Privacy policy

• SOTO LAB SL.
• Tax ID (NIF): B21622261
• Address: Calle Sierra de Ancares 8, 28760 Tres Cantos, Madrid, Spain
• Email for any privacy matter: info@naraeducation.com

We have not appointed a Data Protection Officer because we are not required to; write to the email above for any question about your data.

Passport photo reading: when you use “scan passport with camera”, the photo is read inside your own phone or browser and is not sent to our servers or anywhere else.

“Upload my own form”: only the blank form you upload is sent to our AI provider to explain its fields; your personal data is not sent with it, and we do not store the file.

We do not make decisions about you based solely on automated processing, and we do not sell your data or use it for advertising.

When you download or preview a PDF, we record the account identifier, the time and a download number, and we count how many times you open the guide pages. We use these records to apply the daily download limit, to prevent unauthorised copying and automated collection of our content, and to identify the account that downloaded a PDF. They are kept for 90 days and then deleted automatically.

PDFs generated by NARADocs contain an invisible download number (it does not contain your name or email). Preview PDFs also show a faint, partly masked version of your email address.

• Account, preparation, application and reminder data: 6 months from sign-up. For paid plans, during the storage period of your plan (plus any extension) and for 30 more days after it ends, so that you can still extend. We remind you 14 days and 1 day before deletion; if you do not extend, the data is deleted automatically.
• You can choose how long we keep your data: delete right after you download your documents, 7 days, or 6 months (can be extended). You can delete everything immediately at any time with “Delete all now”.
• Renewal alerts (if you opted in): your email, permit expiry date and visa type, deleted 30 days after the expiry date or as soon as you turn the alerts off.
• Payment records: kept for the period required by tax and commercial law (generally up to 6 years in Spain). When your account is deleted, the name and email on payment records are removed and only the amount, date and transaction number remain.
• Access logs: according to our hosting providers' retention periods. PDF download records: 90 days.

Deleted data cannot be recovered. Our deletion log keeps only the date, the type of data and who carried out the deletion (you, staff or automatic), with no personal data.

We do not sell or give your data to third parties. We share it only with the service providers below, who process it on our behalf under data processing agreements, or when the law requires it.

Some of these providers process data outside the European Economic Area. The Republic of Korea and Japan have adequacy decisions from the European Commission. For transfers to the United States we rely on the EU–US Data Privacy Framework where the provider is certified, or otherwise on the European Commission's standard contractual clauses. You can ask us for more information or a copy of the safeguards at info@naraeducation.com.

You have the right to access your data, to rectify it, to erase it, to restrict or object to its processing, to data portability and to withdraw your consent at any time (without affecting processing carried out before). Many of these actions can be done directly in “My information”. For anything else, email info@naraeducation.com. We will answer within one month.

If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the data protection authority of your country of residence.

• All connections are encrypted (HTTPS) and application data is stored encrypted.
• Row-level access control in the database: customers can only see their own data and staff only what they need for their work.
• Separate staff accounts, activity logs and automatic deletion when retention periods end.

You must be at least 14 years old to create an account. Information about children who travel with you is entered by you as their parent or guardian.

We only use cookies that are strictly necessary for the service. See our Cookie policy.

If we change this policy we will let you know on the website at least 7 days before the change takes effect, and at least 30 days before for important changes (such as new types of data or purposes), asking for your consent again where required.

This policy is available in Spanish and English. If there is any discrepancy, the Spanish version prevails.