the DPO at dpo@tributai.es or use the form at /data-rights. We will reply within a maximum of one month (Art. 12 GDPR).

The processing of your data is based on the following legal bases provided for in article 6 of the GDPR:

• Performance of a contract (Art. 6.1.b): Your data is necessary to provide you with the contracted services.
• Compliance with legal obligations (Art. 6.1.c): We must keep certain data because of tax and commercial obligations.
• Legitimate interest (Art. 6.1.f): To improve the service, for security and to prevent fraud.
• Consent (Art. 6.1.a): For commercial communications and non-essential cookies.

We process your personal data for the following purposes:

1. User account management: Creating and maintaining your account on the Platform.
2. Provision of services: Processing registrations, tax returns and the other contracted services.
3. Invoicing and payments: Managing payments for the contracted services.
4. Service communications: Sending you relevant information about your account and services.
5. Customer support: Answering your queries and complaints.
6. Service improvement: Analysing use of the Platform to improve the experience.
7. Security: Preventing fraud and unauthorised access.
8. Legal compliance: Responding to requests from competent authorities.

Your data may be disclosed to the following recipients:

Your data is stored mainly on servers located in the European Union (Google Cloud Platform - europe-west1 region, Belgium).

Your data is stored in the European Union. Claude (Anthropic) through Google Cloud Vertex AI, processed in the European Union: the eu multi-region and, as a fallback, the europe-west1 region (Belgium). Queries to the AI model are not processed outside the EU. We have a data processing agreement (DPA) with the provider, which does not use the queries to train its models. In the case of other transfers to third countries (such as the USA for SendGrid services, Google/Microsoft social authentication, or Stripe for payments), these are made under:

• Adequacy decision: EU-US Data Privacy Framework for certified companies.
• Standard contractual clauses: Approved by the European Commission.
• Supplementary measures: Encryption and pseudonymisation where applicable.

You can request detailed information about the applicable safeguards by contacting dpo@tributai.es.

We keep your data for the following periods:

TributAI implements technical and organisational measures to protect your data:

In the event of a security breach affecting your data, we will notify you within a maximum of 72 hours in accordance with the GDPR.

The GDPR recognises the following rights over your personal data:

To exercise any of these rights, contact us at dpo@tributai.es attaching a copy of your DNI/NIE. We will reply within one month, extendable by two more months in complex cases (art. 12.3 GDPR).

If you consider that we have not dealt with your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es

TributAI uses artificial intelligence technology (Claude by Anthropic, as well as Google Vertex AI / Vision API / Document AI for document OCR) to assist with tax queries and process documentation. The logic applied, its importance and consequences are explained below:

Profiling

We generate internal profiles to personalise the assistant and improve the experience. These profiles may include:

• Your tax regime, CNAE/IAE, type of activity and formal obligations.
• History of queries and procedures with TributAI.
• Aggregated signals for anti-fraud detection (device fingerprinting, IP geolocation).

Automated decisions (Art. 22.1 GDPR)

• We do not take automated decisions with binding legal effects. All official procedures (Form 036, returns 303 / 130 / 111, self-employed registration) are reviewed and validated by qualified human staff before they are submitted to the AEAT or TGSS.
• The AI assistant’s answers are for guidance only and do not constitute binding professional advice.
• Automated decisions that we do carry out without immediate human intervention (always with a right to subsequent human review): anti-fraud checks / crypto-sensitive step-up, temporary blocking after anomalous access attempts, limiting use according to consumption of the plan taken out.

Your specific rights regarding AI

• Right to human intervention (Art. 22.3): at any time you can ask a technician to manually review any recommendation or block, by writing to dpo@tributai.es.
• Right to object to profiling (Art. 21.1): you can object to profiling based on legitimate interest from the same email.
• Right to contest the decision: you can express your disagreement with a decision and obtain a human explanation.

TributAI may update this Privacy Policy to reflect changes in our practices or in the applicable legislation.

We will notify you of any material change by email or through a prominent notice on the Platform before it takes effect.

We recommend reviewing this page periodically to stay informed about how we protect your information.