Privacy policy
Last updated: 6 November 2026
1. Data controller
FIREFISH ESPAÑA, S.L., NIF B56627821, with address at Calle Marie Curie 8, 3-1, 28703 San Sebastián de los Reyes, Madrid. Contact email: [email protected].
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name and email | Create and maintain the account, authenticate access and send service notices | Performance of the contract (art. 6.1.b GDPR) |
| Data entered on documents: loader and carrier identification, tax ID, address, registrations, origin, destination and goods | Generate, host and keep the control document | Performance of the contract (art. 6.1.b GDPR) |
| Billing and payment data | Charge the subscription and meet tax obligations | Performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR) |
| IP address, user agent and session date | Account security and prevention of unauthorised access | Legitimate interest (art. 6.1.f GDPR) |
| Images or documents the user uploads for automatic delivery-note reading (only if that feature is used) | Read the delivery note and fill in the form with the extracted data, which the user reviews before issuing | Performance of the contract (art. 6.1.b GDPR) |
| Telegram identifiers (only if the user links them) | Notify of issued documents and allow creating them from the chat | Performance of the contract (art. 6.1.b GDPR) |
| Browsing and advertising-campaign data (measurement and advertising cookies) | Measure site usage and the effectiveness of advertising | Consent (Art. 6.1.a GDPR) |
| Phone notification identifier and language (only if the user turns on alerts in the mobile app) | Send the phone an alert for each document issued | Consent (Art. 6(1)(a) GDPR): the user turns alerts on and can withdraw them in the phone settings or by signing out |
| Name, national ID/NIE/identity document number, remarks, signature stroke, date and time, and a hash of the IP address and browser of the person who signs for the receipt of goods (only if the user requests that proof of delivery) | Generating the signed proof of delivery and identifying the person who receives the goods | Legitimate interest of the document holder in proving delivery (Art. 6.1.f GDPR); El DeCA acts as data processor |
| Email address of the person signing for receipt (optional) | Sending them a copy of the proof of delivery | Consent (Art. 6.1.a GDPR): provided voluntarily when signing |
Data appearing on a control document may relate to third parties (for example, a loader who is a private individual). In that case the user acts as the controller of that data and El DeCA as the processor, limited to processing it according to the user's instructions in order to provide the service. The same applies to the data of the person who signs a proof of delivery: El DeCA processes it on behalf of the user who holds the document, who decides to request the signature. The signer is informed on the form itself.
3. How long we keep it
- Account data: while the account is active and, afterwards, for the limitation periods of any potential liabilities.
- Issued documents: at least one year from the date of the transport they document, so the user can meet their retention obligation. They may be deleted afterwards.
- Billing data: the periods required by tax and commercial regulations.
- Access logs: a limited period, for security purposes.
- Delivery-note reading from the mobile app: the extracted data is kept for 24 hours so you can review it and is deleted afterwards; the image is not kept.
- Notification identifier: while the app remains registered on that phone; it is deactivated when you sign out and stops being used if the phone does not connect for a few days.
- Signed proofs of delivery: kept alongside the document they accompany and for the same period. The signer's optional email is used to send them their copy and remains in the account's email delivery log.
4. Visibility of documents
Every issued document remains accessible at a web address that doesn't require logging in. This is a transport regulation requirement: the document must be directly downloadable when its QR code is scanned.
Those addresses contain a random fourteen-character code, are neither predictable nor enumerable, and are excluded from search engines via robots.txt and the X-Robots-Tag header. robots.txt X-Robots-Tag. Whoever has the link or the QR code can see the document: that's what allows it to work during an inspection. The same applies to the link to the signed proof of delivery: in that public version the recipient's ID number is partially hidden, and the full original is only visible to the document holder when logged in.
5. Recipients
No data is sold or transferred to third parties. It is only shared with the providers needed to deliver the service, who act as data processors, and — only if you accept the corresponding cookies — with measurement and advertising providers:
| Provider | Purpose | Location |
|---|---|---|
| Railway Corp. | Hosting of the application and database | United States / EU |
| Cloudflare, Inc. | Content delivery network and security | United States / EU |
| Resend, Inc. | Transactional email delivery | European Union (eu-west-1) |
| Stripe Payments Europe, Ltd. | Subscription payment processing | Ireland |
| Anthropic, PBC | Automatic reading of delivery notes and the help assistant (only if the user uses those features) | United States |
| Factúrate | Issuing the invoices for the service | Spain |
| Telegram | Notifications and document creation by messaging (only if the user activates that channel) | Various, including countries outside the EEA |
| Google Ireland Ltd. | Visit measurement and advertising (only with consent) | Ireland / United States |
| Expo (650 Industries, Inc.) | Push notification service for the mobile app (only if the user turns on alerts) | United States |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications on Android phones (only if the user turns on alerts) | United States |
| Apple Inc. (Apple Push Notification service) | Delivery of push notifications on iPhone (only if the user turns on alerts) | United States |
When any transfer involves countries outside the European Economic Area, it relies on the safeguards set out in Chapter V of the GDPR, such as the European Commission's standard contractual clauses.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [email protected].
Note that deleting documents already issued may be limited while your own legal obligation to keep them still applies.
If you believe the processing doesn't comply with the regulation, you can file a complaint with the Agencia Española de Protección de Datos (aepd.es).
7. Cookies
See the cookie policy.