Privacy policy
Who processes your data, which data, why, and what you can do about it. qualifica.ad collects the minimum the service needs to work: no advertising, no analytics, and nothing sold or shared.
Last updated: September 17, 2026
Who is responsible
The service is published and operated by an Andorran company, which decides why and how the data described on this page is processed. For anything about this policy or about your rights, write to the address below.
What we process
Opening an account takes an e-mail address and nothing else. You may add a first and last name, your organization's name, the interface language and a logo for white-label reports. Every simulation you run is filed on your dashboard with the figures you entered and the result computed from them: attributes of the purchase — buyer type, residence status, property value, intended use — never identity documents and never the seller's details. The label you give a file is free text, so what goes in it is up to you. The server's logs also hold the IP address of requests, which we use to rate-limit sign-ins and simulations.
What we use it for
To sign you in without a password, to run and file your simulations, to produce their PDF reports, to answer your messages and — once payment is live — to invoice the service and keep the accounts. Nothing else: no profiling, no advertising, no marketing mail.
Legal basis
Processing is carried out under Llei 29/2021, of 28 October, the qualified law on personal data protection. Account data and saved simulations are necessary to perform the software licence you accept when you open an account; the short-lived record of IP addresses rests on the legitimate interest in protecting the service from abuse; and keeping invoices is a legal obligation.
What is filed and what is not
Running a simulation takes an account, and every simulation you run is filed on your dashboard — that is what the files are for. What is stored nowhere is anything computed without an account: the public demonstration, and any API call made without signing in. The result is returned and no copy is kept, of either the figures entered or the calculation.
For how long
Account data and filed simulations are kept for as long as the account exists. There is no automatic deletion by age: if you want a file or the whole account erased, ask and we will do it. The sign-in link you receive by e-mail expires after fifteen minutes and works once; a session lasts thirty days from the last time you use it, and can be ended whenever you like. Neither is stored in the clear — the database keeps only a hash.
Who else can see it
Nobody beyond the providers that make the service run, which act as processors on our instructions alone: Fly.io hosts the application and the database, Resend delivers the sign-in e-mails, and PayPal will handle payments once they are switched on. We use no analytics tool and no advertising service, and we neither sell nor share data with third parties.
Where the data is
In the European Union. The application and the database run in the Amsterdam region and mail is sent from a European region. Andorra holds an adequacy decision from the European Commission, so data moving between Andorra and the Union needs no additional safeguards.
Your rights
You may access your data, correct it, erase it, object to the processing, restrict it and ask for it in portable form. The “My account” page lets you read and change your first and last name, your language and — if the account is yours — your organization's name directly; for anything else, write to us and we will answer within the legal deadline. The e-mail address itself cannot be edited: with magic-link sign-in, the address is the credential. If you believe a request was not handled properly, you may complain to the Andorran Data Protection Agency.
Cookies and local storage
One cookie, the session one, which keeps you signed in. It is strictly necessary for the service you asked for, which is why we neither ask for consent nor show a banner. Your browser also keeps, on your own device and without sending it anywhere, the draft of the form while you fill it in and the page to return to after signing in. There are no third-party, analytics or advertising cookies.
Security
The site is served over HTTPS only. There are no passwords: sign-in is a single-use link. Sign-in and session tokens are stored as hashes, so a copy of the database lets nobody sign in as anybody, and any session can be revoked from the server.
Updates
When the service changes — when payment is switched on, for instance — this policy will be updated and the date above will say so.