Privacy Policy
Love is a stray dog.
Last updated: September 8, 2026
Territorio de Zaguates (“we”, “us”) is a dog sanctuary in Santa Bárbara de Heredia, Costa Rica. This policy explains what personal information we collect through www.territoriodezaguates.com, our donation site donar.territoriodezaguates.com and our previous donation site donate.territoriodezaguates.com, why we collect it, who processes it for us, how long we keep it, and the rights you have over it. It applies to donors, gift recipients, newsletter subscribers and website visitors.
The controller of this information is Territorio de Zaguates Inc., a U.S. 501(c)(3) not-for-profit organization (PO Box 112, Greenvale, NY 11548, United States), together with the Costa Rican Fundación that runs the sanctuary. Contact us at info@territoriodezaguates.com.
What we collect and why
When you donate
When you make a one-time or monthly donation, buy a gift certificate or sponsor a dog, we collect your name, email address and billing address, the amount and currency, the language you used, and — if you gave them — the name of the dog you sponsor and a message. Your card details go directly to Stripe, our payment processor; we never see or store your full card number. Stripe tells us the outcome of the payment and its fees. Stripe screens payments for fraud automatically; we make no automated decisions about you ourselves.
We use this to process the donation, send you a receipt (including the tax-deductibility language required for our 501(c)(3) status), keep the accounting and tax records the law requires, thank you, and understand how donors find us and stay with us. If your payment fails, we keep a record of the failed attempt and the reason so we can let you know and help you fix it.
We keep a record of every donation — who gave (name, email, billing address and country), when, how much, and which campaign or link brought them — in a database we control. It is built from Stripe's records, including donations made through our previous donation site, and for those older donors also from that system's own records, so it holds donors who never used the current site. It lets us see, over time, how many donors we have, how many stay, and which appeals work. It is used only by our team. When a monthly payment fails we also keep the failed attempt and Stripe's reason, so we can let you know.
When you give a gift certificate
We collect the recipient's name, the message you write, and — if you ask us to email the certificate — the recipient's email address and the date to send it. We use these only to create and deliver the certificate. The certificate lives at a private, unguessable link; anyone who has that link can view it.
When you subscribe or write to us
If you subscribe to our newsletter we collect your email address, your name if you give it, and your language. If you contact us through a form we collect your name, email address and the message; we use them to answer you, and we also add you to our mailing list so we can keep you posted, on the basis of that contact. Every mailing has an unsubscribe link.
When you visit our sites
Like most websites we use cookies and similar technologies through Google Tag Manager. They power Google Analytics (how the sites are used, in aggregate), Google Ads conversion measurement (whether an ad led to a donation), and the Meta Pixel (the same for Facebook and Instagram). Stripe sets cookies needed to complete a payment and to prevent fraud, and Cloudflare Turnstile checks that a form is being sent by a person. Our hosting provider keeps standard server logs (IP address, browser, pages requested) for security and to keep the sites running, and our forms keep short-lived counters per IP address to slow down abuse. The donation site also sets two small cookies of its own for up to 30 days: the code in one of our short links, if you used one, and the website you arrived from — so we know which appeals work.
You can refuse or delete cookies in your browser settings; the donation flow still works without the analytics and advertising cookies. You can also opt out of Google Analytics with Google's browser add-on and manage ad personalization in your Meta ad preferences and Google ad settings.
Our legal bases
Where data-protection law asks us to name a legal basis (for example for donors in the European Union), it is: performance of a contract — processing your donation and sending your receipt; a legal obligation — keeping accounting and tax records; our legitimate interests — thanking donors, understanding giving so we can run the sanctuary, measuring which appeals work, preventing fraud and keeping the sites secure; and your consent — the newsletter. You can withdraw consent at any time, and you can object to analytics and advertising measurement with the opt-outs above. Giving us your name, email and billing address is required to process a donation; without them we cannot take it.
Who processes your information for us
We do not sell personal information. We share it only with the service providers below, who process it on our behalf under their own contractual and security commitments:
- Stripe — payment processing, receipts data, subscription management (Stripe's privacy policy). Our donation platform is operated on Stripe by our technology partner Treeseed, which builds and runs our websites.
- Cloudflare — hosting of both sites, the donations database, form protection.
- Resend — sends receipts, gift certificates, annual donation statements and our newsletters.
- ActiveCampaign — our donor and subscriber mailing list.
- Google (Tag Manager, Analytics, Ads) and Meta (Pixel) — analytics and advertising measurement, as described above.
- Amazon Web Services — hosts our previous donation system, which still processes some existing recurring donations.
- Our bookkeeping — the monthly accounting report, with donor names and addresses, goes to the people who keep our books.
Several of these providers are in the United States or the European Union, so your information may be transferred outside the country you live in. They rely on recognized safeguards for such transfers, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Donation records (name, address, amount, date): for as long as accounting and tax law requires us to keep the record of the gift, and while you remain a donor. Our monthly accounting reports contain the same information.
- Gift certificates: the certificate and its message stay available at its link; the recipient's email is used only for delivery.
- Newsletter and contact data: until you unsubscribe or ask us to delete it.
- Analytics data: per our Google Analytics retention setting.
- Server logs and form counters: hours to days, not months.
Your rights
You can ask us, at any time, to tell you what personal information we hold about you, to correct it, to delete it, to restrict or object to how we use it, to give it to you in a portable format, and to withdraw any consent you gave. To do so, email info@territoriodezaguates.com from the address you used with us. We answer within one month (45 days for requests under California law).
When you ask us to delete your data we remove your name, email and address from our donation records, mailing lists and the donation database, and ask our providers to do the same. We keep the accounting record of the gift itself (amount and date) where tax law requires it, without your personal details attached — except where a tax filing requires us to keep the donor's identification (in the United States, gifts of $5,000 or more in a year), which we then keep only for that filing.
If you are in Costa Rica, Ley 8968 (Protección de la Persona frente al Tratamiento de sus Datos Personales) gives you these rights and you may also complain to the Agencia de Protección de Datos de los Habitantes (PRODHAB). If you are in the European Union or the United Kingdom, you may complain to your local data-protection authority. If you are a California resident, the California Consumer Privacy Act gives you the rights above. We do not sell personal information. The advertising measurement described under “When you visit our sites” (Google Ads and the Meta Pixel) may count as “sharing” under California law; you can opt out of it with the browser, Google and Meta settings above, or by emailing us. We do not discriminate against anyone who exercises their rights.
Children
Our sites are not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
Security
Both sites are served over HTTPS. Card details never touch our systems. Access to donor information is limited to the people who run the sanctuary and its websites, and protected by keys and passwords that are rotated.
Changes to this policy
When we change how we use personal information we update this page and the date at the top. Significant changes will be announced to donors by email.
Contact
Territorio de Zaguates Inc. · PO Box 112, Greenvale, NY 11548, United States · sanctuary in Santa Bárbara de Heredia, Costa Rica · info@territoriodezaguates.com. Registered 501(c)(3) not-for-profit organization, EIN 81-4423251.