Privacy Policy | InmiBot Spain Immigration AI

Last updated: 25 August 2026

This Privacy Policy explains how InmiBot (“I”, “me”, “my”) collects, uses, stores, shares, and protects personal data when you use InmiBot and related services (the “Service”).

I am committed to handling personal data in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR) and, where applicable, Spanish data protection laws.

1. Data controller

Data Controller: InmiBot
Trade name: InmiBot
Contact email: info@inmibot.es

2. What data may be collected

Depending on how you use the Service, I may collect the following categories of personal data:

A. Account and profile data

name
email address
password hash
preferred language
account type or subscription status
account creation date and login-related metadata

B. Chatbot and form-helper data

prompts, questions, and messages you send
responses generated by the Service
information entered into form assistance tools
uploaded files or extracted document text, if uploads are enabled
drafts, saved sessions, and form completion history

C. Immigration/procedural information you choose to provide

This may include:

nationality
residence situation
identity or passport-related information
dates relevant to applications
family situation
employment or education information
administrative case details

You should avoid providing unnecessary personal or highly sensitive data.

D. Appointment monitoring and alert data

selected province, office, procedure, or monitoring preferences
alert subscription status
Telegram username, chat ID, or interaction metadata, where necessary for alert delivery
records of alert delivery attempts or status

E. Technical and usage data

IP address
browser type and version
device and operating system information
app logs
session timestamps
pages or features used
referral URLs
error and performance diagnostics

F. Support communications

emails or messages you send
support requests
bug reports
feedback

3. Sensitive and immigration-related data

Because the Service relates to immigration procedures, some information users provide may be highly personal in practice.

The Service is not intended for the storage of special category personal data unless strictly necessary for the requested feature and supported by an appropriate legal basis.

Users are asked not to submit more personal data than necessary.

4. Purposes of processing

Personal data may be processed for the following purposes:

to create and manage user accounts,
to provide chatbot responses and form assistance,
to save chat history and user sessions where enabled,
to provide cita previa monitoring and related alerts,
to send transactional messages and service notices,
to provide support,
to maintain security, prevent abuse, and detect fraud,
to debug, monitor, and improve service performance,
to comply with legal obligations,
to establish, exercise, or defend legal claims.

5. Legal bases for processing

Depending on the context, the legal bases under GDPR Article 6 may include:

Performance of a contract: to provide the Service you request, including account management, chatbot functionality, form-helper features, and alert delivery.
Legitimate interests: to maintain security, prevent fraud, improve reliability, monitor performance, and respond to support issues, provided those interests are not overridden by your rights and freedoms.
Consent: where required, such as for non-essential cookies or other optional processing.
Legal obligation: where processing is necessary to comply with applicable laws or lawful requests.

6. AI and automated processing

The Service uses AI systems to generate informational responses and assist with document or form preparation.

Please note:

outputs are generated automatically and may be inaccurate,
users should review outputs before relying on them,
the Service is not intended to make legally binding decisions on a user’s behalf,
no solely automated decision-making is used to make decisions with legal or similarly significant effects about users, unless explicitly stated and lawfully permitted.

7. Retention of data

Personal data is kept only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law.

In general:

account data is retained until account deletion, subject to limited retention for security, legal compliance, dispute resolution, or fraud prevention,
chat history and saved sessions are retained until deleted by the user or until account deletion, subject to limited backup retention,
monitoring and alert configurations are retained until disabled by the user or until account deletion,
support communications are retained as long as reasonably necessary to resolve the request and maintain appropriate records,
technical logs are retained for a limited period necessary for security, debugging, and abuse prevention.

8. Deletion rights

Subject to applicable law, users may request deletion of their personal data.

This includes, where applicable:

deleting individual chat sessions,
deleting saved form data,
disabling monitoring and alerts,
deleting the user account.

These rights apply to both free and paid users.

When deletion is requested, relevant data will be deleted or anonymized without undue delay, except where retention is necessary for:

legal compliance,
security,
fraud prevention,
or the establishment, exercise, or defense of legal claims.

Residual copies may remain temporarily in secure backups until overwritten.

Deletion requests may be made:

using in-app deletion tools, where available, or
by contacting: info@inmibot.es

9. Security measures

Appropriate technical and organizational measures are taken to protect personal data.

These may include:

field-level encryption for selected sensitive personal data stored in the system,
encryption in transit using TLS/HTTPS,
access controls based on least privilege,
password hashing,
logging and monitoring for abuse and incidents,
secure backup practices.

No method of transmission or storage is completely secure, and absolute security cannot be guaranteed.

10. Sharing of personal data

Personal data is not sold.

Personal data may be shared with third parties only when necessary to operate the Service, such as:

hosting or cloud infrastructure providers,
database or storage providers,
email delivery providers,
analytics providers, if used,
AI service providers used to process prompts and generate responses,
Telegram, where users choose to receive alerts through Telegram features,
professional advisers such as legal or accounting advisers where necessary,
public authorities or courts where legally required.

These recipients may act either as processors acting on behalf of the controller or as independent controllers, depending on the context.

11. International data transfers

If personal data is transferred outside the European Economic Area (EEA), appropriate safeguards will be used where required, such as:

an adequacy decision,
Standard Contractual Clauses,
or another lawful transfer mechanism.

12. Cookies and similar technologies

Cookies and similar technologies may be used as described in the Cookie Policy.

Strictly necessary cookies may be used without consent where legally permitted. Non-essential cookies will be used only where required consent has been obtained.

13. Your rights

Subject to applicable law, you may have the right to:

access your personal data,
rectify inaccurate data,
erase your data,
restrict processing,
object to certain processing,
withdraw consent at any time where processing is based on consent,
receive a copy of certain data in a portable format,
lodge a complaint with a supervisory authority.

In Spain, the supervisory authority is:

Agencia Española de Protección de Datos (AEPD)
https://www.aepd.es

14. Exercising your rights

You may exercise your rights by contacting:

Email: info@inmibot.es

Reasonable information may be requested to verify identity before processing a request.

15. Children

The Service is not directed to children under 18, and personal data from children is not knowingly collected without appropriate authorization where required by law.

If you believe a child has provided personal data unlawfully, please make contact so appropriate steps can be taken.

16. Third-party platforms and external websites

The Service may direct users to external services, including Telegram and official public administration websites. I am not responsible for the privacy practices of those third parties.

Users should review the relevant third-party privacy notices before using those services.

17. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time. Material changes may be communicated through the website, app, or other appropriate means.

The “Last updated” date at the top of this Policy indicates the latest revision date.

18. Contact

For privacy questions or requests, contact:

InmiBot
Email: info@inmibot.es

Privacy Policy for InmiBot