Privacy policy
Last updated: 28 August 2026
This policy covers two different things: the cromaset.es website and the CromaSET app. The website barely handles any data; the app handles your accounts, so most of this text is about the app.
Who the controller is
SET AND PARSECS, S.L. — Sociedad Unipersonal (single-member company), Spanish tax ID (NIF) B93850683, registered office at Placeta Adelina Gregoriano, 4, 08224 Terrassa (Barcelona), Spain. Contact: hello@cromaset.es.
On the website
The only data we collect here is what you give us when you ask to sign up: your name or alias (optional), your email and, if you care to tell us, the platforms you get paid by. We use it solely to handle your request and get in touch with you. The legal basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it whenever you like.
The website uses no cookies, no third-party analytics, no tracking pixels and no advertising. Fonts are self-hosted, so your visit makes no requests to anyone else's servers.
In the app
Once you are a client, the app handles the following:
- Your account: name, email and password (stored encrypted, never in the clear), plus an identifier for each device you sign in from.
- Your tax details: tax ID, registered address, business activity code (IAE) and bank account number. These are the ones printed on your invoices.
- Your invoicing: invoices issued, amounts, currencies, exchange rates, payments received, fees and accounting entries.
- Your expenses: the photos of receipts you upload and what is read from them (supplier, tax ID, amount, taxes).
- Your messages with your adviser, read by the firm's staff.
- The platforms you get paid by, so we know how each one must be invoiced.
What for, and on what legal basis
- Providing the service (issuing invoices, working out your taxes, answering you on the chat): performance of the contract, Art. 6(1)(b) GDPR.
- Complying with the law (issuing and keeping invoices, VeriFactu invoicing records, filing tax returns): legal obligation, Art. 6(1)(c) GDPR. This does not depend on your consent: if you ask us to delete an invoice already issued, we cannot do it.
- Keeping the service secure (access logs, abuse prevention): legitimate interest, Art. 6(1)(f) GDPR.
Who else sees your data
We do not sell data, and we do not hand it to anyone to make their own business out of it. It is seen, and only so that we can provide the service, by:
- SET LEGAL SERVICES, S.L., which provides the advisory service: your adviser sees your accounts and your messages. That is the point of the product.
- FACTUSET, the invoicing engine of the same group, which issues and keeps your invoices.
- The Spanish Tax Agency, to which invoicing records and tax returns are sent. A legal obligation.
- Google, whose artificial-intelligence service reads the photo of your receipts to extract the data, on European servers. It acts as a processor. If you would rather not use it, you can enter your expenses by hand.
- Google (Firebase), which delivers notifications to your phone. For that it stores an identifier for your device, not the content of the alert.
- Our hosting provider, with servers in the European Union.
International transfers
There are none. Your data is handled in the European Union, including the automatic reading of receipt photos: it is processed on Google infrastructure pinned to a European region, and that content is not used to train models.
If you would rather no image of yours ever left our servers, you can enter your expenses by hand instead of photographing them: the option is on the Expenses screen, below the camera.
How long we keep it
While you are a client, all of it. Once you are not, there are two cases:
- What the law requires us to keep —invoices, invoicing records and tax documents— is kept for the statutory periods, even if you close your account. That is not our decision: four years under the tax limitation period (Art. 66 of the Spanish General Tax Act) and six years for a trader's books and records from the last entry (Art. 30 of the Spanish Commercial Code). We apply the longest period that applies to you, and it is extended if there is an audit or proceedings under way.
- Everything else —your profile, your messages with your adviser, the receipt photos— is deleted when you ask us to, or when it is no longer needed.
How to ask us to delete your account and your data
Write to hello@cromaset.es from your account's email address, or ask through the app's chat, saying you want your account deleted.
What happens then:
- We close your access and delete your profile, your messages and the receipt photos.
- We keep your invoices and tax records for as long as the law requires, as explained above. Once that period is over, they are deleted.
- We confirm in writing what has been deleted and what had to be kept.
Before we delete anything we offer you a copy of your invoices and books, so you are not left without your own accounts.
Your rights
You can ask us for access to your data, and to rectify it, erase it, object to the processing, restrict it or take it elsewhere. Write to hello@cromaset.es and we will reply within the statutory deadline. If you think we have got it wrong, you can complain to the Spanish Data Protection Agency (aepd.es).
How we protect this
- Everything travels encrypted and the servers are in the European Union.
- The photos of your receipts are not public: they are stored outside the website and served only to someone who has signed in.
- The firm's staff are shown only what they need in order to help you, and every access is logged.
- Discreet mode: you can make notifications say neither who is writing nor what about — only that you have a message. The app's name is deliberately neutral.
A note on discretion
Many of our clients work on platforms they would rather not explain to anyone. Knowing where you get paid from can say a great deal about you, so we treat all of your data with the same reserve a law firm applies to its clients: the minimum data needed, restricted access, and no communication that reveals to anyone else what you do for a living.
We do not use your data for advertising, we do not build commercial profiles, and we do not train systems of our own on your information.
Changes to this policy
If we change anything significant we will tell you through the app or by email before it takes effect. The date at the top says when it was last updated.