Privacy Policy

1. Overview

NOUS helps organizations design, build, and deploy AI-ready technology systems. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, contact us, subscribe to our newsletter, become a client, or work with us on AI, automation, software, infrastructure, training, or consulting projects.

This policy is available in English and Spanish. If there is any conflict between versions, the English version controls unless a signed agreement or applicable law requires otherwise.

This policy is intended to comply with applicable privacy principles, including Costa Rica’s Law No. 8968 on the Protection of the Person regarding the Processing of Personal Data, the EU/UK General Data Protection Regulation when it applies, and other privacy laws that may apply based on where you are located or how we interact with you.

2. Who is responsible for your information

NOUS is responsible for the personal information described in this policy unless a separate written agreement says otherwise.

For privacy questions or requests, contact us at privacy@nous.cr.

3. Personal information we collect

We collect personal information in the following ways.

Information you provide to us

• Contact details: Name, e-mail address, phone number, organization, role, and preferred contact method.
• Inquiry details: Subject, message, areas of interest, project goals, business context, technical needs, and any files or materials you choose to share.
• Initial-contact interactions: Replies, call details, recordings, transcripts, summaries, and next-step notes from Augustus or other NOUS support workflows when you choose e-mail, WhatsApp, or phone follow-up.
• Newsletter information: E-mail address and subscription preferences.
• Client and project information: Information shared during discovery, proposals, contracts, workshops, support, training, implementation, and ongoing service work.
• Billing and administrative information: Tax, invoicing, payment, procurement, and contract records when needed for a business relationship.

Information collected automatically

When you use our website or services, we may collect limited technical information, including IP address, browser type, device type, operating system, pages visited, timestamps, referring pages, logs, user agent, and basic security or performance data.

Our website forms may collect technical metadata such as IP address and user agent for security, abuse prevention, and operational reliability. Augustus records aggregate operational events, language, model, response times, and token usage through Cloudflare. These chatbot metrics contain no message text, answers, IP addresses, contact details, or visitor identifiers. Opening the chat, preparing a contact draft, and successfully saving a contact inquiry are counted as events rather than tracked across an identified visitor journey.

Information from third parties

We may receive information from business partners, referrals, public professional profiles, event organizers, software platforms, payment or procurement systems, and service providers that help us operate our business.

4. AI, automation, and project data

Augustus website chatbot

When you send a message to Augustus, OpenAI processes your message, bounded recent conversation history, and public context from the page you are viewing, including selected text, to generate a reply. Avoid sharing sensitive information, secrets, or credentials. NOUS does not save chatbot text in its analytics or contact database unless you choose to submit it through the contact form.

Recent completed chat turns and contact drafts are kept in your browser tab’s session storage and expire after 30 minutes. You can reset the chat or discard a contact draft. The contact bridge shows an editable draft for your review; it does not send an inquiry automatically. A draft submitted through the contact form follows the contact retention and follow-up practices in this policy.

The chatbot uses the OpenAI API with response storage disabled. This does not mean zero provider retention: OpenAI may retain abuse-monitoring logs under its API data controls. Standard API abuse-monitoring retention may be up to 30 days, subject to the applicable provider terms and settings.

Client project data

Because NOUS works with AI systems, clients may share business information, documents, prompts, datasets, workflows, recordings, transcripts, or other materials that contain personal information.

We use this information only to provide, evaluate, secure, improve, and support the agreed work, unless we have another lawful basis or explicit permission.

We do not intentionally use a client’s confidential project information or personal information to train public AI models unless the client has explicitly approved that use in writing. When we use third-party AI model providers or AI infrastructure providers, we aim to configure them under business, enterprise, API, or data-processing terms appropriate for the work.

Clients should avoid sending sensitive personal information, regulated health data, payment card data, secrets, credentials, or highly confidential material unless it is necessary for the project and we have agreed on appropriate safeguards.

5. How we use personal information

We use personal information to:

• Respond to inquiries and establish first contact;
• Contact you through your selected method, including e-mail, WhatsApp, phone, and automated support workflows where disclosed;
• Evaluate opportunities, scope work, prepare proposals, and provide services;
• Build, deploy, maintain, support, and improve technology systems;
• Run AI discovery, training, automation, integration, and implementation work;
• Communicate about projects, support, billing, contracts, and operations;
• Send newsletters, field notes, updates, and other communications you request or consent to receive;
• Protect the security, integrity, and availability of our website, systems, and services;
• Detect, prevent, and respond to spam, abuse, fraud, security incidents, and misuse;
• Comply with legal, accounting, tax, regulatory, dispute-resolution, and contractual obligations;
• Understand how our website and services are used so we can improve them.

6. Legal bases for processing

Depending on the context and applicable law, we process personal information based on one or more of the following legal bases:

• Consent: When you subscribe, ask us to contact you, approve optional communications, or allow optional processing.
• Contract or pre-contractual steps: When processing is needed to evaluate, enter into, perform, or manage a business relationship.
• Legitimate interests: When processing is necessary for responsible business operations, service improvement, security, fraud prevention, client communications, or administration, and those interests are not overridden by your rights.
• Legal obligations: When processing is required for tax, accounting, regulatory, legal, or compliance reasons.

Where Costa Rican law requires informed consent for certain processing, we will request it in a clear, specific, and informed way.

7. When we share personal information

We do not sell personal information. We share personal information only when needed for legitimate business, service, legal, or security purposes.

We may share information with:

• Service providers: Providers that support hosting, databases, e-mail delivery, website operations, analytics if enabled, customer communication, file storage, collaboration, billing, payment, security, and support.
• AI and cloud providers: Model providers, cloud platforms, vector databases, transcription tools, automation platforms, and infrastructure providers used to deliver approved AI or technology work.
• Professional advisors: Lawyers, accountants, auditors, insurers, and other advisors.
• Business counterparties: Clients, implementation partners, vendors, or contractors involved in a project, subject to appropriate confidentiality or contractual controls.
• Authorities or legal parties: When disclosure is required by law, legal process, public authority, court order, or to protect rights, safety, security, or property.
• Business transfers: If NOUS is involved in a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction, subject to appropriate safeguards.

8. International transfers

NOUS is based in Costa Rica, but we may use service providers, AI labs, cloud infrastructure, and business tools located in other countries.

When personal information is transferred internationally, we use appropriate safeguards where required, such as contractual protections, data-processing agreements, standard contractual clauses, access controls, and vendor due diligence.

9. Cookies and similar technologies

Our website may use essential technologies needed to operate the site, submit forms, secure services, remember preferences, and measure performance.

Augustus operational metrics do not set analytics cookies or create visitor identifiers. Browser-sent opening and draft-preparation events respect Do Not Track and Global Privacy Control; server-side reliability, usage, and saved-contact counts remain operational metrics. If we add marketing cookies or other non-essential tracking technologies, we will provide notice and controls where required by applicable law. You can also manage cookies through your browser settings.

10. Data retention

We keep personal information only as long as reasonably necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

Typical retention considerations include:

• Contact inquiries are kept long enough to respond, manage follow-up, and maintain business records;
• Newsletter records are kept while the subscription remains active and for a limited period after unsubscribe when needed for suppression or compliance;
• Client project records are kept for the term of the relationship and then as needed for support, legal, accounting, tax, security, or dispute purposes;
• Logs and technical records are kept for operational, security, debugging, and abuse-prevention purposes;
• Records subject to legal, tax, contractual, or regulatory obligations may be kept longer.

When information is no longer needed, we delete, anonymize, or restrict it according to reasonable business and legal requirements.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure.

These safeguards may include access controls, authentication, encryption in transit, secure cloud services, least-privilege permissions, vendor review, internal confidentiality practices, logging, monitoring, and incident response processes.

No website, software system, network, AI provider, or internet transmission can be guaranteed to be completely secure. If we identify a security incident involving personal information, we will assess it and notify affected individuals or authorities when required by applicable law.

12. Your rights

Depending on where you live and which law applies, you may have rights to:

• Confirm whether we process your personal information;
• Access personal information we hold about you;
• Correct inaccurate or incomplete information;
• Request deletion or suppression of information;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Request portability of information where applicable;
• Opt out of marketing communications;
• Lodge a complaint with a competent privacy authority.

For Costa Rica, privacy rights may include access, rectification, cancellation, and opposition rights under Law No. 8968. For the European Economic Area or United Kingdom, rights may include GDPR rights such as access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. For California residents, rights may include the right to know, delete, correct, opt out of sale or sharing, and limit certain sensitive personal information, where applicable.

To exercise a right, e-mail privacy@nous.cr. We may need to verify your identity before completing a request. We will respond within the timeframe required by applicable law.

13. Marketing and newsletter choices

You can unsubscribe from marketing or newsletter e-mails by using the unsubscribe link in the e-mail, if available, or by contacting privacy@nous.cr.

Service, security, transactional, legal, and administrative messages may still be sent when necessary even if you opt out of marketing.

14. Children

Our website and services are intended for organizations and adults. We do not knowingly collect personal information from children under 13, and we do not knowingly target children with our services.

If you believe a child has provided personal information to us, contact privacy@nous.cr and we will take appropriate steps.

15. Third-party links and services

Our website, communications, and project materials may link to third-party websites, platforms, or services. Their privacy practices are governed by their own policies, not this Privacy Policy.

16. Changes to this policy

We may update this Privacy Policy as our services, technology, legal obligations, or business practices change.

When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice.

17. Contact

Questions, requests, or concerns about this Privacy Policy should be sent to: