Privacy policy | Corectia

1. Who we are

Corectia is the business name of Ernesto Gavier (CUIT 20-41680065-1, Palenque 1268, Villa Allende, Córdoba, Argentina), a business-to-business consulting service operated from Argentina for business clients, mainly in the United States. We are the controller (the “business”) of the personal information described here. This policy explains what personal information we collect through corectia.com and our booking and contact tools, how we use it, and the choices you have. It covers visitors and prospective clients. Information shared inside a signed client project is also governed by our written agreement with that client.

2. Information we collect

Contact form: your name, email address, team size, website, and your answer to the question “What slows your business down the most?”
Booking (Cal.com): your name, email address, any notes you add, and the time you choose.
Video calls: if we meet on Google Meet or Zoom, the audio and video of the call, handled by that provider.
Payments: if you buy, your name, email, billing details and payment confirmation. Cards are processed by PayPal, and ACH and wire transfers go through your bank. We do not receive or store full card numbers.
Campaign data: UTM parameters from the link that brought you to our site and, if advertising cookies are on, ad click IDs (such as Google’s gclid and Meta’s fbclid). We keep them in a first-party cookie, pass them to the booking page and the contact form, and save them with your inquiry in our records.
Technical data: IP address, browser, device and pages visited, collected by Cloudflare (hosting, security, the Turnstile anti-spam check and aggregate site statistics) and by the analytics and advertising tools in section 3.
Server-side advertising events: if advertising cookies are on, when you book a call or become a client, we send Meta and Google the event together with your email address (converted to a hashed code), IP address, browser details and click ID. When a prospect becomes a client, we also send Google, once a month, the click ID, hashed email and the project value.
Video playback: playback data and cookie IDs when you play a video embedded from YouTube.
Business records: if you become a client, the project information you give us, and a backup copy of the work we build for you, kept for security and recovery.

Please do not put sensitive information (for example health, financial account or government ID numbers) in the message field. We do not ask for it. Our services are directed to businesses, and we do not knowingly collect personal information from anyone under 18.

3. Cookies, tags and advertising

We use Google Tag Manager to run Google Analytics, a Google Ads tag and the Meta Pixel. These tools set cookies and receive information about your visit, such as pages viewed, device identifiers, IP address, browser details, and ad click IDs. We use them to measure how the site is used, to measure and improve our ads, and to show our ads to people who visited the site. Videos on the site are embedded from YouTube, and the booking calendar is embedded from Cal.com. Each of them can set its own cookies when you play a video or open the calendar, and their own privacy policies apply to what they collect. We also set first-party cookies to remember your cookie choices (12 months) and to keep campaign IDs (90 days).

A banner on your first visit explains these choices. For visitors outside the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies are on by default, and you can turn them off for your browser at any time with the “Your privacy choices“ link in the footer of every page, or with Global Privacy Control. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies stay off until you accept them in the banner.

You can also block cookies in your browser settings and use the controls in sections 5 and 6. Our site does not respond to “Do Not Track” browser signals, because there is no common standard for them. We do respond to Global Privacy Control.

4. How we use information and who receives it

We use your information to answer your inquiry, schedule and run calls, scope and deliver projects, keep records, secure the site, and measure our marketing. We do not use it for anything else without telling you.

Service providers who process information for us: scheduling (Cal.com), video calls (Google Meet or Zoom), payments (PayPal and banks), inquiry and project records (Notion), email hosting (Donweb), email delivery (Resend), hosting, security and site statistics (Cloudflare), and the software and AI tools we use to deliver projects, which we configure so that your information is not used to train their models where the provider offers that option. Advertising and analytics partners: Google and Meta, which receive information as described in sections 3 and 5. We may also disclose information if the law requires it or to protect our rights.

5. Sharing, sale and your opt-out

We do not sell your personal information for money. Some state laws treat advertising and analytics tools, including the Meta Pixel, Google Ads, and the server-side events and monthly import described in section 2, as “sharing” personal information for cross-context behavioral advertising, or as a “sale”. To opt out of that sharing, use the “Your privacy choices“ link in the footer, email [email protected] with the subject “Opt out”, or turn on Global Privacy Control (section 6). Opting out also stops the server-side events and the monthly import.

6. Global Privacy Control

When your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing. Our site stops loading the Meta Pixel and Google Ads tag for that browser, and we do not send server-side events or the monthly import for you.

7. Your privacy rights

Wherever you live, you can ask us to tell you what personal information we hold about you and give you a copy, correct it, delete it, or stop sharing it for advertising. We will not treat you differently for asking. To make a request, email [email protected]. We may need to verify your identity, and we will respond within 45 days, or sooner if your local law requires it. If we deny a request, you may appeal by replying to our response, and we will answer the appeal in writing. An authorized agent may submit a request for you with your written permission.

8. How long we keep information

Inquiries and booking records that do not become a project: 24 months from last contact. Client project records, invoices and payment records: 7 years after the project ends, or longer where tax, accounting or contract law requires. Analytics data in Google Analytics: 14 months. Advertising data held by Google and Meta follows their settings, which we keep at the shortest period available. Email delivery logs at Resend: per Resend’s default retention. After these periods we delete or anonymize the data.

9. Processing in the United States and Argentina

We operate from Argentina and use providers that store data mainly in the United States. When you send us your information through the contact form or the booking page, you give your express and informed consent to its transfer to and storage in the United States and other countries where our providers operate, which may not offer the same level of data protection as Argentina. You may withdraw that consent at any time by writing to [email protected].

Under Argentine law (Law 25,326), you have the right to access, correct, update and delete your personal information. We answer access requests within 10 calendar days, and correction, update or deletion requests within 5 business days. You may exercise the right of access free of charge at intervals of not less than six months, unless a legitimate interest is shown under section 14(3) of that law. The Agencia de Acceso a la Información Pública (AAIP) is the oversight authority for that law and handles complaints from people whose data protection rights are not respected.

10. Security

We protect personal information with administrative, technical and organizational measures that are reasonable and appropriate to its nature and to the risks of processing it, in line with Argentine Law 25,326 and applicable US state law. The measures are designed to guard against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the information. They include:

Encryption in transit. The site is served only over HTTPS (TLS) with HTTP Strict Transport Security, and the connections between the site and our providers are encrypted.
Data minimization by design. The site has no user accounts, passwords or database of its own. Our forms collect only what we need to answer you. We do not receive or store full payment card numbers.
Network and application protection. The site is delivered through Cloudflare, with a web application firewall, rate limiting and an anti-spam check on our forms. Form submissions are validated and filtered, and booking notifications from Cal.com are accepted only if their digital signature verifies. The site applies browser security headers, including a Content Security Policy.
Access control. Access to our systems and records is limited to the people who need it for the purposes in this policy, on a least-privilege basis. Administrative accounts use multi-factor authentication, and access keys are kept in protected configuration, never in the public pages or source code.
Email authentication. Our email domain uses SPF, DKIM and DMARC to reduce spoofing and impersonation.
Maintenance. We monitor and update the software the site depends on, and review the third-party tools it loads.
Backups and disposal. Client project work is backed up for security and recovery. Information is deleted or anonymized at the end of the periods in section 8.
Service providers. We choose providers that maintain their own security programs and that may process information only to provide services to us or, in the case of Google and Meta, as described in sections 3 and 5. Their own security and privacy terms apply to the information they hold.

If we learn of a security breach that compromises personal information we hold, we will investigate and contain it, and we will notify affected individuals and the competent authorities without undue delay when applicable law requires us to do so.

Security is shared. Please do not send passwords, financial account numbers or other sensitive information through the contact form or by email, and tell us if you think your information or an exchange with us has been compromised. We welcome good-faith reports of security vulnerabilities at [email protected].

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Changes

We will post changes here and update the date above. If a change materially affects how we use your information, we will tell people who contacted us.

12. Contact

For privacy requests or questions: [email protected].