Privacy Policy
Effective 11/02/2026
Who we are
Lillys de la Selva, SRL (“we,” “us”) runs puentepacificocr.com (the “Site”). This policy explains what personal information we collect through the Site, how we use it, who we share it with, and the choices and rights you have.
This policy covers the Site and the messages you send us through it. It does not cover other websites or apps, even if we link to them.
What we collect
Information you give us
- Inquire form. Your name and email address. If you choose to add them, your phone number, your WhatsApp number, and your message. We also record the date and time you sent it.
- Email and messages. Anything you send us by email or WhatsApp.
- Guest access. If we invite you to the private pages, we keep your name, your email address, the dates your access is open, and a short note about your visit.
Information collected automatically
- Sign in. When you sign in, our sign in service records your email address, the time, your IP address, and basic details about your browser and device.
- Server logs. Our hosting provider records standard technical details when any page loads: IP address, browser type, the page requested, the referring page, and the time. We use these to run and secure the Site.
- Spam protection. The Inquire form and sign in use Google reCAPTCHA Enterprise and Firebase App Check to tell people from automated programs. They collect device and usage information, such as IP address, browser details, and how you interact with the page. Google’s Privacy Policy and Terms of Service apply to that information.
- Analytics. See “Analytics and cookies” below.
Name and email are required so we can reply. Without them we cannot answer your message. Everything else is optional.
We do not ask for and do not want sensitive information, such as health details, government ID numbers, or payment card numbers. Please do not send them through the form.
Analytics and cookies
We use Google Analytics on the public pages of the Site to see how they are used. It never runs on the private pages. It sets cookies and records pages viewed, time on page, the site that referred you, device and browser type, approximate location at the city or country level, and whether you sent the Inquire form. Google Analytics does not log or store full IP addresses. We have turned off Google’s advertising features and data sharing for advertising. We do not run Google Analytics for visitors in the European Economic Area.
You can turn analytics off at any time with the button at the end of this policy. If your browser sends a Global Privacy Control signal, analytics does not run. Browsers’ “Do Not Track” setting has no common standard, so we rely on Global Privacy Control instead.
The Site also stores a few small items in your browser:
| Item | Purpose | How long |
|---|---|---|
| Color choice | Remembers light or dark mode | Until you clear it |
| Analytics choice | Remembers whether you turned analytics off | Until you clear it |
| Pending sign in email | Completes sign in when you open the emailed link | Until sign in finishes |
| Sign in records and token | Keep invited guests signed in | Until you sign out or clear them |
| App Check token | Spam and abuse protection | Short lived, renewed by Google |
| Message limit counter | Limits how many messages one browser can send | About one hour |
| reCAPTCHA | Spam protection | Set by Google |
| Google Analytics (_ga) | Counts visits on public pages | Up to 2 years, renewed on each visit |
You can block or delete cookies in your browser settings. Some parts of the Site, including sign in and the Inquire form, may then not work.
How we use your information
- To reply to you, by email, phone, or WhatsApp, using the details you gave us
- To give invited guests access to the private pages, and to end access when the invitation ends
- To plan and arrange a visit you asked about
- To keep the Site secure and to stop spam and abuse
- To understand how the public pages are used and to improve them
- To meet legal obligations, and to protect our rights, our guests, and the home
We do not send marketing email. We do not use your information for automated decisions that have legal or similar effects on you.
Who we share it with
We share personal information only as described here.
- Service providers who run parts of the Site for us, under contracts that limit how they use it:
- Google (Firebase Hosting, Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, reCAPTCHA Enterprise, Google Analytics)
- Google Workspace, which carries our email
- WhatsApp (Meta), only if you give us a WhatsApp number and we reply there. WhatsApp is not our service provider. Its own terms and privacy policy apply to those messages.
- People who help with a visit you arrange, only what they need to do their part, and only if you arrange a visit.
- Legal reasons. When the law requires it, or to protect the rights, property, or safety of us, our guests, or others.
- A change of control. If the Site or the home changes hands, information may pass to the new owner under the same protections.
We do not sell your personal information. We do not share it for cross context behavioral advertising. These terms have the meaning used in California law and similar US state laws.
How long we keep it
| Information | How long |
|---|---|
| Inquire messages | Up to 24 months after our last exchange, unless a visit or the law needs it longer |
| Guest access records | Deleted within 90 days after access ends, unless you ask us to keep them for a future visit |
| Sign in and server logs | Kept by our providers under their standard settings |
| Google Analytics data | Detailed data is deleted after 14 months. Summary reports may be kept. |
How we protect it
The private pages and photos sit behind sign in. Security rules are designed to check each request against the invited guest list. Data travels over encrypted connections (HTTPS). Access to stored data is limited to the people who need it. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
International transfers
We and our service providers may store and process information in the United States, Costa Rica, and other countries. Those countries may have different data protection rules than where you live. Where personal data leaves the European Economic Area, the United Kingdom, or Costa Rica, we rely on appropriate safeguards, such as the EU-U.S. Data Privacy Framework and its UK extension, Standard Contractual Clauses, or your consent.
Your rights and choices
Everyone who uses the Site may ask us to:
- See the personal information we hold about you
- Correct it
- Delete it
- Stop using it for a purpose you object to
Email moc.rcocificapetneup@aloh. We may need to confirm your identity before we act. We answer requests under Costa Rica law within 5 business days, and other requests within 30 days, or sooner where the law requires. We will not treat you differently for using these rights.
Costa Rica. Law 8968, the Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Protection of the Person Against the Processing of their Personal Data), and its regulations give you the rights of access, rectification, and deletion of your data, and the right to be informed about how it is used. We ask for your express consent before we use the information you send through the Inquire form, including its transfer to service providers outside Costa Rica. You may withdraw consent at any time by email. You may also file a complaint with the Agencia de Protección de Datos de los Habitantes (PRODHAB).
European Economic Area and United Kingdom. The GDPR and the UK GDPR may apply. Lillys de la Selva, SRL is the controller of your personal data. You can reach us at moc.rcocificapetneup@aloh. Our legal bases are:
- Steps you ask for before an agreement, to answer your inquiry and arrange a visit
- Legitimate interests, to give invited guests access, to keep the Site secure, to stop spam, and to understand how the public pages are used. You may object at any time.
- Analytics. We do not run analytics for visitors in the European Economic Area. For UK visitors, we rely on the exemption for statistics cookies, with this notice and the free opt out button below.
- Legal obligation, where the law requires us to keep or disclose information
You also have the right to restrict use of your data and to receive a copy in a portable format. We will respond within one month. You may complain to the data protection authority where you live or work.
United States. Depending on where you live, state privacy laws (including California, Colorado, Connecticut, Virginia, and others) may give you the rights listed above, plus the right to opt out of sale, sharing, and targeted advertising. We do not sell or share personal information or use it for targeted advertising, so there is nothing to opt out of. We honor the requests above for all US visitors, whether or not a state law applies to us. You may use an authorized agent. If we deny a request, you may appeal by replying to our answer.
Other places. If you live somewhere else, you may have similar rights under local law. Email us and we will help.
Children
The Site is not directed to children. You must be 18 or older to use the Inquire form or to accept a guest invitation. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us information, email us and we will delete it.
Changes
We may update this policy. The effective date above shows the latest version. If a change is significant, we will note it on this page.
Contact
Lillys de la Selva, SRL
moc.rcocificapetneup@aloh