Privacy policy

Controller

Controller: [LEGAL NAME], tax number [NIF], address [ADDRESS], [CITY]. Email: [EMAIL].

Until those details are published, consumer payments should not be switched on.

What MiCitas does

It is a guide for preparing procedures in Spain and opening the official site. It does not book appointments, it does not sign in to the official site with your credentials and it is not linked to the Government of Spain.

Data that stays on the device

The card (name, NIE, passport, address and the other fields), the wallet and the reminders are encrypted in the browser with WebCrypto. The controller cannot read them. If you clear the site data, they are gone and there is no copy.

Data that is processed

If you subscribe, the server receives the email, the Stripe customer and subscription identifiers, the price, the status and the period end. The basis is the contract.

The contact form processes name, email, province, interest and message only if you tick the box. The basis is consent. You can withdraw it by writing to [EMAIL].

The host may keep technical logs (IP, time, path). The basis is the legitimate interest in keeping the service secure.

Processors

Stripe processes the payment and the tax. Sign their data-processing agreement and turn on Stripe Tax with the business address in Spain.

The subscription is stored in Upstash Redis or Supabase, in a project hosted in the European Union. The service key never goes to the browser.

The expected host is Vercel, or another provider the owner chooses. Check whether data leaves the EEA and, if it does, the safeguard (standard clauses or another mechanism).

Retention

The subscription record is kept while it is live and afterwards for as long as accounting and tax duties require. Contact messages are deleted when the query is closed, unless the law says otherwise.

Rights

You can access, rectify, erase, restrict, object and request portability by writing to [EMAIL]. You can also complain to the Spanish Data Protection Agency: https://www.aepd.es

Children

The service is not aimed at anyone under 18.