Avyron Legal Tech
Privacy Policy
In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD)
Version 2.0 · August 2026 · avyronlegaltech.net/privacidad
1. Data Controller
Name
Avyron Legal Tech (Pedro Juan Ruiz Diaz Rolon — sole trader)
Tax ID (NIF)
Z3292717L
Fiscal address
Calle Diseminados S/N, 07800 Eivissa (Illes Balears)
Activity
Out-of-court management of air passenger claims (EC 261/2004)
Contact
business@avyronlegaltech.net
Website
avyronlegaltech.net
For any questions about the processing of your data, you can write to us at business@avyronlegaltech.net.
2. Data We Process
When you use the Avyron claim management service, we process the following data:
| Data | Source | Required |
|---|---|---|
| Passenger's full name | Entered by the user | Yes |
| Email address | Entered by the user | Yes |
| Flight number and airline | Entered by the user | Yes |
| Origin and destination airports (IATA codes) | Entered by the user | Yes |
| Flight date | Entered by the user | Yes |
| Incident type (delay, cancellation, denied boarding) | Entered by the user | Yes |
| Incident details (hours of delay, advance notice, alleged reason) | Entered by the user | Yes |
| Passport / ID number (DNI/NIE) | Entered by the user | No — only if the case is escalated to the national regulator (AESA or equivalent) |
| Verified flight data (actual arrival time, distance) | AeroDataBox API (public source) | Automatic |
| Consent and rights assignment (IP, date/time, device) | Generated automatically when signing the assignment | Automatic |
| Rights assignment PDF document | Generated by Avyron | Automatic |
| Case communications (letters, airline responses) | Generated by Avyron / received from airline | Automatic |
| Analysis result and estimated compensation | Produced by the Avyron engine | Automatic |
We do not process special categories of data (health, ideology, biometric data, etc.) within the meaning of Art. 9 GDPR. The ID number is only collected when strictly necessary for escalation to the regulator.
3. Purposes and Legal Basis
Claim viability analysis
Processing flight data to assess eligibility for compensation under EC 261/2004, generate the claim letter and determine the channel for contacting the airline.
Rights assignment and consent
Recording the passenger's consent via the rights assignment document, including IP, date/time and device, as proof of authorisation to act on their behalf.
Management and submission of communications to the airline
Sending the claim letter to the airline by email or post, attaching the rights assignment. Recording responses received.
Escalation to the national regulator
If the airline does not respond or rejects the claim, requesting the passenger's ID number to formalise the complaint with AESA or equivalent regulator.
Case status communications
Notifying the passenger by email of progress: letter sent, airline response, final outcome, commission invoice.
Commission billing
Issuing an invoice for the 15% + VAT commission on the recovered compensation.
Service improvement
Pseudonymised case data (without direct passenger identifiers, but potentially re-identifiable) are used to improve the accuracy of the analysis engine. As pseudonymised data, the GDPR continues to apply.
4. Retention Period
| Case data (flight, passenger, incident, communications) | 5 years from case closure | Limitation period for civil actions in Spain (Art. 1964 CC) and possible obligation to evidence management to regulators |
| Rights assignment document (PDF) | 5 years from signing | Required as proof of authorisation to act on behalf of the passenger |
| Passport / ID number (DNI/NIE) | Deleted or pseudonymised within 12 months of case closure, unless ongoing legal obligation | Sensitive identification data — retained only for the minimum necessary time |
| Email address | 5 years or until you exercise the right to erasure | Required for case communications and billing |
| Consent records (IP, timestamp) | 5 years from signing the rights assignment | Proof of valid consent under GDPR |
| Billing data | 10 years from invoice issuance | Spanish tax obligation (General Tax Law 58/2003) |
| Payment data (Stripe) | Managed directly by Stripe pursuant to its policy. Avyron does not store card data. | — |
5. Recipients and International Transfers
To provide the service we use the following processors, acting as data processors under contract with Avyron:
| Provider | Function | Location | Safeguard |
|---|---|---|---|
| Anthropic, Inc. | AI model that processes case data to generate the analysis and claim letters | USA | SCCs (Decision 2021/914) |
| Supabase / AWS eu-west-1 | Data storage in PostgreSQL database (EU-Ireland region) | EU | Within the EU — no international transfer |
| Vercel, Inc. | Application hosting and function execution | USA / EU | SCCs + DPF |
| Google Ireland Ltd. | Google Ads measurement (which ad led to each claim), only if you accept cookies | EU / USA | SCCs + DPF |
| Resend, Inc. | Email notifications to the passenger about case status | USA | SCCs |
| AeroDataBox / RapidAPI | Query of public flight data to verify the information | USA / EU | SCCs |
| Stripe, Inc. | Commission payment processing | USA | SCCs + DPF |
As part of claim management, the passenger's data (name, flight details, rights assignment) is sent to the airline and, where applicable, the national regulator, in performance of the management contract and the signed rights assignment. These submissions are the core of the contracted service.
SCCs = Standard Contractual Clauses (Decision 2021/914/EU). DPF = EU-US Data Privacy Framework (Decision 2023/1795/EU). For transfers labelled SCCs+DPF, both safeguards apply jointly; for SCCs-only transfers, SCCs are the primary safeguard. Anthropic relies solely on SCCs as no DPF certification has been identified at the date of this policy.
6. Automated Decisions
The claim viability analysis is automated (Art. 22 GDPR). The engine processes flight data without initial human intervention and generates an assessment of eligibility for compensation. Communications to the airline are reviewed by Avyron before sending.
The result of the automated analysis does not constitute legal advice or a binding decision on compensation. The final decision rests with the airline and/or the national regulator. You have the right to request human review of the analysis, express your point of view or challenge the result by writing to us at business@avyronlegaltech.net.
7. Your Rights
Under the GDPR, you can exercise the following rights by writing to business@avyronlegaltech.net with the subject line "GDPR Rights Request":
Access (Art. 15)
Know what data of yours we store.
Rectification (Art. 16)
Correct inaccurate or incomplete data.
Erasure (Art. 17)
Request that we delete your personal data when it is no longer necessary.
Portability (Art. 20)
Receive your data in a structured, machine-readable format (JSON/CSV).
Restriction (Art. 18)
Request that we suspend processing while a dispute is resolved.
Objection (Art. 21)
Object to processing based on legitimate interest, including service improvement.
Withdraw consent
If processing is based on your consent (email), you may withdraw it at any time without affecting what has already been done.
Complaint to supervisory authority
If you consider that your rights have not been addressed, you may complain to the competent data protection authority in your country of residence.
We will respond to your request within a maximum of 30 days (extendable to 60 in complex cases, with prior notice).
8. Cookies and Similar Technologies
Avyron uses technical cookies needed for the service to work (session, language and your choice in the cookie banner) and, only if you give your consent in the banner, Google Ads cookies to measure which ads lead to claims and to store where your visit came from.
You can accept, reject or change your choice at any time from "Cookie settings" in the footer of every page. Details of each cookie are in the Cookie Policy (avyronlegaltech.net/cookies).
9. Security
We apply technical and organisational measures to protect your data: encryption in transit (TLS 1.2+), encryption at rest (AES-256), role-based access control and access auditing. For further technical detail, see the Technical Description of the System.
In the event of a security breach involving risk to the rights and freedoms of data subjects, we will notify the competent supervisory authority (AEPD in Spain) within 72 hours of becoming aware of the incident (Art. 33 GDPR). If the breach poses a high risk to you personally, we will also notify you without undue delay (Art. 34 GDPR).
10. Changes to This Policy
We may update this privacy policy to reflect changes in the service or applicable regulations. The current version will always be available at avyronlegaltech.net/privacidad with the date of the last revision. If the changes are substantial, we will inform you by email (if provided) or by means of a notice on the platform.
business@avyronlegaltech.net