Privacy Policy

Starknot is a web and custom software development agency based in Costa Rica. We operate under the trade name Starknot, are registered with the Dirección General de Tributación (Costa Rica's tax authority) and issue electronic invoices.

For the purposes of this policy, we are the data controller for the personal data we collect through this website and during our commercial relationship with clients and partners.

When we develop a system for a client and that system stores data about third parties, our role is different: we act as data processor on the client's behalf. That distinction is explained in Section 03.

We collect only the information strictly necessary to run our business and provide our services.

Information the user provides directly

• Contact details when completing a form on the site: name, email address, phone number, business name, message.
• Project information when engaging our services: business details, content the client sends (text, images, logos, photographs), routes, rates, catalogues and any operational material needed to build what was contracted.
• Technical access credentials the client provides during development: domain, hosting, database, email delivery service, Google Business profile and equivalent tools.
• Billing information once a commercial relationship is established: name or company name, personal or corporate tax identification number, tax address, and email address for sending the electronic invoice.

Information collected automatically

• Browsing data when visiting the site: IP address, browser type, pages visited, time on site, referring site, device used.
• Cookies and similar technologies, as described in Section 08.

Information we do NOT collect

So that it is absolutely clear:

• Starknot does not process online payments. We do not operate shopping carts, online stores, payment gateways or any functionality that receives, processes, stores or transmits money. Nor do we develop them for our clients. This is set out in our Terms of Service.
• We do not store payment credentials. We do not keep credit or debit card numbers, security codes, banking passwords or online banking credentials, neither for our clients nor for the people who use the systems we develop. Payments we receive are made by direct bank transfer or deposit, outside our systems.
• We do not access information about the client's business that falls outside the scope of the contracted project.
• We do not buy third-party databases or contact lists for commercial purposes.

Several of the systems we build — request forms, booking engines, administrative dashboards — store data about the people who use them: our client's own end customers.

Responsibility for that data is divided as follows:

The client is the controller of the database. It is for the client to comply with the obligations of notice, consent, security, handling of data subjects' rights and, where the regulation so requires, registration of the database with the Agencia de Protección de Datos de los Habitantes (PRODHAB). Starknot builds the tool; the client decides what data it asks for, what it is used for, and who it is shown to.

Starknot is the data processor. During development, testing and launch we may access that data only to the extent necessary to execute the project, and always in accordance with the client's instructions. We undertake to:

• Process that data only for the purposes of the project and never for our own purposes.
• Implement reasonable technical security measures.
• Not transfer it to third parties outside the project.
• Cease all access when the contract or the maintenance plan ends, and delete any technical copies we had retained.

We work with real data as little as possible. During development we use test data. Access to real information is limited to the launch phase and to support incidents that require it.

The user's information is used exclusively for the following purposes:

• Responding to enquiries sent through the website or contact channels.
• Preparing quotations and tailored commercial proposals.
• Executing contracted projects according to the agreed scope.
• Configuring, in the client's name, the third-party services their project requires.
• Issuing electronic invoices and meeting the corresponding tax obligations.
• Providing technical support and maintenance under the contracted monthly plan.
• Communicating about the project: progress, stage deliveries, pending approvals, payment reminders and relevant technical notices.
• Improving our website by analysing how it is used, anonymously and in aggregate.
• Meeting applicable legal and tax obligations.
• Managing and carrying out the obligations arising from strategic commercial partnerships formalised by contract, including the authorised use of the partner's brand image, trade name and developed work, within the limits agreed in each contract.

Starknot does not sell, rent or share the user's personal information for third-party advertising or commercial purposes. Full stop.

The user's information is shared with third parties only in strictly limited circumstances.

Technical service providers

To operate we use trusted third-party services that may have partial access to information necessary for their function:

• Hosting and storage services where our site or the project's working files are held.
• Communication platforms we use for email, messaging and video calls.
• Web analytics tools that help us understand how the site is used.
• Project management and source code version control tools.

These providers are contractually obliged to protect the information and may only use it for the specific purposes for which they were engaged.

Third-party services for the client's project

Where a project requires a domain, hosting, a database or an email delivery service, those accounts are opened and maintained in the client's name. The client is the account holder and is responsible for payment. Starknot performs the initial configuration and accesses them only during execution of the project and the maintenance plan. We receive no commission or margin whatsoever on those services.

Tax obligations

The tax data required to issue the electronic invoice is transmitted to Costa Rica's tax authority in accordance with the regulations in force.

Strategic commercial partners

In the context of the strategic commercial partnerships Starknot formalises by written contract with certain businesses or individuals, there may be limited shared use of information:

• The partner's brand image: trade name, logo, visual identity and visual references to the business may be used by Starknot in its public portfolio, sales materials, social media, case studies and other commercial presentation media, as agreed in the partnership contract.
• The developed work: the website, system or digital product Starknot created for the partner may be exhibited as a use case or reference, under the same terms and scope defined contractually.

This use only applies where a partnership contract signed by both parties exists. The partner has full knowledge of, and gives express consent to, the use of their image and work within the agreed terms. Any use not contemplated in the contract requires additional written authorisation.

Legal compliance

The user's information may be disclosed where legally required: court orders, tax authorities or formal legal proceedings.

Business transfer

In the unlikely event of a merger, acquisition or sale of Starknot, the information could be transferred to the new owner, always under the same protection conditions established in this policy. In that case, the user would be notified in advance.

We implement reasonable technical and organisational measures to protect the user's information:

• Encryption of communications on the website and on the systems we develop (HTTPS/SSL).
• Restricted access to sensitive information, limited to authorised people within Starknot.
• Storage with providers holding professional security standards.
• Access to administrative dashboards through individual credentials, with permission levels where the project contemplates them.
• Use of test data during development rather than real information.
• Good practice in handling credentials and technical access, and revocation of access when the project ends.
• Deletion of information no longer needed for the purposes described.

Despite our best practices, no transmission or storage system is one hundred per cent secure. Starknot does everything it can to protect the user's information, but cannot guarantee absolute security against sophisticated attacks or circumstances beyond its reasonable control.

The security of delivered systems also depends on the client: on the care taken with their credentials, on who has access to the dashboard, and on prompt payment of the third-party services that keep the system running.

Information is kept only for as long as necessary for the purposes described:

• Enquiries that did not become a project: up to 12 months, after which they are deleted.
• Active project information: for the duration of the project and its associated maintenance plan.
• Technical copies of the project: up to 6 months after the maintenance plan ends, after which they are deleted.
• Data belonging to users of the systems developed: access ceases when the contract or maintenance plan ends; retention of that data is for the client as controller of the database.
• Commercial partnership information: for the term of the partnership contract and up to 12 months after it ends, after which it is deleted or anonymised.
• Billing information: according to the legal and tax periods applicable in Costa Rica, typically five years under tax regulations.
• Site analytics data: kept anonymously and in aggregate for limited periods.

Once those periods have elapsed, the information is securely deleted or anonymised.

Our website uses cookies and similar technologies to function correctly and improve the user experience. Cookies are small files saved on the user's device when they visit the site.

Types of cookies we use

• Essential cookies: necessary for the site to work (navigation, forms, language preference). They cannot be disabled without affecting how the site functions.
• Analytics cookies: they help us understand how the site is used so we can improve it. The information they collect is anonymous and aggregated.
• Preference cookies: they remember settings the user configures, such as language, so they do not have to be set every time.

We do not use advertising cookies or cross-site tracking.

Control over cookies

The user can manage cookies from their browser settings: accept them, reject them, or delete those already stored. Note that rejecting certain cookies may affect how the site functions.

The user has clear rights over their personal information. They can exercise them at any time by contacting Starknot through the site's official channels.

Those rights include:

• Access: requesting a copy of the information Starknot holds about the user.
• Rectification: asking us to correct inaccurate or incomplete information.
• Deletion: requesting that information be deleted when it is no longer necessary, subject to legal obligations requiring its retention.
• Objection: objecting to certain uses of the information.
• Portability: receiving the information in a structured, reusable format.
• Withdrawal of consent: revoking consent previously given, without affecting the lawfulness of prior processing.

Requests are answered within a reasonable period, normally within 30 calendar days.

If the request concerns data stored in a system Starknot developed for a client, we will pass it to the relevant client, who is the controller of that database, and tell the requester who to address.

Our services are aimed exclusively at businesses and adults. We do not intentionally collect or process personal information about minors. If we discover that we have collected information about a minor without appropriate consent, we will delete it without delay.

Where a system we develop needs to record the number of minors taking part in a service — for example, the number of minor passengers in a booking — that is operational data supplied by the adult making the request, and its processing is for the client as controller of the database.

Our site may contain links to third-party websites: providers, tools, social networks or project examples. This privacy policy does not apply to those sites. We recommend reviewing the privacy policy of each external site before providing personal information.

As an agency operating across Latin America and using global technology tools, some information may be stored or processed on servers located outside Costa Rica. Where that happens, Starknot ensures the provider meets data protection standards equivalent to those applicable locally.

We may update this Privacy Policy where necessary to reflect changes in our practices, in applicable law, or in the services we offer. The version in force is always the one published on this website, with the update date shown at the top of the document.

If the changes are significant, notice will be given prominently on the website or by email to active clients.

This policy is governed by the applicable law of the Republic of Costa Rica, in particular the Law on the Protection of Persons regarding the Processing of their Personal Data (Law No. 8968) and its implementing regulation.

The competent authority for personal data protection in Costa Rica is the Agencia de Protección de Datos de los Habitantes (PRODHAB), before which any person may file a complaint if they consider their rights have been infringed.

If there are questions, concerns or requests relating to personal information or to this policy, Starknot can be contacted through the form available on our website or through the official contact channels shown on the home page.

Starknot undertakes to respond transparently and promptly.