Privacy policy
Last updated: October 1, 2026
1. Data controller
Company name
Akira Dynamics S.L.
Tax ID (CIF)
B21766068
Address
Avenida de Andalucía 46, 29760 Málaga, Spain
Privacy contact
privacidad@hipotecas.meHipotecas.me is the commercial brand of Akira Dynamics S.L., a Spanish company registered with the Bank of Spain as a mortgage credit intermediary under registry number E569.
2. What data we collect and why
Mortgage assessment form: name, surname, email, phone, property province, employment status, monthly income, savings, age. Used to provide you with a personalised mortgage analysis and contact you within 24 business hours.
Contact form: name, email, phone and message. Used to answer your enquiry.
Hipo, the AI assistant: the question you type, the answer it gives, the pages it suggests and the IP address you ask from. Used to answer you, to protect the service against abuse such as mass-sending questions (that is why we keep the IP) and to review and improve its answers. Please do not use the chat to give us personal data: if you want an assessment, Hipo offers you the form. The site's tools (comparison, simulators, calculators) otherwise run in your browser and store nothing on our side.
Browsing data: random visitor ID, pages visited, referrer, country, device type. Used to count visits and improve the site. The first-party vid cookie (1 year) and our campaign and partner attribution cookies are only set if you accept them in Google's consent message; without consent the visitor ID only lives while the tab is open. Details in our cookies policy.
Optional data: co-borrower information if you indicate the mortgage will be in two names. Voluntary, you can omit it.
Legal basis: consent (Art. 6.1.a GDPR) for the assessment form and for statistics, attribution and advertising cookies; performance of a contract (Art. 6.1.b GDPR) when you hire our intermediation service; legitimate interest (Art. 6.1.f GDPR) for cookie-less aggregate analytics and for keeping Hipo conversations (protecting the service against abuse and reviewing answer quality). You can object by writing to us.
3. Retention periods
We keep your data only for as long as needed for the purpose for which we collected it and, where a law requires us to keep it longer, for the period that law sets. These are the periods by type of data:
Assessment requests that do not become clients
2 yearsFrom when: From our last contact with you, or until you ask us to erase them sooner.
No law sets this period: it is the time needed to assist you if you pick the assessment up again. If you gave us your identity document for customer due diligence, that copy follows the anti-money-laundering period.
Law: No statutory period: time needed
Clients who hire our intermediation service
6 yearsFrom when: The pre-contractual information we gave you, from the end of the contract's effects for you. The rest of the file and the correspondence, from the last entry in our books.
When the pre-contractual information period ends we will notify you, in a verifiable way, of your right to receive it and, if you ask for it, we will hand it over.
Law: Law 5/2019, fourth additional provision; Spanish Commercial Code, art. 30
Anti-money-laundering (identification and customer due diligence)
10 yearsFrom when: From the end of the business relationship or the execution of the transaction.
As a credit intermediary we are an obliged entity under Law 10/2010. After 5 years, that documentation is only accessible to internal control and legal defence, and after 10 years it is deleted.
Law: Law 10/2010, art. 25 and art. 2.1.k
Invoicing (if you pay fees)
6 yearsFrom when: From the last entry in our books.
It also covers the 4 years during which the Tax Agency can review a tax year, counted from the end of the filing period, during which it must be possible to substantiate it.
Law: Spanish Commercial Code, art. 30; General Tax Act (Law 58/2003), arts. 66 and 67 and art. 70
Complaints and claims
5 yearsFrom when: Once resolved, blocked for 5 years from when performance of the obligation claimed can be demanded.
We keep them for as long as needed to handle them and, afterwards, only blocked for the limitation period of personal actions that have no special period.
Contact form
1 yearFrom when: From our reply to your enquiry, unless a service relationship begins.
No law sets this period: it is the time needed to deal with follow-up questions on the same enquiry.
Law: No statutory period: time needed
Conversations with Hipo, the AI assistant
12 monthsFrom when: From the date of each question. After that period they are deleted automatically.
No law sets this period: it is the time needed to detect abuse of the service and review the quality of the answers.
Law: No statutory period: time needed
When each period ends, or earlier if you ask for erasure and no law requires us to keep the data, we block it: it is set aside, and we can neither use nor consult it, available only to judges and courts, the Public Prosecutor and the competent authorities (including the Spanish Data Protection Agency, AEPD) for the limitation period of any liability arising from the processing. It is then destroyed (LOPDGDD (Organic Law 3/2018), art. 32). Anti-money-laundering documentation is not blocked at the end: it is deleted once the 10 years are up, as that law itself requires.
Browsing data and cookies: the period for each cookie is set out in the cookies policy.
Legislation cited
- BOE — Ley 5/2019, reguladora de los contratos de crédito inmobiliario (LCCI)
- BOE — Código de Comercio (Real Decreto de 22 de agosto de 1885)
- BOE — Ley 10/2010, de prevención del blanqueo de capitales y de la financiación del terrorismo
- BOE — Ley 58/2003, General Tributaria
- BOE — Código Civil (Real Decreto de 24 de julio de 1889)
- BOE — Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales
4. Recipients
Recipients: we only share your data with banks you authorise as part of your mortgage assessment, plus our service providers under data processing agreements (hosting, email, CRM). We do not sell or transfer data to third parties for advertising. If you reach us through a partner in our affiliate programme, that partner sees that you are a client, your shortened name (initial and surname), the type of transaction you are looking for, your province, the stage your mortgage is at and its dates, and the partner's commission; never your documents, your contact details or your financial details. If the partner registers you themselves, they also see whether your case is viable and how many banks are a fit, never the score or your figures.
AI provider (Hipo, the AI assistant): the text of your conversation with Hipo (your question and the earlier messages in the same chat) is sent to the provider of the AI model Hipo uses to generate the answer, acting as data processor under contract. It is located outside the European Economic Area, so this is an international data transfer, with the safeguards required by Chapter V of the GDPR. We do not send it your IP address or contact details.
Google (analytics and campaign measurement): we use Google Analytics to count visits and Google Ads to measure which ads bring us requests, only if you accept those cookies in our notice. More in Google's privacy policy.
X (campaign measurement): only if you accept advertising cookies, we load the X pixel and, when you send a request, we tell X it happened together with your email and phone number scrambled with an irreversible function (SHA-256), so X can tell whether you came from one of our ads. We never send it your details in plain text or anything about your mortgage. X may process this data outside the European Economic Area. More in X's privacy policy.
International transfers: some of our processors are located in the EU/EEA. If any transfer occurs outside the EU, it is covered by Standard Contractual Clauses approved by the European Commission.
5. Your GDPR rights
You have the right to access, rectify, delete, restrict, port your data and object to its processing. To exercise any right:
- Email privacidad@hipotecas.me with a copy of your ID/passport
- We respond within 30 days
- If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es
Note: Hipotecas.me operates under Spanish law. The legally binding version of this privacy policy is the Spanish version. The English text above is provided for transparency and convenience.