What pasaCódigo reads, and what it keeps.

pasaCódigo finds verification codes in your email so you do not have to go looking for them. Doing that means reading part of your mailbox. This page says exactly which part.

Who is responsible

UnVale S.L., Madrid, Spain. CIF: Pending.
Questions, requests or complaints: [email protected].

UnVale S.L. is the data controller for the processing described here. pasaCódigo is distributed by UnVale S.L.; it is not affiliated with any email provider, courier, or the services whose messages it reads.

What we read and what we keep

The list below is the same text the app shows you before you grant anything, in both languages the app ships in. It is generated directly from the application's own copy rather than written separately for this page, so widening what pasaCódigo reads changes this section too. If this page and the app ever disagree, that is a bug — please report it.

English

Codes are read only from the senders you select.
Turn on deliveries and we also read parcel mail.
Turn on security alerts and we check subject lines for warnings about your accounts — we open the message only when one matches, and keep a short excerpt.
Finding your services reads senders and subject lines, never message text.
Both are off unless you turn them on. Codes go straight to your contacts, then are forgotten — pause any service anytime.

Once a code is no longer live it moves to Recents, where you can still read it. This is how long it stays there before the server deletes it — 12 hours by default. Shortening it takes effect straight away.

Español

Los códigos se leen solo de los remitentes que selecciones.
Si activas los envíos, también leemos el correo de transporte.
Si activas las alertas de seguridad, revisamos los asuntos en busca de avisos sobre tus cuentas — solo abrimos el mensaje cuando uno coincide, y guardamos un extracto corto.
Al detectar tus servicios leemos remitentes y asuntos, nunca el texto del mensaje.
Ambas están desactivadas salvo que las actives. Los códigos van directos a tus contactos y luego se olvidan; pausa cualquier servicio cuando quieras.

Cuando un código deja de estar activo pasa a Recientes, donde todavía puedes leerlo. Este es el tiempo que se queda ahí antes de que el servidor lo borre; por defecto, 12 horas. Si lo acortas, se aplica al momento.

What we never do

We do not sell, rent or share your mail, your codes or your contacts.
We do not use the contents of your mailbox for advertising or profiling.
We do not train models on your messages.
We do not read anything from a switch you have not turned on.

Where the data is processed

Processing takes place in the European Union. Codes are transient by design: a code is delivered to your device and then removed from the server once its retention window ends, as described above.

Your rights

Under the GDPR you may request access to your personal data, correction, deletion, restriction of processing, portability, and you may object to processing. You may withdraw consent for any optional read at any time by turning off the corresponding switch in the app, which takes effect immediately. Write to [email protected] to exercise any of these rights.

You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

Deleting your account

You can delete your account from within the app. Deleting it revokes mailbox access, removes stored codes, and deletes the account record.

Changes to this policy

When what the app reads changes, the app's own copy changes and this page is regenerated from it. Material changes are announced in the app before they take effect.

Last updated: 2026-08-22.