Privacy Policy

SPES REX · closed beta · version of 14/10/2026

This is an English translation provided for convenience. The Spanish version (Política de Privacidad) is the only binding text and prevails in case of any discrepancy.

This policy explains what personal data SPES REX (shown as «SPES RE» in the beta) processes, for what purpose, where, for how long, and how to exercise your rights under Argentine Personal Data Protection Law 25,326. It forms part of the Terms and Conditions of Use.

1. Who processes the data

Carlos V. Castrillo, domiciled at Av. Alicia Moreau de Justo 1150, office 306 A, Autonomous City of Buenos Aires, Argentina («SPES»). Contact: legal@spesjur.com.ar.

SPES plays two different roles:

• Users' data (the lawyers who use the tool): SPES is the controller.
• Data appearing in the cases (of clients, opposing parties and third parties): the controller is the lawyer who uploads it, and SPES processes it on their behalf (art. 25 of Law 25,326). Anyone wishing to exercise their rights over that data must contact that lawyer; SPES will assist as needed.

2. What data is processed

• User identification: the name or identification associated with your access password, the password, your declaration that you are a licensed lawyer and proof of your licence if we ask for it, and any data you give us if you write to us.
• Case content: what you type or dictate, the files you attach (PDF, Word, images and others) and the text extracted from them, and the tool's answers. It may include personal data of third parties: that is why we ask you not to upload criminal cases or unnecessary sensitive data, and to anonymise (section 7 of the Terms).
• Metadata and usage log: for each conversation turn, the service records in its technical log a session identifier, the name associated with the password, the model used and the number of tokens processed; on entry, it records your acceptance of these texts with the version and date, and that same record (your name, the version of the texts, the date and your declaration that you are a licensed lawyer; never your password) is sent by email to the controller, because the technical log is deleted after a few days. The log does not store the content of the cases. The hosting provider also records technical data for each connection, such as the IP address, the date and the page requested.
• Session cookie: a single signed technical cookie to keep you logged in. We do not use advertising or analytics cookies.

3. What it is used for

• Generating the analysis and drafts you request.
• Checking citations to Fallos (the Supreme Court's official reports) against a local index of the Court's official summaries, which runs on the same server without sending anything outside.
• Protecting the tool against attempts to obtain its internal logic (section 10 of the Terms).
• Measuring the use and cost of the service, maintaining its security and keeping a record of acceptance of the Terms.

It is not used for advertising, is not sold or transferred, is not used to build profiles and is not used to train artificial intelligence models.

4. Legal basis

• Users' data: we need it to provide the service you contract by accepting the Terms (art. 5, para. 2, sub-para. d, of Law 25,326), and we also have your consent, which you give by accepting this policy.
• Case data: the legal basis is provided by the lawyer who uploads it, within their professional relationship; SPES processes it only on their behalf and for the requested purpose (art. 25).

5. Where it is kept and for how long

• The conversation and attachments live only in the server's memory while you work. They are not written to disk or to a database. They are deleted when you press «Caso nuevo» (new case) or «Salir» (log out), and also when the server restarts or is suspended for inactivity, which happens often in the beta.
• The technical log is kept by the hosting provider, Render, for the period it sets according to the plan: 7 days on the Hobby plan, 14 on Pro and 30 on Scale or Enterprise, according to its public documentation (render.com/docs/logging, consulted on 14/10/2026).
• At Anthropic, the provider of the artificial intelligence model, the retention Anthropic declares for its API users applies: it deletes inputs and outputs from its systems within 30 days of receipt or generation, unless otherwise agreed, unless longer retention is needed to enforce its usage policy, or unless the law requires it. If its automated systems flag a conversation as violating that policy, it declares that it keeps inputs and outputs for up to 2 years, and safety classification scores for up to 7 years. Source: «How long do you store my organization’s data?», privacy.claude.com, article 7996866 (version of 1/7/2026). Under its commercial terms (in force since 17/6/2025), Anthropic may not train models on that content.
• The acceptance record sent by email on entry (name, version of the texts, date and licence declaration; no password and no case content) stays in the controller's mailbox, at Google, for as long as the relationship lasts and for the period in which it may be needed as proof.
• The alert email sent on blocking (the person's name and a session identifier, no case content) stays in the administrator's mailbox, at Google.
• Voice dictation: the microphone uses your browser's speech recognition; depending on the browser, the audio may be processed on its maker's servers (in Chrome, Google), outside SPES's control. If you do not want that, type instead of dictating.
• The showcase site (rex.spesjur.com.ar) is hosted on Netlify and loads fonts from Google Fonts: those providers receive the technical connection data, such as the IP address.

6. International transfer

Anthropic, Render and Google process data in the United States. The United States is not listed among the countries with adequate legislation recognised by the Argentine authority (art. 3 of DNPDP Disposition 60/2016), and Law 25,326 only allows transfers to countries without adequate protection in the cases of its art. 12 or with equivalent safeguards. SPES is putting in place contractual clauses for these transfers following the models approved by DNPDP Disposition 60/2016 and AAIP Resolution 198/2023. Until those clauses are signed, the beta is to be used only with anonymised, public or test cases: do not upload identifiable personal data of third parties.

7. Security and confidentiality

SPES adopts technical and organisational measures to protect the data (art. 9 of Law 25,326): encrypted connection, access with an individual password, no copy of the cases on disk, a log without case content, alert and acceptance emails without case content, and providers' keys stored as server secrets. Those involved in the processing are bound by secrecy, even after the relationship ends (art. 10).

8. Your rights

• Access: you may ask what data of yours we hold. We answer within 10 calendar days of receiving the request; it is free of charge if you request it at intervals of at least six months, unless you show a legitimate interest (art. 14).
• Rectification, updating and deletion: you may ask us to correct, update or delete your data. We do so within 5 business days of receiving the request (art. 16).
• To exercise them, write to us at legal@spesjur.com.ar from an email address that identifies you or with something that proves your identity. Since the tool does not keep the cases, we will generally only hold your user data and whatever remains in the technical log for as long as it lasts.
• The Agency for Access to Public Information (AAIP) is the enforcement authority of Law 25,326 (art. 19 of Law 27,275): you may file complaints and claims with it if you consider that your rights were not respected. Under art. 3 of AAIP Resolution 14/2018: «THE AGENCY FOR ACCESS TO PUBLIC INFORMATION, in its capacity as Control Body of Law No. 25,326, has the power to handle the complaints and claims filed by those whose rights are affected by non-compliance with the rules in force on personal data protection». (Official text in Spanish: «LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales».)

9. Changes to this policy

If we change it, we publish the new version with its date on this page and on the access screen, and ask you to accept it when you log in again.

10. Contact

Carlos V. Castrillo · Av. Alicia Moreau de Justo 1150, office 306 A, Autonomous City of Buenos Aires, Argentina · legal@spesjur.com.ar