Privacy Policy

01Who we are

This policy explains how Vector Costa Rica (“Vector”, “we”), a software studio based in San Ramón, Alajuela, Costa Rica, collects and uses personal data on vectorcr.com, our client portal and our related services. Questions or requests: info@vectorcr.com.

It does not cover websites we build for clients: each of those has its own policy, set by that client.

02What we collect

When you contact us

Your name, email address, phone number (optional), the services you are interested in and your message. To stop spam we also process your IP address (to limit repeated submissions) and run a proof-of-work check in your browser through Cap, a CAPTCHA service we host ourselves; it sets no tracking cookies and shares nothing with third parties. Your submission is held for up to 24 hours until you confirm your email address; if you do not confirm, it is deleted.

If you are a client

To provide our services and the client portal we keep: your name, email address, company, language preference and login times; your password, stored only as a salted, one-way hash; support requests and messages; files you upload to support requests (images, PDF, text or CSV, up to 5 MB each); events you record in the portal; and records about your projects, websites and their performance.

For billing we keep the contact and tax details you give us (such as name, company, tax ID, address, email and phone), invoices, payments and subscriptions.

When you browse the site

We use Google Tag Manager and Google Analytics in Consent Mode. Until you accept analytics cookies in our banner, Google receives only cookieless measurement signals; analytics cookies are set only after you accept, and you can change your choice at any time under “Cookie settings”.

Our servers keep operational logs, which can include IP addresses and, for some actions, email addresses.

03How we use it

We use personal data to answer your inquiry and confirm your email address; to provide, support and bill for our services and the client portal; to report on the performance of the websites we run for you; to keep our services secure and free of spam and abuse; to understand and improve how our site is used (only with your consent for analytics cookies); and to meet legal, tax and accounting obligations.

We rely on your consent (analytics cookies, and the information you choose to send us), on the performance of our contract with you, on our legitimate interest in running a secure business, and on legal obligations.

04Who we share it with

We do not sell personal data. We share it only with providers that help us run our services, under their own privacy and security terms:

Resend (email delivery); Google (Tag Manager and Analytics, and, where we use it, internal team notifications); DigitalOcean (the infrastructure our servers run on). Our database, file storage, identity service and support chat (Nexus) and CAPTCHA service (Cap) are systems we operate ourselves on that infrastructure.

We may also disclose data when the law requires it, or to protect our rights, our clients or the public.

05Where it is processed

Our servers are located in the United States (DigitalOcean, San Francisco), and our providers may process data in the United States or other countries. By using our services you understand that your data will be transferred outside Costa Rica. We choose providers that protect it appropriately.

06How long we keep it

Unconfirmed contact submissions: up to 24 hours. Confirmed inquiries: as long as needed to respond and follow up. Client and portal data: while you are a client, then deleted when your account is closed, except invoices and billing records, which we keep for as long as tax and accounting law requires. Server logs: short-term, for operations and security.

07Cookies and local storage

Essential, set only when you use the related feature: vcr_portal_sess, vcr_portal_hint and vcr_portal_lang (client portal session and language, up to 12 hours; language up to 1 year); vcr_dash_sess, vcr_oauth_state and vcr_oauth_retry (staff sign-in only).

Preferences stored in your browser: your cookie choice, light or dark theme, reading mode and dismissed notices.

Analytics: Google Analytics cookies, only after you accept them.

08How we protect it

Traffic is encrypted with TLS, passwords are stored only as salted hashes, uploaded files are kept in private storage and available only to your account and our staff, and access to client data is limited to the people who need it.

09Your rights

Under Costa Rica’s Law 8968 on the Protection of Persons in the Processing of their Personal Data, you may ask us to access, correct or delete your data, or object to its processing, and you may withdraw your consent at any time. Write to info@vectorcr.com; we will answer within the time the law sets. You may also file a complaint with the Agencia de Protección de Datos de los Habitantes (PRODHAB). If you live elsewhere, you may have similar rights under your local law, and we will honour them.

10Children

Our services are for businesses and are not directed at children under 18. We do not knowingly collect their data.

11Changes to this policy

We may update this policy. We will change the date at the top and, for significant changes, tell our clients through the portal or by email.