es

Privacy policy

Last updated: 2026-08-07.

Data controller

The data controller is 3-102-961689 SOCIEDAD DE RESPONSABILIDAD LIMITADA (legal entity ID 3-102-961689), domiciled in San José, Santa Ana, Uruca, Costa Rica. VegasiO is the trade name under which we operate the website and application. For privacy questions, email [email protected].

Scope and minimum age

This policy applies to the website, Discovery web, the community, accounts, and client portals. The services are intended exclusively for people aged 18 or older acting on their own behalf or for an organization.

Data we collect

  • Contact and advisory: name, work email, company, role, optional phone or WhatsApp, message, contact intent, and meeting details.
  • Discovery web: company, role, team size, industry, affected process, pain points, goals, previous attempts, urgency, budget authority, contact details, answers, conversation, and recommended outcome.
  • Account and client data: authentication identifier, name, email, profile photo when available, sign-in provider, company, profile, preferences, onboarding status, resources accessed, memberships, and project requests.
  • Community data: questions, answers, comments, votes, reports, and information required for moderation and notifications.
  • Usage and source: public pages visited, essential conversions and, with consent, UTM parameters, referrer, and landing page.
  • Security and operations: session data, IP address, and technical signals required to prevent abuse, diagnose failures, and deliver email.

We do not request sensitive categories of information. Do not include secrets, credentials, or third-party personal data in forms, posts, or Discovery conversations.

Fields marked as required are necessary to answer your request, create the account, or provide the requested feature; without them we cannot complete that action. Fields identified as optional, such as phone number on certain forms, may be left blank.

Purposes and legal basis

We process data to respond to requests, provide services, create and protect accounts, administer projects and the community, send operational communications and, when you authorize them, commercial communications you can unsubscribe from at any time, moderate content, prevent fraud, comply with legal duties, and improve the website. Depending on the activity, processing relies on your informed consent, steps you request before or during a contractual relationship, and applicable legal obligations.

Google Sign-In and Limited Use

If you choose Google Sign-In, we request only the openid, email, and profile scopes. From those we keep a stable account identifier, your name, your email address, and your profile photo when available. We use this data only to authenticate you, create and administer your account, protect access, and provide support.

We do not access Gmail, Google Drive, Google Calendar, or other Google Account data. Scheduling through Google Calendar or Google Meet is a separate integration loaded only when you choose to open it; it is not a Google OAuth permission.

Our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy. We do not sell this data, use it for advertising, retargeting, or commercial profiling, share it with analytics or advertising tools or with artificial intelligence model providers, or use it to train artificial intelligence models.

Discovery web and artificial intelligence

Discovery web uses the business context and conversation you provide to generate a preliminary qualification and non-binding commercial recommendation. To do so, that context may be sent to an artificial intelligence model provider we contract with, which may process it outside Costa Rica. Data obtained through Google Sign-In is never included in that request.

That request carries only the business context you describe: company, role, team size, industry, affected process, goals, and previous attempts. We do not send your name, email address, phone number, or any other contact details. Please do not include credentials, confidential information, or third-party personal data in those descriptions.

We select these providers against a constant standard, regardless of which one is currently in use: we configure the service so the data is not used to train models and so the request is not routed to alternative providers. Any processing the provider carries out on its own account, including temporary retention for safety or abuse prevention, is governed by its own terms and privacy policy. You can ask which provider is currently in use by writing to [email protected].

An automated recommendation does not replace human review and does not by itself create legal or contractual effects.

Analytics, marketing, and scheduling

With your optional consent, we may activate Google Analytics 4 to measure aggregate use of public pages and Meta Pixel to measure campaigns and essential conversions. We do not send account data, form contents, Discovery scores, or session identifiers to these tools. You can withdraw consent through Cookie preferences. Google Calendar receives a request only after you click to load or open the calendar.

Providers and international transfers

To operate the service, we may share strictly necessary data with:

  • Authentication and database providers.
  • Application hosting and delivery providers.
  • Automation-protection and media storage providers, including Cloudflare Turnstile on our forms.
  • Transactional email providers and providers for the communications you authorize.
  • Artificial intelligence model providers, only for Discovery business-context analysis.
  • Google, for sign-in, Google Tag Manager, Google Analytics, and visitor-initiated scheduling.
  • Meta, for Meta Pixel when marketing consent exists.

You can request the current list of providers by writing to [email protected].

Some providers process information outside Costa Rica. We limit transfers to the purposes described and use providers subject to applicable contractual commitments, privacy policies, and security safeguards. We do not sell personal data or provide lists to data brokers.

Retention and deletion

  • Contacts, leads, forms, Discovery sessions, and related email records: up to 24 months after the last interaction, unless a legal or contractual duty requires longer retention.
  • Account, profile, memberships, and Google Sign-In data: while the account remains active and then for the minimum period needed to close it or comply with applicable legal obligations.
  • Community content: deleted or anonymized when an account is closed where reasonable; an anonymized version may remain to preserve conversation integrity.
  • Contractual, accounting, and security records: for periods required by applicable law or reasonable backup and protection cycles.

Security

We apply technical and organizational measures appropriate to the risk of the processing, and we review them periodically. No system is infallible; if we identify a relevant incident, we will act in accordance with applicable law.

Your rights and revocation

Under Costa Rica Law 8968, you may request access, correction, updating, deletion, or portability where applicable, and withdraw consent. If you have an account, you can delete it from your profile: self-service deletion removes the access identity, profile, and memberships; anonymizes community questions and answers, deletes comments, and removes the email-provider contact after sending confirmation. Leads, forms, Discovery sessions, and contractual records are not automatically deleted by matching an email address; to request their review or deletion where applicable, write from the associated email address to [email protected]. We will address the request within the applicable legal period, generally five business days, subject to identity verification and legal exceptions.

You may also revoke Google access from the security section of your Google Account. Revocation prevents future sign-ins but does not automatically delete data already stored; email us or close your account to request deletion.

Changes and contact

We may update this policy to reflect legal or service changes. We will publish the current version and its update date. For any question or request, email [email protected].