Privacy Policy

Who is responsible for your data

Manuel Herrera Mesén, an individual based in Costa Rica, is responsible for processing the personal data collected through this site.

What data we collect

Email address, when you subscribe to the newsletter (with double opt-in confirmation) or use the contact form.

Name and message, when you use the contact form — including, if you provide it, which section or service you're interested in.

Basic technical data (IP address, browser type) automatically collected by the infrastructure and security providers we use (see the providers section), mainly to prevent spam/abuse and diagnose errors.

What we use your data for

Sending you the newsletter you chose to receive, and letting you confirm or cancel that subscription at any time.

Replying to messages sent through the contact form.

Detecting and preventing automated abuse (bots, mass submissions) on the site's forms.

Diagnosing technical errors and keeping the site running correctly.

We don't use your data for advertising, sell it, or share it with third parties for their own commercial purposes.

Who we share your data with (providers)

To run this site we use the following providers, which process data on our behalf under their own privacy policies: SendGrid (newsletter and contact notification emails), Cloudflare Turnstile (anti-bot verification on forms), Vercel (site hosting and aggregated visit analytics), Railway (backend hosting), Neon (database), and Sentry (technical error monitoring).

None of these providers use your data for their own marketing purposes — they use it only to provide us the service we've contracted.

How long we keep your data

Subscription data is kept while your subscription is active, and deleted or marked as unsubscribed when you cancel.

Contact messages are kept for a reasonable period to follow up on them, and deleted once no longer needed.

Your rights

You can request to access, correct, or delete your personal data at any time by writing through the Samara One Code contact form.

If you subscribed to the newsletter, every email we send includes a link to unsubscribe without needing to contact us.

Cookies and analytics

This site uses **one cookie**: `NEXT_LOCALE`, first-party and session-only, which remembers the language you are browsing in. It is technical and necessary for the site to work, so it does not require your prior consent.

We also store a marker in your browser's session storage so the same visit is not counted twice in the reading counter. It is cleared when you close the tab and never leaves your device.

We use no advertising cookies, no cross-site tracking and no third-party cookies — which is why this site shows you no consent banner: there is nothing to consent to.

Visit analytics are aggregated and anonymous (Vercel Analytics): it measures which content gets read, without cookies and without building an individual profile of you.

The legal basis for each use of your data

Newsletter: your consent, given when you subscribe and confirm by email (double opt-in). You can withdraw it whenever you want from the unsubscribe link in any message, no explanation needed.

Contact form: to answer your enquiry and, where relevant, to take the steps that precede a possible engagement. You wrote to us; we use that data to write back.

Abuse prevention and technical diagnostics: legitimate interest in keeping the site working and free of automated submissions. It is the minimum necessary and is never used to profile you.

We never process your data on a basis other than the ones listed here. If that changes, this page is updated before it does.

Where your data is processed

The providers that run this site process data outside Costa Rica, mainly in the United States: the backend runs on Railway (San Francisco region), the database on Neon, the site on Vercel's network, and email goes out through SendGrid.

If you write to us from the European Union, the United Kingdom, Mexico, Canada or anywhere else, your data is processed on that infrastructure. By using the forms you are sending your data to those providers, which act on our behalf and under their own contractual safeguards.

We do not transfer your data to any third party other than those providers, and none of them uses it for their own purposes.

Legal framework and where to complain

The controller is based in Costa Rica, so the baseline framework is Law 8968 on the Protection of Individuals with regard to the Processing of their Personal Data. The supervisory authority is the Agency for the Protection of Inhabitants' Data (PRODHAB).

We also serve clients in Latin America, North America and Europe, and local rules apply on top where relevant: in Mexico, the LFPDPPP, with INAI as the authority; in Canada, PIPEDA, with the Office of the Privacy Commissioner; and in the European Economic Area and the United Kingdom, the GDPR, through its extraterritorial reach, before the authority of your country of residence.

The United States has no general federal privacy law today; state laws apply once their thresholds are met, which this site does not reach given its volume.

You can complain to the authority that covers you at any time. Before that, write to us: almost everything gets resolved faster that way.

Children

This site is not directed at children and we do not knowingly collect data from anyone under 13, or under 14 in countries where that is the applicable threshold.

If we find we have received a child's data without authorisation from whoever holds parental responsibility, we delete it. If you believe that has happened, write to us and we will sort it out.

Changes to this policy

We may update this policy if how we handle your data changes. The last-updated date appears at the top of this page.

Contact

For any question about this policy or your personal data, write to us through the Samara One Code contact form.