1. What we collect
We only collect what you type into the contact form or the quote builder: name, email address, phone (optional), company (optional), city (optional, in the quote builder), the services you select, the estimated budget and timeline if you give them, and the message or project description. With each submission we also record the page language, your browser's preferred language —so we can answer in your language— and which form it came from. To stop abuse, your IP address is processed hashed (SHA-256) and is not stored in clear. When you tick the authorization box, Google reCAPTCHA also collects technical data about your browser, your IP address and your interaction with the page to estimate whether a person is sending the form (sections 4 and 5).
2. What we use it for
We use your data to answer your request and prepare the proposal you asked for; to send you an email confirming we received it; to follow up on that conversation; and to protect the form against spam and abuse. We do not use your data for third-party advertising and we do not sell it.
3. Legal basis
The basis is your prior, express and informed authorization: the box you tick before sending the form. Proof of that authorization travels with your request and is recorded, with its date, in the email through which we receive it. The Google reCAPTCHA check starts when you tick that box, not before. You can withdraw your authorization at any time by writing to us.
4. Processors and international transfers
Your request reaches our team by email. These processors take part along the way, and they may only use your data to provide their service to us: Resend, which delivers the notification email to our team and the confirmation email to you; Hostinger, which hosts the site and our business email; and Google, which provides the Gmail account where the team receives a copy of every request. Google reCAPTCHA also operates under the Google Privacy Policy and Terms of Service. Some of these providers are outside Colombia, mainly in the United States: by authorizing the processing you also authorize that international transfer, limited to the purposes of this policy. We do not share your data with anyone else, unless a competent authority requires it.
5. Automated spam checks
Before a request is delivered, the site checks it automatically: a hidden field only robots fill in, how long the form took to complete, a limit of three submissions per hour and, with Google reCAPTCHA, a score from 0 to 1 of how likely it is that a person is sending it. If the score is very low, the form does not accept the submission and tells you to message us on WhatsApp or by email. If there is doubt —a middling score, or a message that looks like a sales pitch— the request does reach us, flagged for a person to review, and we do not send you the automatic confirmation email. These checks only decide whether the form accepts the submission; they have no other effect on you.
6. How long we keep it
We keep requests in the team's email inboxes for 24 months from our last contact with you, a reasonable period for follow-up. If you ask us to delete them sooner, we do so and confirm it. Resend keeps a technical record of sent emails for the period its policies set. The submission-limit counter uses only your IP hash and expires after an hour.
7. Your rights
You can access, update and correct your data; request proof of your authorization; be informed of how we use it; file complaints with the Superintendencia de Industria y Comercio; and withdraw your authorization or request deletion where no legal duty requires us to keep it. To exercise them, write to holabeleafdesign.co with the subject "Personal data". We reply within the legal terms: 10 business days for queries, 15 business days for claims.
8. Cookies and analytics
This site uses Google Analytics 4 to measure visits and navigation through cookies and similar technologies, plus the technical storage needed to remember the language you chose. When you tick the authorization box of a form, Google reCAPTCHA loads its script and may set its own cookies (such as _GRECAPTCHA) to tell people from robots; Google does not use them for personalized advertising. You can delete or block cookies in your browser settings; if you block reCAPTCHA, the form will not be able to verify your submission and you can message us on WhatsApp or by email.
9. Security
The site is served over HTTPS and form data travels encrypted to the email provider. Access to the inboxes where we receive requests is restricted to the team that handles them, and service keys are never published on the site. No control is infallible: if we detect an incident affecting your data, we will inform you and notify the authority as the law requires.
10. Validity and changes
This policy applies from the update date shown above and replaces earlier versions. Your data is kept for as long as the purpose you gave it for lasts, within the period in section 6. If we change it substantially, we will publish the new version on this page with its date.
11. Controller and contact
Data controller: beleafdesign — Medellín, Antioquia, Colombia. Email for personal data matters: holabeleafdesign.co. Phone and WhatsApp: +57 322 534 2120.