Privacy policy

Last updated 13.11.2026

Controller: STAYFRITZ SPAIN, S.L.
Tax ID: B26591909
Address: Avenida Central 18, 07180 El Toro, Calvià (Illes Balears), España
Contact: hola@stayfritz.es

What we process

Account: your email address, language and notification settings.
People on your account: document type and number (stored encrypted), first name and surnames, municipality of registration, certificate language, and optionally mobile number and email.
Proof of residence, only if you upload it: a copy of your EU registration certificate, residence card (TIE) or padrón certificate, stored encrypted. Mari attaches it to your requests to the town hall as an additional document; you can remove it at any time.
Authorisation: the name you typed as signature, date and time, IP address, browser, and the version of the text you signed.
Requests: progress log, registration number, the town hall’s receipt and messages, and a screenshot of the e-office page with your document number masked.
Certificates: the PDF issued by the town hall, its validity dates and verification code.
Waitlist and interest lists: your email address and the town or plan you asked about.

Why, and on what legal basis

To request, check, deliver and renew your certificate — performance of our contract with you (Art. 6(1)(b) GDPR).
To keep evidence of your authorisation and of what was filed — our legitimate interest in being able to prove it (Art. 6(1)(f) GDPR).
To email you about new towns and features — only if you switch it on (consent, Art. 6(1)(a) GDPR). You can switch it off in Settings at any time.

Who receives your data

The town hall of your municipality, which receives the request and issues the certificate. Nobody else receives your data for their own purposes. We use these processors under a data processing agreement:

Hetzner Online GmbH, Germany — servers and database, hosted in the EU.
Resend — sending our emails (sign-in links, progress, certificates). Resend may process data outside the EU under the European Commission’s Standard Contractual Clauses.
Anthropic — understanding free-text requests (for example “renew my daughter’s certificate”) and sorting incoming town-hall emails. Document numbers are masked before anything is sent. Anthropic does not use this data to train models.
A Spanish internet access provider (proxy) — carries the encrypted connection to the town hall’s e-office, because the e-office only accepts connections from Spanish networks. It cannot read what is sent.

How long we keep it

Account, people and authorisations: for as long as your account exists.
Certificates and receipts: until the certificate expires plus six months.
Waitlist and interest entries: until the town or plan is available and we have told you, or until you ask us to remove them.
When you delete your account we erase the people on it, their authorisations, requests, certificates and files straight away.

Security

Document numbers and stored files are encrypted at rest. Pages and files are served only to you over HTTPS. We never ask for or store passwords, PINs, Cl@ve or digital certificates.

Cookies

Mari uses one strictly necessary cookie to keep you signed in. There are no analytics, advertising or third-party cookies.

Your rights

You can access, correct, delete, restrict or object to the processing of your data, ask for a copy (Settings → Download my data), and withdraw your authorisation or consent at any time. Write to hola@stayfritz.es. You can also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es).