Privacy Policy

Starknot is a web and custom software development agency based in Costa Rica. We operate under the trade name Starknot, are registered with the Dirección General de Tributación (Costa Rica's tax authority) and issue electronic invoices.

For the purposes of this policy, Starknot is the data controller for the personal data it collects through this website and during its commercial relationship with clients and partners, and the controller of the databases in which it keeps that data. For any matter relating to your personal data, you can write to us at contact@starknot.co or by WhatsApp at +506 7260 8885.

When we develop a system for a client and that system stores data about third parties, our role is different: we act as data processor on the client's behalf. That distinction is explained in Section 03.

We collect only the information strictly necessary to run our business and provide our services.

Information the user provides directly

• When booking a discovery session: name, email address, company (optional), WhatsApp number (optional), estimated budget (optional), session type, chosen date and time, the reason described, the site language and the record of their acceptance of this policy.
• When requesting artificial intelligence consulting: name, email address, WhatsApp number (required, to coordinate the session), company (optional), topics of interest, level with artificial intelligence, format, two or three preferred dates and time windows, time zone, session language, what they want to achieve and the record of their acceptance of this policy.
• Messages sent to us by email or WhatsApp.
• During the commercial relationship: notes on conversations and sessions, the stage of the commercial relationship, proposals, projects, payments received (amount, date, method and receipt number), follow-up tasks and video-call links, which we record in our internal client management system.
• Project information when engaging our services: business details, content the client sends (text, images, logos, photographs), routes, rates, catalogues and any operational material needed to build what was contracted.
• Technical access credentials the client provides during development: domain, hosting, database, email delivery service, Google Business profile and equivalent tools.
• Billing information once a commercial relationship is established: name or company name, personal or corporate tax identification number, tax address, and email address for sending the electronic invoice.

Information collected automatically

• Technical security data: when a form is sent, an encrypted, irreversible code derived from the IP address (not the IP address itself), used to limit abuse and to record the creation of each request in an audit log. Our hosting provider may temporarily record IP addresses in its technical logs.
• Browsing data, only if the user accepts analytics: pages visited, buttons used, referring site, device and browser type, and an approximate location, as described in Section 08.
• Browser local storage, as described in Section 08.

Information we do NOT collect

So that it is absolutely clear:

• Starknot does not process online payments. We do not receive, process or transmit money through our systems. As a general rule, we do not develop online payment functionality for our clients either; exceptional cases are assessed one by one. Where a project includes them, the payment is processed by a certified provider on its own payment page, and that provider's own privacy policy also applies. This is set out in our Terms of Service.
• We do not store payment credentials. We do not keep credit or debit card numbers, security codes, banking passwords or online banking credentials, neither for our clients nor for the people who use the systems we develop. Neither Starknot nor the client's website receives or stores that data, even when a project includes online payments: it is entered only on the provider's page. Payments we receive are made outside this site, by bank transfer or deposit, SINPE Móvil or an external provider's payment link; in that case the provider processes the payment data under its own privacy policy and only reports to us the payment received and the payer details shown on the receipt.
• We do not access information about the client's business that falls outside the scope of the contracted project.
• We do not buy third-party databases or contact lists for commercial purposes.

Several of the systems we build — request forms, booking engines, administrative dashboards — store data about the people who use them: our client's own end customers.

Responsibility for that data is divided as follows:

The client is the controller of the database. It is for the client to comply with the obligations of notice, consent, security, handling of data subjects' rights and, where the regulation so requires, registration of the database with the Agencia de Protección de Datos de los Habitantes (PRODHAB). Starknot builds the tool; the client decides what data it asks for, what it is used for, and who it is shown to.

Starknot is the data processor. During development, testing and launch we may access that data only to the extent necessary to execute the project, and always in accordance with the client's instructions. We undertake to:

• Process that data only for the purposes of the project and never for our own purposes.
• Implement reasonable technical security measures.
• Not transfer it to third parties outside the project.
• Cease all access when the contract or the maintenance plan ends, and delete any technical copies we had retained.

We work with real data as little as possible. During development we use test data. Access to real information is limited to the launch phase and to support incidents that require it.

Kepler by Starknot and consulting sessions

Kepler. Kepler is installed on the client's computer and keeps the brands' files there; Starknot does not receive them on its servers. Kepler's agents work with the Claude (Anthropic) or ChatGPT (OpenAI) subscription the client contracts: to generate content, Kepler sends the necessary information to that provider, under the client's account and the privacy policy the client accepted with it. If Starknot accesses the client's computer to install Kepler or provide support, it does so with the client's prior authorisation and as data processor.

Consulting. Sessions are held by video call (Google Meet). We do not record them unless agreed in writing beforehand. Whatever the client shares on screen is used only during the session. We recommend not showing passwords or third parties' personal data.

The user's information is used exclusively for the following purposes:

• Responding to enquiries sent through the website or contact channels.
• Scheduling, confirming, rescheduling and holding discovery sessions and consulting sessions, and sending the related confirmation emails.
• Coordinating by WhatsApp when the person gave us their number.
• Preparing quotations and tailored commercial proposals.
• Keeping the internal record of the commercial relationship with each person: notes, proposals, projects and payments.
• Executing contracted projects according to the agreed scope.
• Configuring, in the client's name, the third-party services their project requires.
• Issuing electronic invoices and meeting the corresponding tax obligations.
• Providing technical support and maintenance under the contracted monthly plan.
• Communicating about the project: progress, stage deliveries, pending approvals, payment reminders and relevant technical notices.
• Improving our website by analysing how it is used, with pseudonymous data, only if the user accepts analytics.
• Protecting the site and forms against abuse and keeping a security log.
• Meeting applicable legal and tax obligations.
• Managing and carrying out the obligations arising from strategic commercial partnerships formalised by contract, including the authorised use of the partner's brand image, trade name and developed work, within the limits agreed in each contract.

Starknot does not sell, rent or share the user's personal information for third-party advertising or commercial purposes. Full stop.

The user's information is shared with third parties only in strictly limited circumstances.

Technical service providers

To run the site and serve our clients we use these providers, which process data on Starknot's behalf and only to provide their service:

• Vercel Inc. (United States): site hosting and form processing.
• Supabase Inc. (database hosted in the United States): storage of requests, sessions and client data.
• Resend (United States): sending confirmation emails and notices.
• PostHog Inc. (United States), only if the user accepts analytics: measuring how the site is used.
• Google LLC (Google Meet): session video calls.
• WhatsApp (Meta Platforms): messaging, when the user chooses that channel.
• The external payment link provider that Starknot indicates in each case: collecting consulting payments when the client chooses that method.
• Email, project management and source code version control tools.

These providers are contractually obliged to protect the information and may only use it for the specific purposes for which they were engaged.

Third-party services for the client's project

Where a project requires a domain, hosting, a database or an email delivery service, those accounts are opened and maintained in the client's name. The client is the account holder and is responsible for payment. Starknot performs the initial configuration and accesses them only during execution of the project and the maintenance plan. We receive no commission or margin whatsoever on those services.

Tax obligations

The tax data required to issue the electronic invoice is transmitted to Costa Rica's tax authority in accordance with the regulations in force.

Strategic commercial partners

In the context of the strategic commercial partnerships Starknot formalises by written contract with certain businesses or individuals, there may be limited shared use of information:

• The partner's brand image: trade name, logo, visual identity and visual references to the business may be used by Starknot in its public portfolio, sales materials, social media, case studies and other commercial presentation media, as agreed in the partnership contract.
• The developed work: the website, system or digital product Starknot created for the partner may be exhibited as a use case or reference, under the same terms and scope defined contractually.

This use only applies where a partnership contract signed by both parties exists. The partner has full knowledge of, and gives express consent to, the use of their image and work within the agreed terms. Any use not contemplated in the contract requires additional written authorisation.

Legal compliance

The user's information may be disclosed where legally required: court orders, tax authorities or formal legal proceedings.

Business transfer

In the unlikely event of a merger, acquisition or sale of Starknot, the information could be transferred to the new owner, always under the same protection conditions established in this policy. In that case, the user would be notified in advance.

We implement reasonable technical and organisational measures to protect the user's information:

• Encryption of communications on the website and on the systems we develop (HTTPS/SSL).
• Restricted access to sensitive information, limited to authorised people within Starknot.
• Storage with providers holding professional security standards.
• Access to administrative dashboards through individual credentials, with permission levels where the project contemplates them.
• Use of test data during development rather than real information.
• Good practice in handling credentials and technical access, and revocation of access when the project ends.
• Deletion of information no longer needed for the purposes described, as set out in Section 07.

Despite our best practices, no transmission or storage system is one hundred per cent secure. Starknot does everything it can to protect the user's information, but cannot guarantee absolute security against sophisticated attacks or circumstances beyond its reasonable control.

If a security incident affects personal data, we will notify the people affected and, where applicable, PRODHAB, within the periods set by the regulations, with the information they need to protect themselves.

The security of delivered systems also depends on the client: on the care taken with their credentials, on who has access to the dashboard, and on prompt payment of the third-party services that keep the system running.

Information is kept only for as long as necessary for the purposes described:

• Enquiries and session or consulting requests: kept for as long as the commercial relationship with the person requires, and deleted when the person asks through the channel set out in Section 09, unless a legal obligation requires their retention.
• Active project information: for the duration of the project and its associated maintenance plan.
• Technical copies of the project: up to 6 months after the maintenance plan ends, after which they are deleted.
• Data belonging to users of the systems developed: access ceases when the contract or maintenance plan ends; retention of that data is for the client as controller of the database.
• Commercial partnership information: for the term of the partnership contract and up to 12 months after it ends, after which it is deleted or anonymised.
• Billing information: according to the legal and tax periods applicable in Costa Rica, typically five years under tax regulations.
• Security log (IP-derived code and record of actions): for as long as it is needed to protect the site and to evidence the requests received and the consent given.
• Abuse counters: deleted automatically after 2 days.
• Encrypted database backups: deleted information may remain in them until they are replaced by new backups, and it is not used for any other purpose.
• Analytics data (only if accepted): kept in PostHog for the retention period configured in that service, without being linked to the user's name or email.

Once information is no longer kept, it is securely deleted or anonymised.

This site uses no advertising cookies and no cross-site tracking.

• Necessary storage: the site stores the visitor's analytics choice in the browser's local storage. That value does not identify the person. The language is set by each page's address and is not stored.
• Analytics, only with consent: if accepted, we load PostHog, an analytics service with servers in the United States. PostHog gives the browser a random identifier, kept in local storage, and records the pages visited, the buttons used, the referring site, the device and browser type, and an approximate location derived from the IP address. We do not link that data to the visitor's name or email, and we do not record sessions. We use it to understand which parts of the site work and to improve them.
• Changing the choice: analytics can be accepted or rejected at any time from the "Cookie preferences" link at the foot of every page. If it is rejected after being accepted, measurement stops and the identifier is deleted from the browser. The site's data can also be cleared in the browser settings.

The user has clear rights over their personal information and can exercise them at any time.

Those rights include:

• Access: requesting a copy of the information Starknot holds about the user.
• Rectification: asking us to correct inaccurate or incomplete information.
• Deletion: requesting that information be deleted when it is no longer necessary, subject to legal obligations requiring its retention.
• Objection: objecting to certain uses of the information.
• Portability: receiving the information in a structured, reusable format.
• Withdrawal of consent: revoking consent previously given, without affecting the lawfulness of prior processing. Consent to analytics is withdrawn from the "Cookie preferences" link at the foot of every page.

To exercise these rights, write to contact@starknot.co stating your name, the email you used to contact us and what you are requesting. We may ask you to confirm it from that same email. The process is free of charge and we reply within five business days of receiving the request, in accordance with Law No. 8968 and its implementing regulation.

If the request concerns data stored in a system Starknot developed for a client, we will pass it to the relevant client, who is the controller of that database, and tell the requester who to address.

Our services are aimed exclusively at businesses and adults. We do not intentionally collect or process personal information about minors. If we discover that we have collected information about a minor without appropriate consent, we will delete it without delay.

Where a system we develop needs to record the number of minors taking part in a service — for example, the number of minor passengers in a booking — that is operational data supplied by the adult making the request, and its processing is for the client as controller of the database.

Our site may contain links to third-party websites: providers, tools, social networks or project examples. This privacy policy does not apply to those sites. We recommend reviewing the privacy policy of each external site before providing personal information.

Several of the providers in Section 05 store or process data on servers outside Costa Rica, mainly in the United States. By sending a form, accepting analytics or engaging our services, the user expressly consents to that transfer for the purposes described in this policy. We choose providers that offer encryption, access control and contractual data protection commitments, and we give them only the data their function requires.

We may update this Privacy Policy where necessary to reflect changes in our practices, in applicable law, or in the services we offer. The version in force is always the one published on this website, with the update date shown at the top of the document.

If the changes are significant, notice will be given prominently on the website or by email to active clients.

This policy is governed by the applicable law of the Republic of Costa Rica, in particular the Law on the Protection of Persons regarding the Processing of their Personal Data (Law No. 8968) and its implementing regulation.

The competent authority for personal data protection in Costa Rica is the Agencia de Protección de Datos de los Habitantes (PRODHAB), before which any person may file a complaint if they consider their rights have been infringed.

If there are questions, concerns or requests relating to personal information or to this policy, Starknot can be contacted by email at contact@starknot.co or by WhatsApp at +506 7260 8885.

Starknot undertakes to respond transparently and promptly.