Privacy
Draft pending legal review. Last updated: 15 October 2026.
The Spanish version of this policy prevails.
Who is responsible
- Frankly Data Lab, S.L., NIF B05581624
- Calle Juan de Austria 15, Piso 3, 28010 Madrid, Spain
- Privacy: privacy@frankly.es
Your account
To run a check you sign in with Google or with a link we email you. We keep your email address and the dates you signed up and last signed in. From Google we receive only your email; we do not keep your name or picture. The sign-in link expires after 15 minutes and works once.
Legal basis: providing the service you ask for (GDPR art. 6.1.b). We keep the account until you ask us to delete it.
Checks are not linked to your account: we do not keep which listings you checked.
Waiting list
Only if you expressly agree (we ask once, and only a "yes" adds you), we keep your email, your language and the version and date of the text you agreed to, to tell you when we launch other services for tenants. Legal basis: your consent (GDPR art. 6.1.a). You can withdraw it at any time, from the link in each email or by writing to us, and we will remove you from the list.
What happens to the listing you check
The only thing you give us for a check is the link to a listing. The listing page is read once on your behalf, its content is analysed during the request and discarded once your result is shown. It is not stored, not used to train anything, and not sent to any language model: the analysis is done by our own code, and the rent is compared with aggregate figures for the area.
When an agency placed the ad, its business name is checked against our index of agencies. The ad's first photos are downloaded during the request to compute a numeric fingerprint that is compared with our index of agency listings; the photos are discarded and only the fingerprint is used. When the ad gives a street and number, the address is looked up in the public Catastro.
What we keep from each check
- The verdict, the score and the codes of the signs found, for 30 days, so the share link works.
- A code derived from your IP address, never the IP itself, for 2 days, to limit abuse. Legal basis: our legitimate interest in preventing abuse of a free service (GDPR art. 6.1.f).
- For each listing checked, an identifier derived from the link (never the link itself), how often it was checked and its scores.
Contract review
When you upload a contract (a PDF or photos of its pages), we read it only to carry out the review you ask for. The files are processed in the server's memory during the request: they are never written to disk or to any database, and they are deleted as soon as you have the result. The contract's text goes back to your browser, so you can correct a detail without uploading it again, and it disappears when you close the page.
PDFs with a text layer are read on our own server. Photos and scanned PDFs, when we read them, are sent page by page to Google Cloud's text recognition service (Cloud Vision), at its European Union endpoint, acting as our processor. No language model reads your contract: the review is done by fixed rules written from the law, and nothing is used for training.
From each review we keep only an anonymous count: the codes of the rules that applied, the type of contract, the region, the number of pages and how long it took. Never words, figures, names or addresses from the contract.
Legal basis: performing the service you ask for (GDPR art. 6.1.b); for the count, our legitimate interest in measuring and improving the review (GDPR art. 6.1.f).
We do not need ID numbers or bank account numbers to review a contract: if you take photos, you can cover them first.
Other people's data
The ad may contain the advertiser's name or phone number. They are processed only during the request, for the analysis, never stored, and never shown on the share link. Legal basis: the legitimate interest in preventing rental fraud (GDPR art. 6.1.f).
A contract names other people: the landlord, the agency and sometimes an ID number or a bank account. By uploading it you confirm it is your contract. Their details are processed only during the review and are not kept. Legal basis: the legitimate interest of someone who signs or has signed a contract in knowing their rights (GDPR art. 6.1.f). As we keep nothing and have no way to contact those people, we do not inform them one by one (GDPR art. 14.5.b).
Providers
- Railway: hosting of the service and its database, in the EU region.
- Cloudflare: protects and delivers the site. All traffic, including the contracts you upload, passes through its network encrypted and is not kept.
- Google Cloud (Cloud Vision): reads the text of photos and scanned PDFs for the contract review, in the EU.
- ScraperAPI: reads the page of the listing you ask us to check.
- Resend: sends the sign-in emails and, if you join, the waiting-list emails.
- Google: sign-in with Google, if you choose it, under its own privacy policy.
Some of these providers are based in the United States. Where data is transferred internationally, it is done with the GDPR's safeguards (an adequacy decision or standard contractual clauses).
Cookies
Justísimo uses only necessary cookies: one for your language and those for your session when you sign in. There are no analytics or advertising cookies. See the Cookie policy.
Your rights
You can ask for access, correction, deletion, objection, restriction and portability of your data, and withdraw your consent, by writing to privacy@frankly.es. You can also complain to the Spanish Data Protection Agency (www.aepd.es).