Privacy policy

Tierramor Hospitality LLC runs Tierramor and this website, tierramor.cr. We are responsible for the information described here. Our registered address is 251 Little Falls Drive, Wilmington, Delaware 19808, United States. Tierramor itself is a farm, residency and events project in Río Montaña, Nosara, Costa Rica.

We collect information when you give it to us, and we say why next to each one.

When you send us a question on the residencies page. Your first and last name, email, phone number, the residency you're asking about, your question, your Instagram handle or another username or link you share, whether you chose WhatsApp or text, and your answer to our text-message box if it is shown. We save them when you press the button that opens your messaging app, so we can answer you even if your message never sends. The message itself reaches us through WhatsApp (run by Meta) or your phone carrier, like any message.

When you book a call, or ask us for a call time. On the first step: your first and last name, email, phone number and whether it's on WhatsApp, a social link, your time zone, and your answer to our text-message box if it is shown. We save these when you press Next, so we can follow up if you don't finish. On the second step: where you're based, your age range, the dates you're considering, what draws you here, and the time you pick or the times that suit you.

When you reserve a residency. The name and email of everyone who will stay, which residency and casita, the dates, and who paid. The person paying also gives a phone number, which Stripe collects with the payment. Your card is handled by Stripe, never by us; if you pay a deposit, Stripe keeps the card on file to take the balance on the date we tell you.

When you buy an event ticket. The payer's name, email and phone, what you booked, and any allergies you tell us about for the meal.

When you stay with us. On your own stay page we ask for what a stay needs: how and when you arrive (your flights and airport, whether you'd like a ride, and whether you'd like our transport contacts), what you eat and any serious allergies, anything about your health the kitchen or the team should know, an emergency contact, who you're travelling with, whether you agree to appear in photos, whether you have travel insurance, and your signature on the participant agreement. You can also tell us if your birthday falls during your stay, something you'd like to share with the group (a skill, a story, a dish, a song), and anything else we should know. If our accountant needs it for an invoice, we ask for your ID or passport number. After your stay we ask how it was; we quote your answers publicly only if you tick the box that says we may.

When you sign up for the newsletter, a waiting list or the Residency Guide. Your email, your name if you give it, which residency you're interested in if you choose one, and which page you signed up from.

When you write to us through another form (an event question, hosting an event, the farm and nursery, becoming an Experience Host, or partnering with us). Your name, email, phone if you give it, and your message. If you applied for a residency before October 2026, we also hold that application.

When you contact us by email, WhatsApp, text or Instagram. We keep the conversation, so we know what you asked.

How you found us. With any form above, we also record the page you arrived on, the site that sent you, and any campaign tags in the link you clicked. Your browser keeps these for your visit (in its own storage, not a cookie) until you send a form. This tells us which of our efforts reach people.

To keep robots off our forms. On some forms we count how often your internet address sends them, using a scrambled code made from the address that can't be turned back into it, changes every day, and is deleted soon after a day. The payment form keeps your internet address in memory for ten minutes for the same reason.

What we never ask for: card numbers (Stripe holds those), or anything about your religion, politics or sexuality. Health notes and allergies are the one sensitive thing we ask for, and you choose what to write.

We never sell your information, and we never share it with anyone for their own marketing. These companies see it because they run part of our service, on our instructions:

• Vercel hosts the website and counts visits without cookies.
• Supabase stores our database (questions, call bookings, enquiries, sign-ups, reservations and stay pages) and our videos.
• Cloudflare plays the video on our home page, so it sees your internet address.
• Stripe takes card payments and holds your card details.
• GoHighLevel (LeadConnector), with Mailgun holds our contact list, our call calendar and our conversations with you (email, text and WhatsApp), and sends our emails and texts. It holds what a booking needs: your answers to the call form, whether you have allergies for a stay (yes or no), and the allergies you tell us about for an event meal. It never holds your stay-page health notes or your emergency contact.
• Meta carries WhatsApp messages between you and us, and measures our ads (section 5).
• Anthropic writes our team's daily summary of who is waiting for a reply, from names and where each person is in our process.
• Retreat Guru holds bookings made before our own booking page, and their payments.
• Google Workspace runs our team email.
• PostHog and Google Analytics measure the site (section 5).

Inside Tierramor, only our team can sign in to our admin system. Stay pages, health notes, allergies and emergency contacts are visible only to the team members who sign in to it.

Before you choose, a few things run, and none sets an advertising cookie: Vercel counts the visit without cookies; Google's tag loads in a mode that sets no cookies and sends Google anonymous signals (it still receives your internet address and browser type, as any website request does); our banner records that it was shown, on which page, and later the choice you make, with no identifier. Things you do before choosing are held in your browser and sent to PostHog only if you then accept.

If you accept, some or all of these run, depending on what you accept:

• PostHog shows which pages are visited and which buttons are clicked, so we can see where the site confuses people. Its servers are in the United States. If you then send us a form, we link your visits to the email you gave. It does not record your screen.
• Google Analytics shows how many people visit and where they came from. If you accept marketing cookies, it may also set Google's advertising cookies.
• The Meta pixel shows whether our Instagram and Facebook ads work, and lets Meta show ads to people with similar interests.
• Instagram posts from our guests, on the residencies page, load from Instagram, which sets its own cookies.

Our server's report to Meta. When you book a call, ask for a call time, send us a question through the residencies page, or pay for a residency, our server tells Meta that it happened, so we can see whether our ads bring people who actually talk to us. It sends your email and phone only in scrambled form, which Meta can match to an account it already knows but cannot read, together with your internet address, your browser type, Meta's own browser cookies if you have them, the page, the residency, and for a payment the amount. We send it unless you said no to marketing cookies, including when you haven't answered the cookie banner yet. If you said no, we never send it. You can say no at any time with the button below.

Paying. Stripe's payment form sets its own cookies to tell real payments from fraud. They are for the payment, not for marketing: __stripe_mid (kept for one year) and __stripe_sid (kept for 30 minutes). They are set only when you reach a payment step.

What your browser stores for us: your cookie choice, and how you found us (section 2).

• Questions, call bookings, applications and enquiries: until you ask us to delete them. Once a year we clear out enquiries that never became a booking.
• Newsletter and waiting-list sign-ups: until you unsubscribe. After that we keep only the fact that you unsubscribed, so we never email you by accident.
• Your stay record (arrival, allergies, health notes, emergency contact): until you ask us to delete it, so your next stay starts filled in for you to check. Ask us and we delete it.
• Payment and invoice records: as long as tax law requires.
• Measurement data: as long as each tool in section 5 keeps it.

Our tools store information in the United States and other countries, not only in Costa Rica. When it leaves the European Union, the United Kingdom or Costa Rica, it is protected by the European Commission's standard contractual clauses, which these companies include in their data processing terms, and for some by the EU-US Data Privacy Framework.

The site runs only over a secure connection (HTTPS). Only our team can sign in to the admin system, and only a few people can reach the database. Health notes, allergies and emergency contacts are visible only to team members who sign in. And we hold as little as we can, which is the one protection that never fails.

You can ask us to:

• send you a copy of what we hold about you, in a file you can take elsewhere;
• correct it;
• delete it;
• stop using it for marketing;
• withdraw any consent you gave.

How: write to hello@updates.tierramor.cr. We reply within 30 days, and it's free.

If you're not satisfied, you can complain to Costa Rica's data protection agency (PRODHAB, the Agencia de Protección de Datos de los Habitantes), the data protection authority where you live in Europe, the UK's Information Commissioner's Office, or Canada's Office of the Privacy Commissioner.

Every marketing email has an unsubscribe link, and it works right away. If you unsubscribe and later book a stay, we may switch email back on for your contact so the emails your booking needs (confirmation, arrival details, your balance) reach you; the newsletter stays off.

If you send us a question through the residencies page, we reply in the app you chose. Straight away we also send a short note so you know we have it: a text from our US number if you chose text, or an email if you chose WhatsApp (WhatsApp lets a business write first only with approved templates). These replies are only about your question, never marketing.

Marketing texts are separate and optional. Where a form offers a box to receive our texts, it is never pre-ticked, and saying yes is never a condition of booking anything. If you tick it, Tierramor Hospitality LLC may text you offers, event news and service announcements. How often varies, and message and data rates may apply. Reply STOP to any text to stop, or HELP for help. We never share your mobile number or your text consent with anyone for their marketing. Our texts are sent through LeadConnector, the GoHighLevel service in section 4.

This site is not for anyone under 16. Guests aged 16 and 17 can join a residency only with a parent in the same casita, and the parent signs the agreement for both. We don't knowingly collect information about anyone younger. If you think we have, write to us and we'll delete it.

Some US state laws treat letting an advertising company see your activity as "sharing" your information. Three things we use work this way: the Meta pixel and Instagram's posts (only if you accept marketing cookies), and our server's report to Meta (unless you say no, section 5). You can say no to all three at any time with the cookie button. We don't sell your information, and we don't use sensitive information to make guesses about you.

When we change this policy, we update the date at the top. If a change affects how we use information you've already given us, we email you before it takes effect.

Questions, or any request in section 9: hello@updates.tierramor.cr.

Post: Tierramor Hospitality LLC, 251 Little Falls Drive, Wilmington, Delaware 19808, United States.