Privacy policy.

01Data controller

NovaSyn, operating from Costa Rica, is responsible for deciding why and how the data described in this policy is processed.

• Email: novasyn@novasyn.org
• Phone: +506 6053 2155
• Location: Costa Rica

02Data we process

When you use the contact form, we may receive:

• Identity and contact details: name, email, company and phone.
• Project information: type, timeline and message content.
• Operational data: language, submission path, consent date and internal follow-up status.
• Technical security signals processed by Cloudflare Turnstile to distinguish people from automated traffic.

NovaSyn’s inquiry database does not store IP addresses. Infrastructure providers may temporarily process IP addresses, device information or technical logs to operate and protect their services.

We do not request sensitive data. Please do not include medical, biometric, detailed financial or children’s data in your message.

03Purposes and consent

We use the data to:

• Receive, assess and respond to the inquiry.
• Coordinate meetings, prepare a proposal and follow up on a potential business relationship.
• Protect the form, prevent fraud, spam and abuse, and diagnose failures.
• Maintain business records and meet contractual or legal obligations where applicable.
• Measure aggregate website performance when analytics are enabled.

Submission is voluntary. Name, email, project type, timeline, message and consent are required to process the form; company and phone are optional. Without the required information, we cannot process the inquiry through the form.

The form checkbox records your informed consent. You may withdraw it later without affecting processing performed before the withdrawal request.

04Providers and recipients

Information is accessed only by authorized NovaSyn personnel and the providers needed to operate the site:

• Supabase: database and secure function that receives the inquiry.
• Resend: delivery of the email notification to NovaSyn.
• Cloudflare: anti-abuse protection through Turnstile and, if enabled, aggregate analytics and website infrastructure.

These providers may process information on infrastructure outside Costa Rica and operate under their own privacy and security commitments. NovaSyn does not sell, rent or disclose data for third-party advertising. We will disclose additional information only with authorization, when needed to provide the service, or when legally required.

05Retention and deletion

Inquiries that do not become a contractual relationship are retained for up to 24 months after the last interaction. They are then deleted or anonymized unless a documented legal reason requires longer retention.

Where a contractual relationship exists, we retain necessary information during the relationship and for periods required by accounting, tax, contractual or claims-related obligations. Provider technical logs follow their own operational retention periods.

06Your rights

You may request, free of charge, access to your data, correction or updating, deletion where applicable, and withdrawal of consent. You may also ask about the use, purpose and recipients of the information.

Email novasyn@novasyn.org with your name, the specific request and information that allows us to locate the record. We may request reasonable identity verification before responding. NovaSyn will respond within the applicable legal period; Costa Rican Law 8968 establishes five business days.

If you believe your rights were not properly addressed, you may contact Costa Rica’s data protection authority, PRODHAB.

07Security and confidentiality

We apply reasonable measures to preserve the confidentiality, integrity and availability of information. The inquiry table uses row-level access control, grants no direct access to public users and receives data through a server function that validates origin, content, consent and Turnstile. Operational access is limited to authorized personnel.

No system is completely invulnerable. If we detect an incident that may affect your data, we will act in accordance with the law and provide required notice where applicable.

08Cookies, Turnstile and analytics

NovaSyn does not use advertising pixels or create advertising profiles. Cloudflare Turnstile processes limited technical signals to verify that the form is not being operated by a bot. Cloudflare analytics, when enabled, are used for aggregate performance and traffic statistics.

You can manage cookies and storage through your browser. Blocking strictly necessary functions may prevent the form from working correctly.

09Changes and applicable law

We may update this policy when the site, providers or applicable obligations change. The effective date will always appear at the top. Material changes will be communicated reasonably before applying a use incompatible with the original consent.

This policy is governed by Costa Rican law, particularly Law No. 8968 and its regulations.