Privacy Policy

Google Analytics and cookies

We use Google Analytics 4 to see which pages get read and which listings get clicked. It sets cookies in your browser — named _ga and _ga_* — which hold a randomly generated number so that your second visit can be recognised as the same browser as your first. They expire after two years, and they do not contain your name, email, or anything you typed.

Through it, Google receives your IP address, your browser and device details, which pages you viewed, and roughly where you are (country and city level). Google acts as our processor for this and its own privacy policy also applies.

We do not ask you first, and you should know that

Most sites show a cookie banner before setting analytics cookies. We do not, and under EU rules we probably should. We would rather say that here than show you a banner we designed to be clicked through. If this matters to you, the next paragraph is the part that actually stops the tracking — which a banner would do no better.

How to opt out

• Install Google’s official opt-out browser add-on, which blocks Analytics everywhere, not just here.
• Turn on “Do Not Track” or tracking protection in your browser. Firefox, Safari and Brave block this by default.
• Use any ad or script blocker. We do not detect blockers, and nothing on this site breaks if you use one.

What we do not do

• There are no accounts and no forms. You cannot register, log in, or submit anything to us through this site.
• We do not sell or share personal data, and we have no advertising trackers — no ad pixels, no retargeting, no data brokers.
• We do not try to identify you. We never link the analytics data above to a name, and we have no way to, because we never collect one.

What we record about visitors

Outbound link clicks

When you click a link that leaves this site — a business’s website, “View on Google”, or “Get directions” — the click passes through a redirect on our servers. We record four things in our own server logs: the category, which listing it was, which kind of link you clicked, and which page you came from. That record holds no identifier and nothing in it identifies you.

The same click is also sent to Google Analytics, and that copy does include your IP address and the cookie identifier described above, so that the click can be matched to the visit it came from. Clicking a phone number or an email address on a listing is counted the same way. If you have opted out above, none of this reaches Google — only our own server log, which does not identify you.

We count these clicks because that number is what we will sell to advertisers, and we would rather tell you that directly than describe it as “improving our services”.

Note that our hosting provider, Amazon Web Services, keeps its own server logs at the infrastructure layer, as every web host does. Those are ordinary technical logs and are not used to build any profile of you.

Maps

Pages with a map load it from Google — interactive maps on the category pages, static map images on listing pages. Because your browser fetches those directly, Google receives your IP address and browser details on any page showing a map, and its own privacy policy governs that. Along with Google Analytics above, Google is the only third party that receives visitor data from this site today.

Data about listed businesses

We publish roughly 3,900 business listings compiled from publicly available sources, including Google Places data. No business applied to be listed, agreed to be listed, or paid to be listed.

Each listing may hold the business name, address, phone number, website, coordinates, opening hours, photos, publicly shown ratings and review counts, and amenity information. For surfboard shapers and surf shops we may also hold a public email address and social media handles.

Most of this is information about a company rather than about a person. But if a business is run by someone in their own name, it may also be personal data about them — which is why the next section matters.

If this is your business: corrections and removal

If you want your listing removed, we will remove it. You do not need to give a reason. We confirm you are the owner first, using the contact details already published on the listing, and we act within 30 days.

The full process — how we confirm it is you, what happens if the listing has no contact details, and exactly what removal does — is set out in our terms of service. It is written there rather than repeated here so there is only one version of it.

To start either request, email listings@costaricasurfing.guide with the business name and the town it is in.

Your rights

Depending on where you are, you may have rights over personal data we hold about you — to see it, correct it, have it deleted, or object to how it is used. This includes the GDPR if you are in the EU or UK, Ley 8968 in Costa Rica, and the CCPA/CPRA if you are in California.

In practice, the request we expect is a business owner asking to be corrected or removed, and our answer is yes in both cases. Email listings@costaricasurfing.guide and we will respond within 30 days.

Who we are

This directory is operated by Costa Rica Surfing. For any question about this policy, or about data we hold, write to listings@costaricasurfing.guide.

We will update this page whenever what we collect changes, and the date at the top shows when this version was published.