Privacy notice
Last updated:
This is a courtesy translation. Portalis operates in Mexico and the Spanish version of this notice is the one that governs; if the two ever disagree, the Spanish text prevails.
This notice is issued under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation on March 20, 2025.
1. Who is responsible
[LEGAL NAME], RFC [RFC], with address at [REGISTERED ADDRESS], is responsible for the processing of your personal data. We operate the Portalis platform.
For anything related to this notice you can write to [PRIVACY EMAIL] or call [PHONE].
2. Who gives us data, and about whom
Portalis is contracted per condominium. The administration or the board is the one that uploads the unit and resident roster; we process it on that condominium’s behalf to provide it the service. If you’re a resident and want to know why your administration handed over your data, that question is for them to answer; we’ll still help you with whatever is within our own control.
3. What data we process
From administrators or board members: name, email, phone, role within the condominium, and the tax data needed to invoice (legal name, RFC, tax regime, CFDI use, and registered address).
From residents: name, unit number, WhatsApp number, the indiviso share (the unit’s share of the common property) that corresponds to their unit, and that unit’s history of charges and payments.
From visitors: the name of the person being announced, the unit announcing them, and the entry date and time logged at the gate.
From use of the service: IP address, device and browser type, console access logs, and the log of sensitive operations — who authorized an entry, who issued an adjustment, and at what time.
We do not process sensitive personal data, we do not request data from minors, and we do not collect biometric data.
We never touch your card data. Charges are processed by Stripe directly on its own infrastructure; Portalis receives only an identifier, the card’s last four digits, and its brand.
4. What we use it for
Primary purposes, necessary to provide you the service:
- Setting up and maintaining the condominium’s account and its units.
- Calculating, issuing, and collecting ordinary and extraordinary fees, and keeping each unit’s account statement.
- Processing payments and issuing the corresponding CFDI.
- Sending account notices over WhatsApp: fee reminders, payment confirmations, and visitor notices.
- Generating and validating access passes, and keeping the gate log.
- Handling inquiries, providing support, and complying with legal, tax, and accounting obligations.
- Preventing fraud and protecting the platform’s security.
Secondary purposes, which are not necessary and which you can opt out of without affecting the service:
- Sending you product news and content for administrators.
- Inviting you to satisfaction surveys and new-feature trials.
To opt out of the secondary purposes, just write to
[PRIVACY EMAIL]; you can also reply BAJA to any message that isn’t a
notice about your account.
5. Who we share it with
We hire providers who process data on our behalf and under our instructions. The law calls them processors, and sharing data with them does not require your consent:
| Provider | What for | Where it processes data |
|---|---|---|
| Stripe | Processing card payments | United States |
| Meta Platforms (WhatsApp Business) | Sending and receiving messages | United States |
| Supabase | Database and authentication | United States |
| Railway | Application servers | United States |
| [INVOICING PROVIDER] | Stamping and issuing the CFDI | Mexico |
Outside of those cases, we do not transfer your data to third parties except when the law requires it or a competent authority requests it in the exercise of its duties, in the cases the LFPDPPP itself allows. We do not sell personal data.
6. Your ARCO rights
You have the right to access your data, to have it rectified when it’s wrong, to have it cancelled when it’s no longer necessary, and to object to its use for specific purposes.
Write to us at [PRIVACY EMAIL] with:
- Your name and a way to reach you back.
- A document proving your identity, or the power of attorney of whoever represents you.
- What data is involved and which right you want to exercise.
We will respond within a maximum of 20 business days, and if the response is favorable we will act on it within the following 15 business days, per the deadlines the LFPDPPP sets. The process is free; only shipping or reproduction costs would be charged, if any.
There are rights we can’t always exercise in full: accounting and tax information must be kept for five years under Mexico’s Federal Tax Code, and the access log and a unit’s history of charges and payments back up the accounts your condominium is required to present at the assembly. In those cases we’ll explain in writing what we keep and why.
7. How long we keep your data
- Accounting and tax information, five years, as required by Mexico’s Federal Tax Code.
- The roster, charges, and payments, for as long as your condominium has a contract with us and 90 calendar days after, so it can export them.
- The gate log, [LOG RETENTION PERIOD] counted from each entry.
- The animation preference lives only in your browser; you can clear it whenever you want.
Once those periods have run, we delete the information.
8. Revoking your consent
You can revoke it at any time through the same channel. Keep in mind that revoking it for the primary purposes means we can no longer provide you the service, and that your condominium may still be required to keep your information on its own account.
9. Limiting use or disclosure
If you only want to stop receiving messages that aren’t notices about your account, write to us and we’ll record it, with no need for a full ARCO request.
10. Cookies
The Portalis site does not use advertising or cross-site tracking
cookies. We store a single preference in your browser,
portalis:motion, which remembers whether you asked to reduce animations.
The console uses strictly necessary cookies to keep you logged in; they are
httpOnly and no third party reads them.
11. How we protect the information
We encrypt connections and stored information, isolate each condominium’s data at the database level, require everyone to log in with their own identity, and log sensitive operations. No measure is foolproof: if a breach occurred that significantly affects your rights, we will inform you immediately, as the LFPDPPP requires.
12. Changes to this notice
We may update it as our services, our providers, or the law change. The current version is always on this page, with its last-updated date above, and we keep the history of previous versions. If the change is substantial we will notify you by email or WhatsApp before it takes effect.
13. If our response doesn’t satisfy you
You can turn to the Secretaría Anticorrupción y Buen Gobierno (Anticorruption and Good Governance Secretariat), Mexico’s data-protection authority for the private sector, within fifteen days of our response.