Privacy policy

This is a starter template. Replace this placeholder with your jurisdiction-specific privacy policy before accepting user data.

WHAT WE COLLECT

Identity email and password hash. Per-workspace display name and avatar. Audit-log rows for sign-in, role changes, and key rotations. No tracking pixels, no analytics SDK.

WHO SEES IT

Your workspace owners can see all data inside their workspace. rojas.cr operators can see tenant-level metadata (slug, plan, status). No cross-workspace data sharing.

WHERE IT LIVES

Cloudflare D1 (SQLite) + R2 (blobs). Sensitive fields are encrypted with a per-tenant derived key. Keys are versioned and rotatable by operators.

YOUR RIGHTS

You can delete your account from /account/security at any time; deleting scrubs your personal data. To request a copy of your data, contact us.

For questions, contact hola@rojas.cr.

Data subject rights

You may request access to, correction of, or deletion of your personal data at any time. To exercise these rights, contact us at hola@rojas.cr.

Forks of this kit serving regulated jurisdictions should replace this copy with regulation-specific wording (GDPR Art. 13–22, LGPD Art. 18, Ley 8968 ARCO, etc.).