HolaSam is an educational tax orientation tool for US persons living in Spain, operated from Spain. We are the data controller for personal data processed through this service.
Contact: hello@holasam.app
We collect only what we need to provide the service. Here is what we collect, why, and on what legal basis under GDPR:
| Data | Why we collect it | Lawful basis | How long we keep it |
|---|---|---|---|
| Email address — service use | To send your sign-in link, deliver your snapshot and assessment, and allow you to access your account | Contract / pre-contractual necessity | Duration of account + 30 days after deletion |
| Email address — marketing | To send occasional tax orientation content and HolaSam updates, only if you opt in | Consent (separate opt-in checkbox — withdrawable at any time) | Until you unsubscribe + 30 days |
| Tax profile data (residency, income sources, asset types, etc.) | To generate your triage snapshot and full assessment | Contract (necessary to provide the service) | Duration of account + deletion on request |
| Chat history | To provide context-aware responses in the assessment chat | Contract | 12 months, then anonymised |
| Assessment outputs | To display and persist your assessment results | Contract (contains derived personal data) | Same as chat history |
| Partner share authorisation | To log your explicit consent when you share your snapshot with a named advisor | Legal obligation (GDPR consent record) | Indefinite — proof of authorisation |
| Stripe payment data | To process one-time access pass purchases | Contract + legal obligation | 7 years (Spanish accounting law) |
| Consent records | To demonstrate lawful basis for processing and marketing | Legal obligation | Indefinite |
| IP address / device data | Server-side security and fraud prevention | Legitimate interest | 90 days |
| Cloudflare Analytics (cookieless) | Aggregate site usage — no personal identifiers, no cookies, no cross-site tracking | Legitimate interest (low-friction, privacy-preserving analytics) | Cloudflare default (90 days aggregated) |
| Triage session data (unclaimed) | Anonymous sessions that were not converted to an account | Legitimate interest | 30 days, then deleted automatically |
HolaSam uses Anthropic Claude to generate assessment outputs and chat responses. When you use these features, relevant parts of your tax profile are sent to Anthropic's API as part of the prompt.
Anthropic processes this data as a sub-processor under our instructions. Anthropic's API terms do not permit training on API user data. We have documented this in our internal records of processing.
We do not send more data to the AI than is needed to answer your question.
If you choose to share your snapshot with a partner advisor through HolaSam, we will tell you the name of that advisor before anything is shared. Sharing requires your explicit action — it is never automatic.
Once shared, the advisor receives your triage answers and the contact details you provide. HolaSam logs every share with a timestamp.
The advisor then acts as an independent data controller for their own follow-up. Their privacy practices are governed by their own policies.
We use the following third-party services to operate HolaSam:
| Service | What they process | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (AWS eu-west-1) |
| Anthropic | AI prompt processing for assessments and chat | USA (with EU SCCs) |
| Stripe | Payment processing | USA (with EU SCCs) |
| Cloudflare | CDN, hosting, cookieless analytics | Global |
HolaSam uses only strictly necessary cookies (authentication session management). We do not currently use advertising or analytics cookies.
Our site analytics are provided by Cloudflare Analytics, which is cookieless and does not track you across sites.
If we add analytics or marketing cookies in the future, we will ask for your consent before they are set, via a cookie consent banner.
Under GDPR, you have the right to:
To exercise any of these rights, email hello@holasam.app. We aim to respond within 30 days. You also have the right to lodge a complaint with the Spanish data protection authority ( AEPD).
User data is stored in Supabase with row-level security policies that ensure each user can only access their own data. Access to production data is restricted and logged.
No system is perfectly secure. If you believe your data has been compromised, contact us immediately at hello@holasam.app.
We will update this policy as the product evolves. The version and effective date are shown at the top. If we make material changes that affect how we use your personal data, we will notify you by email if we have a valid address for you.