Privacy Policy

1. Who is responsible

Noscius, based in Costa Rica, is responsible for the personal data described in this policy. Contact: soportenoscius@gmail.com.

We follow Costa Rica’s Law 8968 on the Protection of Individuals with regard to the Processing of their Personal Data and its regulations.

There is one important distinction:

• Your account and our relationship with you. For the data we need to run accounts, the waitlist, billing and support, Noscius decides how it’s used and is responsible for it.
• What your company records in Noscius. For the inventory and documentation a company stores (which may include names of its staff or contractors), the company decides what to record. Noscius processes it on the company’s behalf. Requests about that data should go to the company first; we’ll help them answer.

2. What we collect

• Account data: name, work email, password (stored only as a one-way hash, never readable), the companies you belong to, your role and access dates.
• Company data: company name, country, industry, size and, optionally, its legal ID.
• Waitlist requests: name, work email, company, country, size and the message you choose to write.
• Activity in the application: the change history each company keeps (who changed what and when) and, for each signed-in browser, when it was last active.
• Technical data: IP address and browser type, used to protect sign-in and forms against abuse and to show you your active sessions.
• Messages: what you write to us by email.

We don’t collect payment card numbers ourselves; when billing opens, payments will be processed by a specialized payment provider.

3. Why we use it

• To create and secure your account, confirm your email and let you sign in. Basis: providing the service you asked for.
• To run the application for your company, including roles, invitations and history. Basis: the agreement with your company.
• To answer waitlist requests and tell you when your company can start. Basis: your consent, which you can withdraw at any time.
• To send service emails (confirmations, invitations, password resets, important notices). These aren’t marketing and can’t be turned off while you have an account.
• To detect and prevent abuse, fraud and attacks. Basis: our legitimate interest and legal obligations.

We don’t sell personal data, we don’t use it for advertising, and we don’t profile you.

4. Cookies

Noscius only uses the cookies needed to keep you signed in and to protect forms. We don’t use advertising or third-party tracking cookies, so there is nothing to opt into. The browser’s local storage may remember small interface preferences (for example, a filter you chose); that never leaves your device.

5. Who processes data for us

We use a small number of providers to run the service. Each only receives what it needs and is bound to protect it:

• Vercel: hosting and delivery of the application.
• Neon: the PostgreSQL database where accounts and company data are stored.
• Upstash: rate limiting to protect sign-in and forms (stores short-lived counters keyed by email or IP).
• Resend: sending service emails.

These providers may store or process data outside Costa Rica, mainly in the United States. We choose providers that offer contractual and technical safeguards for that. We may also disclose data when a competent authority requires it by law.

6. How long we keep it

• Account and company data: while the account or company exists, plus up to 30 days after it is closed so it can be exported.
• Waitlist requests: until you join, ask to be removed, or one year without activity, whichever comes first.
• Email confirmation and password links: they expire within 24 hours and 1 hour respectively.
• Rate-limit counters: minutes to hours.
• Backups made by our database provider expire on their normal schedule.

7. Your rights

Under Law 8968 you can ask to access your personal data, correct it, delete it, or object to its processing, and you can withdraw consent you gave (for example, for the waitlist). Write to soportenoscius@gmail.com from the address involved, and tell us what you need. We’ll answer within the time limits set by the law, and it’s free.

If you think we didn’t handle your request properly, you can file a complaint with Costa Rica’s Agency for the Protection of Individuals’ Data (PRODHAB).

8. How we protect it

Connections are always encrypted, passwords are stored as one-way hashes, each company’s data is isolated at the database level, and sign-in is protected against repeated attempts. If we ever learn of a breach that affects your personal data, we’ll notify you and the authorities as the law requires.

9. Minors

Noscius is a business tool and isn’t meant for people under 18. We don’t knowingly collect their data.

10. Changes to this policy

If we change this policy in a way that matters, we’ll tell account owners by email or in the application before it takes effect. The date at the top shows the current version.