Privacy notice
AISTRAEN applies the following data minimization, consent and security controls. Production collection remains conditional on publishing the controller's legal name, address, rights channel and an approved notice version.
Data controller
AISTRAEN [LEGAL NAME, REGISTRATION NUMBER AND ADDRESS PENDING CONFIRMATION]. These details must be completed and validated before production form collection is enabled.
Data we process
The form receives your name, company, work email, role, message and consent evidence. With analytics or marketing authorization, we may also retain source page, referrer, UTMs and GCLID. We do not request passwords, credentials, financial data or sensitive personal data.
Separate purposes and choices
Required privacy acceptance allows us to respond to and follow up on the request you initiated. The commercial checkbox is optional and separate: only checking it authorizes commercial communications. Leaving it unchecked is neither an opt-out nor permission for campaigns.
Cookies and measurement
Necessary cookies store language and consent preferences. Google Tag Manager, GA4 and advertising attribution remain blocked until authorization. You can accept, reject, or select analytics and marketing separately, and change your choice from the footer. Consent preferences are retained for up to 180 days and language preference for up to 12 months.
Providers and transfers
Configured providers include Vercel and Cloudflare for hosting, delivery and security; HubSpot for CRM and consent records; Google only for authorized measurement; and Resend only for optional notifications. Some providers may process data outside Costa Rica, subject to contractual and legal review.
Retention and security
Under the provisional operating rule, requests are reviewed for deletion or anonymization 24 months after the last useful interaction. Suppression records and consent evidence are retained as needed to honor preferences and demonstrate compliance. Controls include restricted access, encryption in transit, minimization and traceability.
Your rights
You may request access, correction, updating, deletion or withdrawal of consent. The formal channel, internal response time, controller identity and ARCO procedure must be completed before production collection is enabled.
Legal items blocking activation
- Controller legal name, registration number and address
- Formal email or channel for ARCO rights
- Legal validation of purposes, transfers and retention
- Processor agreements and data protection addenda
- Approved version and effective date