Legaltica is a directory of lawyers and a service that analyses your legal problem in order to put you in touch with the lawyer you choose. This policy explains what data we process, for what purposes, who we share it with and what rights you have.
1. Who the controller is
Controller: LEGALTICA LLC, a limited liability company organised in the State of Wyoming (USA), registered with its Secretary of State under no. 2026-002091484.
Address: 407 Lincoln Road, Suite 708, Miami Beach, FL 33139 (United States).
Although the controller is established in the United States, we offer the service to people who are in the European Union, so the General Data Protection Regulation (GDPR) applies to what we process about them (Art. 3(2) GDPR). If you are outside the European Union, the law of your country applies; where this policy makes distinctions by country (section 4.1), the annex for your country prevails.
Contact for anything relating to your data: privacidad@legaltica.com or the contact form. We reply within one month at most (Art. 12(3) GDPR).
2. What data we process
2.1 If you describe your case, ask for a lawyer's phone number or review a law firm
- Your case: the text you write, the documents you upload (up to three) and your approximate location (city).
- Sensitive data you choose to include: a legal problem may involve health (sick leave, medical negligence), criminal proceedings, domestic violence, sexual orientation or beliefs. These are special categories of data (Art. 9 GDPR) and data relating to criminal offences (Art. 10 GDPR). We only process them because you write them and expressly authorise us to do so by ticking the box on the form. What section 4.1 and the annex for your country provide for the case dataset is the only exception. You do not need to include names, ID numbers or other people's data: the analysis works just as well without them.
- Your contact details: name and phone number when you ask for a lawyer's number; email address only if you give it to us so that we can send you the analysis or let you know if nobody replies to you.
- Technical data: IP address, browser and pages visited, and the cookies you accept (see the cookie policy, in Spanish).
Invitations to review a law firm. We ask for your review with a personal link sent to your email or your mobile phone. That link can reach you in four ways:
- You contacted the law firm through Legaltica: we may ask you once, after one month, by email or SMS (to the contact details you gave us), how it went.
- The law firm gives us your email address so that we can invite you: the data is disclosed to us by the law firm you dealt with (Art. 14 GDPR). We receive your email address and, if the law firm provides them, your first name and an internal reference of its own, which is never published. The law firm declares that it has a legal basis for disclosing your email address to us for this purpose. From the moment we receive it, Legaltica processes that email address as an independent controller, in order to send you the invitation and, if you do not open the link, a single reminder.
- The law firm gives you a link (for example, in one of its emails or on paper): the law firm does not give us any of your data. When you open the link, you give us your email address or mobile number yourself, and we send you the link to write your review there.
- You ask for the link from the law firm's website (a button or a QR code that leads to Legaltica): you give us your email address or mobile number yourself and we send you the link there.
Unsubscribing applies to everything. Every message contains a link to stop receiving invitations. Unsubscribing applies to all law firms and all four ways, not only to the one that wrote to you. You can undo it whenever you want. We keep the date on which you unsubscribed and the date on which you revoked it, so that we can prove that we respected your decision.
If you write a review, we process the rating, the title and the text you write, the month in which you were served, what you highlight, the name under which you want it to appear and, if you came from the law firm's website, whether you ended up hiring it. To detect fake reviews we also keep technical data about your browser, your network and your email domain, and the score given by Google reCAPTCHA. To remember that you do not want us to write to you, and that only one review per person and law firm is allowed, we keep an encrypted code of your email address or phone number: it does not allow the data to be recovered.
It is not necessary, and we ask you not to do so, to include in your review details of your case, health data or data about criminal proceedings, or other people's names. If you do, we send it back to you so that you can remove them before it is published.
2.2 If you are a lawyer or law firm and you are listed in the directory
The directory profiles are not created by the professional: we compile them ourselves from publicly accessible sources, without any registration or request on their part.
- Categories: name of the law firm or professional, address of its offices, professional phone number and email address, website, opening hours, practice areas, ratings and reviews published by third parties, and a description written by us on the basis of those sources.
- Source: the public business profile that the law firm itself maintains on Google (Google Business Profile), its website and, where they exist, publicly accessible professional registers and directories.
- Legal basis: legitimate interest (Art. 6(1)(f) GDPR and Art. 19(2) of the Spanish Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights, LOPDGDD) in offering a professional directory that helps the public find lawyers. Professional contact data is processed, not data from the private sphere.
- Notifications: when someone asks for your phone number on your profile, we tell you by email or SMS at the published contact details. You can switch off these notifications using the link they contain.
- Objection and removal: you can object at any time and without giving reasons (Art. 21 GDPR) using the removal form (in Spanish) or by writing to us. We remove the profile and keep only the minimum record of your request so that we do not publish it again. Removing the profile is free of charge and is not conditional on anything.
- If you claim your profile or sign up: we additionally process your login email address, your password (encrypted) and whatever you edit in your dashboard, in order to provide you with the service (Art. 6(1)(b)) under the terms for law firms (in Spanish).
- Anti-fraud fingerprint of your dashboard: when you log in to your dashboard we store two codes encrypted with a key of our own. They are used only to detect a law firm reviewing itself. Basis: legitimate interest (Art. 6(1)(f)) in reviews being genuine.
- If you reply to a review: your reply is public. If it contains contact details or sensitive terms, we hold it back until a person has reviewed it.
2.3 If you visit a website that displays our badge
A law firm can place a Legaltica badge or widget with its reviews on its website. When it loads, your browser connects to our servers, as with any content from another site, and we receive your IP address, your browser and the page you are on. We do not store your IP address, we do not use cookies in the badge and we do not identify you: we only count, per day, from which website the badge has been viewed or clicked and on how many different pages, without storing which ones. The IP address is used only in temporary memory, to limit the number of requests. Basis: legitimate interest (Art. 6(1)(f)) in serving the badge and measuring where it is used. The law firm that places it on its website must disclose this in its own policy.
3. For what purposes and on what legal basis
| Purpose | Legal basis |
|---|---|
| Analysing your case with artificial intelligence and showing you suitable lawyers | Performance of the service you request (Art. 6(1)(b)) and, for any sensitive data you include, your explicit consent (Art. 9(2)(a)) |
| Passing your case and your phone number to the lawyer you choose | Performance of the service you request (Art. 6(1)(b)) and your explicit consent for sensitive data (Art. 9(2)(a)) |
| Publishing the directory of law firms | Legitimate interest (Art. 6(1)(f), Art. 19(2) LOPDGDD) |
| Notifying a law firm that someone asked for its phone number | Legitimate interest of the law firm and of the user (Art. 6(1)(f)) |
| Managing a lawyer's account | Performance of the contract (Art. 6(1)(b)) |
| Answering your enquiries and requests to exercise your rights | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
| Asking you once, after one month, how it went with the law firm you contacted | Legitimate interest (Art. 6(1)(f)), with one-click unsubscribe in the message itself or on the page |
| Inviting you to write a review when the law firm gives us your email address | Legitimate interest (Art. 6(1)(f)) in helping other people choose a lawyer, with one-click unsubscribe |
| Sending you the review link you ask for yourself (from the law firm's website or from a link it gave you) | Responding to your request (Art. 6(1)(b)) |
| Publishing your review | Your consent (Art. 6(1)(a)), which you give by submitting it and withdraw by deleting it |
| Detecting fake reviews and abuse | Legitimate interest (Art. 6(1)(f)) in reviews being genuine and the service not being abused |
| Remembering that you unsubscribed and that you review each law firm only once | Legitimate interest (Art. 6(1)(f)) and respect for your objection (Art. 21) |
| Handling reports about reviews | Legal obligation (Art. 6(1)(c), Art. 16 of the Digital Services Act) and legitimate interest (Art. 6(1)(f)) |
| Anonymising your analysis when it expires and keeping its classification in order to produce statistics on the matters we receive and to improve the analysis | Legitimate interest (Art. 6(1)(f)) in knowing what legal problems people have and whether the service classifies them correctly |
| Case dataset (section 4.1): statistics, evaluation of the analysis and training of our own models | Closed classification: legitimate interest (Art. 6(1)(f)) in understanding the demand for legal services and improving the analysis, with the compatibility that the GDPR recognises for statistical and research purposes (Arts. 5(1)(b) and 89). Summary and extended classification: in Spain, your consent by ticking the box «Dono mi caso para investigación» ("I donate my case for research") (Arts. 6(1)(a) and 9(2)(a)); outside the EU, whatever the law of your country allows (annex) |
| Measuring use of the site | Your consent to cookies (Art. 6(1)(a)) |
We do not send commercial communications to users who describe their case or to people we invite to write a review. The question about how it went and the invitations are not commercial communications: they offer nothing and do not link to other services.
4. What artificial intelligence does with your case
Your case goes through two language models from providers with which we have a data processing agreement: one carries out a first triage using your text and your city, and the other the full analysis using your text and your documents.
- Neither of them uses what we send it to train its models, and the documents you upload are deleted from its platform when the analysis is finished.
- The model does not take any decision that produces legal effects concerning you (Art. 22 GDPR): it guides and organises the information; the decision whether to make contact, and with whom, is always yours, and the lawyer is a person who is a member of a bar association.
- The analysis is for guidance only and is no substitute for a lawyer.
- When the analysis expires (section 7), we delete your text, the facts, the summary for the lawyer, your IP address, your session and your email address. We keep only values chosen from a closed list, never sentences, such as the area of law, the urgency, the country, the city and the date. If there are criminal facts, not even the city: only the region. If you also asked for a lawyer's phone number, that classification remains linked to your enquiry for as long as we keep it (365 days). We use it to know what legal problems reach us and where, and to measure whether the analysis gets it right.
4.1 Case dataset
In addition to the analysis, we store each case in a separate case dataset. The cases come from the analysis of your case and from the description you write when you ask for a lawyer's phone number, where it does not come from an analysis. We use the dataset to produce statistics on the legal problems that reach us, to measure whether the analysis gets it right and to train Legaltica's own models. We do not disclose it to anyone or use it to train third-party models.
- What we keep for all cases: the closed-list values from the previous section (except the options you ticked and which lawyers we showed you), with the month instead of the date; if the case comes from the contact form, the problem you chose; the page from which you started; a band for the length of your text; which model analysed it; and whether you went on to contact a law firm, how many and whether the firm opened the notification. The row does not record which law firm. In family or immigration matters, if the summary described in the next point has not been produced, not the city either: only the region.
- What we keep depending on the country: a second model, as a processor and under the same conditions as in section 4, reads your text before it is deleted and records further closed-list values and a short summary written so as not to include names, places, dates or figures.
- Spain: only if you tick the optional box «Dono mi caso para investigación» ("I donate my case for research") in the analysis. If you do not tick it, or if the case comes from the description in the contact form, we keep only the closed classification.
- Argentina, Colombia, Mexico, Peru and Venezuela: it is done without a box, on the basis indicated in the annex for your country. If you asked for a lawyer's phone number, that case is not used for training until we have deleted your enquiry with your name and phone number.
- Chile and Ecuador: it is not done. We keep only the closed classification.
- What is never included case by case: criminal matters and matters of gender-based or domestic violence, sexual violence, children at risk, trafficking, asylum or irregular immigration status; and, in Spain, Chile and Ecuador, health matters if you did not donate your case. For these we only add one to a count.
- Cases from before this version: in Argentina, Colombia, Mexico, Peru and Venezuela we also produce the summary of cases that reached us earlier, as long as their text has not been deleted. In the other countries, for cases from before 24 October 2026 we keep only the closed classification, and only for statistics.
- If you write from the European Union using another country's website, we apply what is provided for Spain.
- How we protect it: the dataset row carries no identifier of yours or of the analysis and is kept in tables with restricted access. It is pseudonymised data and we treat it as personal data.
- Your rights: while the link to your analysis is still open, you can remove your case yourself from the analysis page («No quiero que el mío entre», "I don't want mine included"). After that, you can withdraw the donation or object by writing to us. To find your case we need something that links it to you: the phone number or the name you used to ask for a lawyer's contact details, for as long as we keep that enquiry (365 days). If nothing remains that links it to you, we cannot tell which case is yours either, and we will tell you so (Art. 11 GDPR). Anything already used to train a model cannot be removed from that model, but it will not be used in later ones.
- If we publish statistics, they will only be aggregates.
Reviews are not decided by a machine: a person at Legaltica reads each one before it is published.
5. Who receives your data
5.1 The lawyer you choose
Only when you press the button that sends it to them. They receive your enquiry and your phone number in order to assist you. From the moment they receive them, they act as an independent controller: they decide for themselves how to handle your case, subject to their professional secrecy and to the terms for law firms (in Spanish), which require them to use your data only to deal with that enquiry and not to disclose or reuse it.
How it reaches them, depending on the status of their profile:
- Law firm that has not yet confirmed its profile: it receives only the category of the matter (area of law, type, urgency). To see your name, your phone number and what you told us, it has to prove that the profile is its own.
- Law firm with a confirmed profile: it receives by email the summary written by the AI; it sees your name and your phone number only inside its dashboard, after identifying itself.
If you review a law firm, the law firm and the public see only what is published: the rating, the title, the text, the month, what you highlight and the name you chose. The law firm does not see your email address or your phone number.
5.2 Our providers (processors)
They process data on our behalf and under contract, solely for what we instruct them to do:
| Provider | Purpose | Location |
|---|---|---|
| Hosting | Hosting of the application and the database | European Union |
| Artificial intelligence | Analysis of the case with artificial intelligence and classification of the case for the case dataset (section 4.1), without training | United States (EU-U.S. Data Privacy Framework and standard contractual clauses) |
| Artificial intelligence | Quick triage of the case | United States (EU-U.S. Data Privacy Framework) |
| Sending of transactional emails, including invitations to write a review | European Union | |
| SMS and calls | Sending of SMS messages and verification calls to law firms, and of the SMS messages that ask you how it went or send you the review link | United States (EU-U.S. Data Privacy Framework) |
| Storage | Storage of the photographs on the profiles | It hosts only the public photographs on the profiles, never case data |
| Anti-abuse | Telling people apart from automated programs on the forms to prevent abuse; it receives your IP address, your browser and how you interact with the page | United States (EU-U.S. Data Privacy Framework) |
| Monitoring | Monitoring of the site's performance and errors. It receives the timing of each request and the type of browser, not the content of the forms | United States (EU-U.S. Data Privacy Framework and standard contractual clauses) |
| Cookies | Management of cookie consent | European Union |
| Analytics | Measurement of use of the site, only if you accept analytics cookies | United States (EU-U.S. Data Privacy Framework) |
5.3 Authorities
When a law requires us to.
We never sell or rent out your data. The only third party that receives your case is the lawyer you send it to.
6. International transfers
The data is hosted in the European Union. The controller, LEGALTICA LLC, is in the United States and is directly subject to the GDPR (section 1); those who work on its behalf access that data only in order to provide the service.
Some providers are in the United States. Transfers are based on the EU-U.S. Data Privacy Framework (Commission Decision of 10 July 2023) where the provider is certified, and on the European Commission's standard contractual clauses in all other cases.
7. How long we keep your data
| Data | Period |
|---|---|
| Analysis of your case (text, result, document metadata) | 24 hours; 30 days if you give us your email address so that we can send it to you. After that, everything is deleted except the classification described in section 4 |
| Case awaiting transfer to the dataset | Up to 30 days |
| Case dataset (section 4.1) | No time limit. While we keep your enquiry (365 days) it is pseudonymised; after that it cannot be associated with you |
| Content of the documents you upload | Only during the analysis |
| Enquiry sent to a lawyer, with your name and phone number | 365 days from when it is sent |
| Description of a case without contact details | 90 days |
| Lawyer's account | For as long as the account exists; when it is closed, the profile remains in the directory unless its removal is requested |
| Record of a request to remove a profile | Indefinitely, only the minimum needed so that it is not published again |
| Email address, phone number, first name and reference of a review invitation that did not lead to a review | 60 days from the invitation |
| Email address, phone number, first name and reference of an invitation that led to a review | 12 months from publication (or from when you submitted it, if it was never published); immediately if you delete your review |
| Published review | For as long as it is published; you can delete it whenever you want and it disappears immediately |
| Text and title of a review that we sent back to you and you did not correct | 90 days from when we sent it back |
| Rejected or hidden review, with the law firm's reply | 12 months from the decision |
| A law firm's reply that was held back and never reviewed | 30 days |
| Anti-fraud data of a review, of a link request and of a law firm's dashboard | 90 days; the counters that limit sending and queued requests, up to 24 hours; dashboard data, 30 days from when it was last seen; the reCAPTCHA score and the email domain code, for as long as the invitation or the review exists |
| Answer to "did you get to speak to the law firm?" and record of a deleted review (without the text) | 12 months |
| Encrypted code of your email address or phone number and record of your unsubscription and its revocation | Indefinitely: this is what allows us not to write again to anyone who objected and to keep a single review per person and law firm |
| Messages sent through the contact form and reports about reviews | For as long as needed to deal with them and to show how we handled them, and we delete them if you ask us to and there is no obligation to keep them |
| Server access logs (IP address, browser and page requested) | For as long as our hosting provider keeps them |
| Browsing data | As set out in the cookie policy (in Spanish) |
8. Your rights
Access, rectification, erasure, restriction, portability and objection. And withdrawal of the consent you gave us for sensitive data, at any time, without affecting the lawfulness of processing already carried out.
Write to privacidad@legaltica.com or use the form. We will only ask you to prove your identity if we cannot confirm it in any other way and it is necessary in order to deal with the request. Maximum time limit: one month (Art. 12(3) GDPR).
You manage your own review. At legaltica.com/opinion/gestionar/ (in Spanish) you enter the email address or phone number you used to write your review and, if there are reviews linked to it, we send you there a single-use link. With it you can edit your review, delete it and undo your unsubscription.
What we keep even if you request erasure. If you delete your review or ask us to erase your data, we delete the text, the email address, the phone number and the name, but we keep the encrypted code of your email address or phone number and the minimum record of the unsubscription or of the deleted review. This is the bare minimum needed so as not to write to you again if you objected and so that nobody can review the same law firm twice (Arts. 17(3) and 21 GDPR).
If you are a lawyer and want to remove or correct your profile, you do not need any documentation: the removal form (in Spanish) is enough.
You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es). If you live outside Spain, the annex for your country (available in Spanish only) indicates your authority.
9. Security
What we apply: encryption of communications (TLS); the database encrypted at rest by the provider; access to the lawyer's dashboard only with a verified account; the content of documents is not stored; and a record of which version of this policy was in force when you gave each consent.
10. Minors
The service is not aimed at people under 18. To review a law firm you must be at least 18 years old, and you confirm this by ticking a box when you submit your review. If we learn that a review was written by a minor, we delete it.
11. Changes to this policy
Each version has a number and a date of entry into force, and earlier versions remain available in the history (in Spanish).
12. Terms of use
Use of the site is governed by the terms of use, the legal notice and, if you write a review, the review terms (all in Spanish).