Privacy policy

1. Who we are

Bamboo Lab is a digital accessibility services company based in Costa Rica that works with organizations in many countries. Bamboo Lab is the controller of the personal data described in this policy.

For any privacy question, email us at info@bamboolab.tech.

2. What data we collect

Data you give us

When you use the contact form, we collect:

• Full name and email address (required).
• Phone number and company name (optional).
• The message you write to us.
• Your consent to receive communications and the form language.

Website usage data

We use Umami to get aggregated statistics: pages visited, referring page, device and browser type, and approximate country. Umami does not use cookies and does not store your IP address. We cannot identify you from this data.

Technical data

Our hosting provider generates technical logs (for example, IP address, date and browser) for security purposes. In addition, to prevent abuse, the contact form temporarily stores a hashed version of your IP address for 10 minutes.

3. How we use your data

• To answer your request and prepare a service proposal.
• To follow up on your request and send related communications, if you agreed.
• To understand how the website is used so we can improve it.
• To protect the website and the form against spam and abuse.

We do not use your data for automated decision-making or advertising profiles.

4. Legal basis

We process your data based on:

• Your informed consent, under Costa Rica’s Law on the Protection of Individuals with regard to the Processing of their Personal Data (Law 8968) and, where applicable, the European Union General Data Protection Regulation (GDPR).
• Pre-contractual steps you request, such as a quote.
• Our legitimate interest in keeping the website secure and measuring its use anonymously.

5. How long we keep data

• Requests that do not become a business relationship: up to 24 months from the last contact.
• Clients: for the duration of the business relationship and any additional period required by legal, accounting or tax obligations.
• Umami statistics: up to 6 months.
• Temporary form abuse record: 10 minutes.

6. Who we share your data with

We do not sell or rent your personal data. We only share it with:

• Hostinger, our web hosting and email provider.
• Umami, our analytics provider (non-identifying usage data only).
• Providers of the artificial intelligence tools we use in our services, under confidentiality terms (see section 12).
• Competent authorities, when required by law.

7. International transfers

Our providers may process data outside Costa Rica or your country. We work with providers that offer appropriate data protection safeguards.

8. Your rights

You can exercise your rights at any time to:

• Access: know what data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection and restriction: ask us to stop or limit using your data.
• Portability: receive your data in a commonly used format.
• Withdraw your consent, without affecting processing carried out before.

To exercise them, email info@bamboolab.tech with the subject “Privacy”. We will respond within the time limits set by applicable law. You can also file a complaint with Costa Rica’s Data Protection Agency (PRODHAB) or with the data protection authority in your country.

9. Cookies and local storage

This website does not use tracking or advertising cookies. The contact form may save a temporary draft in your browser storage so you do not lose what you wrote if an error occurs. That draft never leaves your device and is deleted when the form is submitted successfully or when you close the tab.

10. Security

We use encrypted connections (HTTPS), restricted access to information, and reasonable technical and organizational measures to protect your data. No system is completely infallible; if an incident affects your data, we will notify you as required by law.

11. Client data during our services

When auditing digital products, we may access systems that contain third-party personal data. That processing is governed by the service contract and the confidentiality or data processing agreements signed with each client, not by this policy.

12. Use of artificial intelligence tools

We use artificial intelligence tools to support part of our work, for example to scan entire websites with a crawler or to draft VPAT / ACR reports. When we do:

• We process each project’s information under the confidentiality agreements signed with the client.
• We choose providers that do not use the information we send them to train their models, and we avoid including personal data when it is not needed.
• A Bamboo Lab specialist reviews and validates every result. We do not make automated decisions that affect you.

13. Minors

Our services are aimed at organizations. We do not knowingly collect data from anyone under 18.

14. Changes to this policy

We may update this policy. Any changes will be published on this page with their update date.