Privacy Policy — Portal Orange

Who we are and scope of this Privacy Notice

This Privacy Notice describes how ENSO MKTG LLC, a limited liability company incorporated under the laws of the State of Florida, United States of America (hereinafter, “ENSO MKTG LLC”, “we”, or “Portal Orange”), collects, uses, stores, and protects the personal data of the people who use our services.

ENSO MKTG LLC operates commercially under the brand “Portal Orange”, an online SaaS (software as a service) platform designed for social media content planning, marketing brief management, the creation and tracking of marketing plans, and collaboration among agencies, brands, internal teams, and freelancers around the creation, review, and publication of content.

This Privacy Notice applies to:

The main website: https://portalorange.com
The platform web application: https://app.portalorange.com
Any other subdomains linked to Portal Orange that link to this Privacy Notice.

Collectively, we refer to all of them as the “Platform”.

This Privacy Notice covers both:

People who visit our websites without creating an account (for example, to learn about the service).
Individuals who create an account or are invited to use Portal Orange on behalf of an agency, company, brand, or organization, as well as individual users and freelancers who use Portal Orange to manage their own content.

Our services are intended exclusively for people over 18 years of age. We do not deliberately offer the Platform to minors, nor do we knowingly collect personal data from minors. If we become aware that data from minors under 18 has been collected, we will take reasonable steps to delete that information.

Although Portal Orange is based in the United States, the Platform may be used by users located in different countries. This Privacy Notice is drafted primarily with the privacy regulations applicable in the United States in mind and, in general terms, the usual obligations in Latin American countries. Where appropriate, specific sections may be added for certain territories (for example, additional requirements for residents of certain states or countries), which will be indicated separately.

For any inquiry related to the protection of personal data or the content of this Privacy Notice, you can contact:

ENSO MKTG LLC – Privacy Team / Portal Orange
Email: privacy@portalorange.com
Address: 880 W 74th ST APT 103 Hialeah FL 33014, United States

Likewise, we currently do not have a formally designated Data Protection Officer (DPO). Nonetheless, any request, question, or complaint related to privacy will be handled through the email address indicated above.

2. Personal data we collect

The information we collect depends on how you use Portal Orange (for example, whether you only visit the site, create an account, are part of a team, or connect social media profiles). In general, we can group the personal data we process into the following categories:

2.1. Identification and account registration data

When you create an account on Portal Orange or are invited by an agency, company, or team, we may collect:

First and last name.
Email address.
Password (stored in encrypted form).
Profile photo or avatar (if the user chooses to upload one).
Name of the space, agency, company, or project the account is linked to.
Role or type of user within Portal Orange (for example, administrator, team member, client, etc.).
Optionally, other profile data such as country, time zone, preferred language, and similar data needed to set up and personalize the account.

2.2. Data about spaces, brands, and clients managed in Portal Orange

In order to provide content planning and management features, users can create and administer spaces and brands. In this context, we may process:

Name of the space or account (for example, the name of the agency or company).
Name of each managed brand or project.
Brand logo and images.
Brand sector or industry.
Brand website.
Brand contact details (for example, generic email, phone, city, and country), when the user provides them.
Contact information of individuals linked to the brand (for example, the name and title of the main contact), when included in the Platform’s text fields or in briefs.

2.3. Information contained in briefs and marketing plans

As part of the normal use of Portal Orange, users may enter into the Platform:

Information about objectives, audiences, products, services, brand positioning, and communication guidelines.
Names of contact persons, job titles, and corporate emails, whenever the user chooses to include them.
Internal notes, instructions for the team, comments, and observations about campaigns and content.

The content of briefs and marketing plans may include personal data of third parties that the user chooses to enter. In these cases, the user is responsible for having obtained the authorizations or the legal basis necessary to share that information with Portal Orange.

2.4. Content and files created or uploaded by users

When you use the Platform to plan or manage content, we may process:

Post texts, copy, titles, descriptions, hashtags, and other content variants.
Images, videos, and other media files uploaded by users (for example, social media creatives, logos, mockups, templates, etc.), stored in our systems or in integrated external storage services.
Internal comments, feedback, annotations, approval statuses (for example, “draft”, “in review”, “approved”, “rejected”, “scheduled”, “published”) and the record of who performed each action and when.

To the extent that this content includes personal data (for example, names, images of people, testimonials, or contact details), such data will also be processed as part of the service.

2.5. Data derived from connecting social media accounts (Facebook, Instagram, and TikTok)

If you connect social media profiles or pages to Portal Orange, we may collect and store:

Technical identifiers of the connected accounts (for example, page_id for Facebook, instagram_business_account_id for Instagram, the TikTok account identifier, and similar data).
Name of the page or profile, username, and profile photo, to the extent the platforms allow.
Access tokens needed to publish and schedule content on your behalf, provided by the corresponding platforms, along with their expiration date. These tokens are refreshed automatically while the connection remains active; in the case of TikTok, authorization expires after a maximum of 365 days, after which you must reconnect the account.
Basic information about the status of posts made through Portal Orange (for example, whether the post was successful, whether it was scheduled, whether an error occurred).
Engagement metrics for posts made through Portal Orange, such as reach, impressions, clicks, reactions, comments, and other similar statistics, when the platforms allow it. In the case of TikTok, the first version of the integration does not collect statistics.

Currently, Portal Orange does not use your credentials to read or reply to private messages on behalf of the page, but we could access additional information that the platforms make available through their official APIs, in accordance with the permissions you authorize and those platforms’ policies. Any relevant expansion will be reflected in future versions of this Privacy Notice.

We do not store the direct login credentials to your personal social media account (username and password); access is always carried out through the authorization mechanisms provided by those platforms.

2.6. Data related to artificial intelligence features

When you use content generation or assistance features powered by artificial intelligence within Portal Orange (for example, to suggest copy or content ideas), we may process:

The texts, instructions, and content you submit to be processed by the AI feature.
The responses or content proposals generated by the AI that you choose to save within the Platform.

This data may be sent to our artificial intelligence service provider (currently, OpenAI) with the sole purpose of providing the requested feature, in accordance with the conditions indicated in this Privacy Notice and in the section corresponding to providers and sub-processors.

2.7. Support, forms, and communications data

If you contact us through contact forms, email, or other means, we may collect:

First and last name (if requested or if you include them in the message).
Email address.
Company or brand name, if you choose to provide it.
The content of the message, including the information you choose to share about your case.
Attachments you send, such as screenshots or images to illustrate a technical or usage issue.

Likewise, we may keep the history of communications (for example, support emails, help requests, and tickets) to manage your inquiries, follow up on incidents, and improve the quality of the service.

2.8. Billing, payments, and subscriptions data

When you subscribe to a paid Portal Orange plan, through our payment service provider (currently, Stripe), we may process:

First and last name or business name of the customer.
Billing email address.
Necessary tax and billing data (for example, address, country, and, where applicable, tax identification number) when required to issue receipts or invoices.
Information about the contracted plan, subscription status, amounts charged, currency, charge date, and payment method used.
Only the last digits of the card and partial data that allow the payment method to be identified, when Stripe makes them available.

We do not store full card numbers or security codes (CVV) in our systems; that processing is carried out directly through Stripe, which acts as an independent processor of payments.

2.9. Technical, usage, and cookie data

When you use our sites and the Platform, we may automatically collect certain technical and usage information, such as:

IP address.
Browser type and version.
Operating system and device type.
Browser language.
Access dates and times.
Pages visited, navigation paths, time spent, and actions taken on the Platform (for example, creating, editing, or scheduling posts).
Identifiers associated with cookies, pixels, and similar technologies.

This data may be obtained directly or through analytics and measurement tools integrated via Google Tag Manager, such as Google Analytics, Meta Pixel / Conversions API, Google Ads tags, and similar technologies, in order to understand the use of the Platform and improve the service. Details about the use of cookies and similar technologies will be described in greater depth in the dedicated Cookies section.

2.10. Preferences and commercial communications data

If you choose to subscribe to our commercial or marketing communications (for example, newsletters, product updates, webinar invitations, or promotions), we may process:

Name and email address.
Preferences related to the type of communications you want to receive.
Records of sign-ups, opt-outs, and changes to your subscriptions.

These communications may be managed through external email marketing providers (currently, Resend), in accordance with the applicable legal bases and the consent options we present to you in each case.

2.11. Sensitive data

Portal Orange does not intentionally request or process personal data considered sensitive under applicable regulations (for example, health information, religion, sexual orientation, political opinions, biometric data, etc.). Any inclusion of this type of information in text fields or files uploaded to the Platform will be the sole responsibility of the user, who must ensure they do not share sensitive data unless they have the legal basis and appropriate measures to do so.

3. How we obtain your personal data

We collect personal data about you through different means, always in the context of your use of Portal Orange and the services we offer. The main sources are as follows:

3.1. Data you provide to us directly

We obtain information directly from you when you:

Create an account on Portal Orange or accept an invitation to join a space or brand.
Complete or update your user profile, your space/agency profile, or a brand’s record (for example, name, logo, sector, contact details).
Enter information into the Platform, such as briefs, marketing plans, objectives, instructions for your team, and any content related to your social media strategy.
Create, edit, or schedule posts, including texts, images, videos, hashtags, and other content elements.
Upload files (for example, screenshots, creatives, logos, reference materials) to the Platform.
Communicate with us through contact forms, support requests, or emails, including any additional information you choose to include in your messages.
Give your consent to receive commercial or marketing communications, for example, when you subscribe to our newsletters or mailing lists.

In all these cases, you decide what information you provide to us, although some data may be necessary to create your account or provide certain services.

3.2. Data generated by your use of the Platform

Certain information is generated automatically or semi-automatically as a result of your interaction with the Platform, for example:

History of actions within Portal Orange (such as creating, editing, reviewing, approving, scheduling, and publishing content).
Activity logs associated with your account and your role in the different spaces or brands.
Task and content statuses (draft, review, approved, scheduled, published, etc.).
Records of incidents and technical errors that may occur during use of the Platform.

This data is used, among other purposes, to provide you with the service, maintain a change history, improve performance, and resolve technical issues.

3.3. Data obtained through third-party integrations

We also obtain personal data through integrations with third-party services that you choose to connect to Portal Orange, always via official authorizations and mechanisms:

Meta (Facebook and Instagram): When you connect a Facebook page or an Instagram account to Portal Orange, we receive information through Meta’s official APIs, only after you authorize the corresponding permissions. This may include technical identifiers of the connected accounts, the name and photo of the page/profile, and engagement statistics related to the posts you manage through Portal Orange. We also receive and use the access tokens needed to publish or schedule content on your behalf.
TikTok: when you connect a TikTok account to Portal Orange, login takes place on TikTok’s site and never within our Platform. Through TikTok’s official APIs, and only after you authorize the corresponding permissions, we receive the account identifier, the display name, the username, and the profile photo, along with the access tokens needed to publish or schedule content on your behalf.
Payment provider (Stripe): When you subscribe to a paid plan, we receive from Stripe the information needed to manage your subscription and billing (for example, subscription status, amounts, payment method, and billing data). The full details of your credit or debit card are handled directly in Stripe; Portal Orange does not store full card numbers or the security code (CVV).
Email marketing and communications (Resend): If you subscribe to our newsletters or other commercial communications, your contact data (such as name and email) may be managed through Resend or other similar services, always under the instructions of ENSO MKTG LLC.
Artificial intelligence services (OpenAI): When you use AI features within Portal Orange, the texts, instructions, and content you choose to send for processing may be transmitted to our artificial intelligence provider (currently, OpenAI) in order to generate the responses or content proposals you request.

In all these cases, we only connect your information with these services when you authorize it or when it is necessary to perform the service you have contracted.

3.4. Data obtained automatically through cookies and similar technologies

When you visit our websites or use the Platform, certain information is collected automatically through cookies, pixels, and similar technologies, managed, among others, through Google Tag Manager.

These tools allow the implementation of, among others:

Google Analytics, to analyze the use of our sites and improve the user experience.
Meta Pixel and Conversions API, to measure the performance of campaigns on Facebook and Instagram.
Google Ads tags and other measurement or conversion tags.

These technologies may record, for example, your IP address, browser type, operating system, the pages you visit, the time you spend on the Platform, and the way you interact with our services, both on the public site (portalorange.com) and, where applicable, within the application (app.portalorange.com), according to the configuration we establish and the permissions you accept.

The specific use of cookies and your management options will be detailed in our Cookie Policy, which complements this Privacy Notice.

3.5. Data obtained from support and contact communications

When you contact us by email to request help, report a problem, or make inquiries, we obtain information through the email services we use (currently, Gmail). This includes the data contained in your messages (sender, recipient, date, content, and attachments), which we keep to the extent necessary to manage your requests and maintain a record of the support provided.

3.6. Sources from which we do not obtain data

Portal Orange does not buy third-party databases or obtain personal information from “data brokers” or other similar sources. We do not manually create accounts without user intervention, nor do we add contacts to the Platform without an action by the user or their teams (for example, accepting an invitation or voluntarily subscribing to communications).

In our view, making this clear reduces risks and misunderstandings: all data comes from you, from your use of the platform, from the tools you choose to connect, and from the analytics necessary to operate and improve the service.

4. What we use your personal data for

We use the personal data described in this Privacy Notice only for legitimate purposes connected to the operation of Portal Orange and the relationship we have with you. In particular, we may process your data for the following purposes:

4.1. Service provision and operation of the Platform

We use your data to:

Create, manage, and maintain your user accounts on Portal Orange.
Allow you to join one or more spaces and to work with different brands within the Platform, according to the role assigned to you (for example, administrator, team member, client).
Make possible the creation, editing, review, approval, scheduling, and publishing of content on connected social media, including texts, images, videos, and other associated elements.
Maintain a history of changes and actions (for example, who created, edited, approved, or rejected a piece of content and when).
Facilitate collaboration among users of the same space or brand, including comments, review statuses, and the use of the internal chat to coordinate tasks and content.
Operate the integrations with Facebook, Instagram, and TikTok, so that you can connect pages and accounts, schedule and publish content on your behalf with your authorization, as well as obtain statistics related to the posts made through Portal Orange, when the corresponding social network allows it.
Provide you with briefing, marketing planning, and campaign and content calendar organization features.

Without this processing, Portal Orange could not function as it has been designed.

4.2. Management of the contractual relationship, billing, and support

We also process your data to:

Manage the sign-up and maintenance of your subscription, the contracted plans, and the features associated with each plan.
Process payments and billing, in coordination with our payment provider (currently, Stripe), as well as issue the corresponding receipts or invoices.
Provide customer service and technical support, respond to your inquiries, manage requests, investigate incidents, and send you communications related to your tickets or requests.

4.3. Communications necessary for the provision of the service

We use your contact data to send you communications that we consider an essential part of the service, such as:

Account confirmation, welcome, or activation messages.
Notices about important changes to the Platform, the Terms and Conditions, or this Privacy Notice.
Operational notifications related to your use of the service (for example, problems publishing content, expiration of social media connection tokens, status of your subscription, or relevant technical incidents).
Communications about account security, unusual access attempts, or other alerts necessary to protect your information.

This type of communication is not commercial in nature, but part of the normal operation of the service.

4.4. Improvement of the Platform, analytics, and statistics

We use information about the use of the Platform, as well as technical and analytics data, to:

Understand how the different features of Portal Orange are used and prioritize improvements and new features.
Analyze the performance of the Platform, detect errors, and improve stability and user experience.
Prepare internal statistics and aggregated metrics (for example, number of spaces, volume of planned content, frequency of use), without directly identifying specific people in internal usage reports.

In these cases, whenever possible, we work with aggregated or pseudonymized data, so that it does not focus on individual users, but on general usage patterns.

4.5. Security, abuse prevention, and regulatory compliance

We process certain data (such as activity logs, IP addresses, and technical logs) to:

Protect the security of accounts and of the Platform, including the detection and prevention of unauthorized access.
Investigate and, where appropriate, prevent misuse, fraudulent activities, attacks on systems, unauthorized bulk sending, or behavior contrary to our Terms and Conditions.
Comply with our legal obligations and respond, where appropriate, to legitimate requests from competent authorities.
Exercise or defend our rights against possible claims or disputes related to the Platform.

4.6. Marketing and commercial communications about Portal Orange

With your prior consent, we may use your contact data to:

Send you newsletters, updates about Portal Orange, product improvements, usage tips, and educational content related to social media management and digital marketing.
Inform you about promotions, launches, or plan changes for Portal Orange that may be of interest to you.

These communications focus exclusively on Portal Orange. We do not use the data of Platform users to offer them other unrelated services, nor do we share it with independent third parties so they can send you their own commercial communications.

In addition:

We may use online measurement and advertising tools (such as Meta Pixel, Google Ads, and Google Analytics) to show ads about Portal Orange to people who have visited our site or interacted with our Platform (remarketing).
We do not manually upload or share lists of emails or customer data to advertising platforms to create custom audiences based on those lists; remarketing is based on interaction with the site and the Platform through the tags and pixels implemented.

You can unsubscribe from our commercial communications at any time by following the instructions included in each email or by contacting us through the means indicated in this Privacy Notice.

4.7. Artificial intelligence features

When you use the artificial intelligence features of Portal Orange (for example, to generate or adjust copy or content ideas), we process your data to:

Send our AI provider (currently, OpenAI) the texts, instructions, and content you choose to submit for processing, with the sole purpose of generating the responses or proposals you request.
Show you the generated result and allow you to save, edit, or discard that content within the Platform.
Internally improve the quality and relevance of Portal Orange’s AI features (for example, by adjusting preconfigured prompts or usage flows), without using your content publicly or as an identifiable example without your additional authorization.

We do not systematically or manually review all the content you process with AI, beyond what is necessary to provide support in specific cases where you ask us for help or authorize access.

4.8. Use of your name and logo as a client

We may use your company or brand name and logo to identify you as a Portal Orange client on our website, commercial materials, or presentations (for example, a “Brands that trust Portal Orange” section or similar).

Under no circumstances will we disclose, for promotional purposes, confidential information or specific details of your campaigns, results, or strategies without having obtained your express authorization. If at any time you do not want us to use your name or logo in this way, you can request it and we will stop doing so to the extent reasonably possible.

4.9. Compliance with legal obligations and defense of rights

Finally, we may process your personal data when necessary to:

Comply with legal obligations applicable to us (for example, tax, accounting, or regulatory requirements).
Respond to requests or requirements from authorities, courts, or competent bodies, when they are legitimate.
Manage, exercise, or defend our rights and interests in the context of claims, litigation, or administrative proceedings.

5. Legal bases for processing

This section is especially relevant when regulations such as the European Union’s General Data Protection Regulation (GDPR), United Kingdom regulations, or other data protection laws that use similar concepts apply.

When those regulations apply, we process your personal data on the basis of one or more of the following legal bases:

5.1. Performance of a contract or application of pre-contractual measures

We process your data when it is necessary to:

Create and manage your user account on Portal Orange.
Allow you to participate in one or more spaces and brands, with the role assigned to you.
Provide the main features of the Platform:
- creation, editing, review, approval, scheduling, and publishing of content,
- internal collaboration and chat among users of the same space,
- management of briefs, marketing plans, and content calendars,
- integrations with Facebook and Instagram to publish and obtain statistics for the managed posts.
Manage your subscription, the contracted plans, and, in general, the commercial relationship with you or the organization you represent.
Handle support requests directly related to the use of the Platform.

Without this processing we could not provide you with the service you have requested or comply with our Terms and Conditions.

5.2. Compliance with legal obligations

In some cases, we process your data because it is legally required, for example, to:

Comply with billing, tax, accounting, or record-keeping obligations that may apply depending on the country.
Respond to legitimate requirements from administrative, regulatory, or judicial authorities, when we are obligated to do so.

In these cases, processing is limited to what is strictly necessary to comply with those obligations.

5.3. Legitimate interests of ENSO MKTG LLC or third parties

We may also process your data when necessary to satisfy our own legitimate interests or those of third parties, provided that your fundamental rights and freedoms do not override those interests. In particular:

Maintain the security of the Platform, prevent unauthorized access, misuse, fraud, abuse, or attacks on our systems.
Record and analyze activities and technical logs to diagnose problems, correct errors, and improve the stability and quality of the service.
Develop and improve the features of Portal Orange based on aggregated or pseudonymized usage information (for example, which modules are used most, which flows generate the most incidents).
Prepare internal statistics about the use of the service and the growth of the business, without individually profiling users beyond what is necessary for the provision of the service.
Use your company or brand name and logo to identify you as a Portal Orange client on our website or commercial materials, always without disclosing confidential information or specific details of your campaigns without your authorization.

When processing is based on our legitimate interest, you will have the right, in certain circumstances, to object to such processing, as will be explained in the section on user rights.

5.4. Consent

In other cases, we process your data only when you have given us your free, specific, and informed consent. This applies, for example, to:

Sending commercial communications by email (newsletters, product updates, webinar invitations, promotions), which we manage through tools such as Resend.
The use of cookies and similar technologies for analytics and marketing/remarketing purposes, including tools implemented via Google Tag Manager (for example, Google Analytics, Meta Pixel, Google Ads tags), when applicable law requires your prior consent for this.

When processing is based on your consent:

You may withdraw it at any time, without affecting the lawfulness of processing carried out previously.
You may unsubscribe from our commercial communications using the “unsubscribe” link or similar included in each email, or by contacting us through the means indicated in this Privacy Notice.
You may manage your cookie preferences through the mechanisms we make available (for example, a cookie banner or settings panel, where required by law).

5.5. Artificial intelligence features

When you use the AI integrated into Portal Orange:

Sending texts, instructions, and content to our AI provider (currently, OpenAI) and the return of results is part of the performance of the contract, to the extent that it is a feature of the service you choose to use.
We may rely on our legitimate interest to use, internally and in aggregate, information about the use of these features (how much they are used, what type of results they generate in general terms) in order to improve the quality and relevance of the AI within Portal Orange, without using your content publicly or as an identifiable example without your additional consent.

If you enter personal data of third parties into content that you submit for processing by AI, you are responsible for ensuring that you have an appropriate legal basis for such processing.

6. Who we share your personal data with

6.1. Providers acting as data processors

We work with service providers that process personal data following our instructions and only for the purposes described in this Privacy Notice. These may include, among others:

Infrastructure, hosting, and database providers We use cloud computing services, such as Amazon Web Services (AWS), to host the Platform, run our services, and store data securely. We also use specialized platforms such as Supabase (or equivalent providers) to manage databases, user authentication, and storage of certain content and files generated or uploaded by users. This may include both account data (users, spaces, brands, settings) and part of the content related to the normal use of Portal Orange.
Authentication, database, and storage platforms Through these services we manage registration, login, permissions, and storage of information associated with the account, spaces, brands, and content uploaded to the Platform, including certain media content related to posts (images, creatives, etc.), to the extent that it is stored in those services.
Payment provider (Stripe) To process payments, manage subscriptions, and make charges securely, we share with Stripe the necessary billing data and payment method details. Stripe processes this data as a processor to handle payments on our behalf and as an independent controller to comply with its own legal obligations (for example, fraud prevention, financial regulations). Portal Orange does not store full card numbers or the security code (CVV).
Email services and communications management We use email services (for example, Gmail or other equivalent services) to send and receive messages related to support, service notifications, and operational communications with you.
Email marketing platforms (Resend or other equivalents) To manage newsletters, commercial communications, and mailing lists, we share with these providers your name and email address, as well as basic information about your subscription preferences, only when you have given your consent to receive these communications.
Artificial intelligence services (OpenAI or other equivalents) When you use AI features integrated into Portal Orange, the texts, instructions, and content you choose to send for processing may be shared with our AI provider, exclusively to generate the responses or content proposals you request and to improve the AI feature within the Platform, under the terms described in this Privacy Notice.

In all these cases, we require our providers to apply appropriate security measures and to process the data only in accordance with our instructions and applicable regulations.

6.2. Connected social networks

When you publish or schedule content from Portal Orange to a connected social network (Facebook, Instagram, or TikTok), we send that social network, through its official APIs, the content you have prepared and the data necessary to publish it on the account you authorized.
These platforms do not act as processors on our behalf: they process that data under their own responsibility and in accordance with their own privacy policies, over which Portal Orange has no control.
Content that has already been published on those social networks is governed by the conditions of each platform, and its deletion must be managed directly from the corresponding social network.

7. International data transfers

ENSO MKTG LLC is based in the United States and uses service providers that may also be located in other countries. This means that, in the normal course of providing our services, your personal data may be transferred, stored, and processed outside the country where you are located.

In particular:

The data we process through Portal Orange may be stored and processed on servers located in the United States and in other countries where our infrastructure and cloud service providers operate, such as Amazon Web Services (AWS), Supabase, and other equivalent providers.
Some of our service providers, such as Stripe (payments), Resend (email marketing), OpenAI (artificial intelligence), Google (Google Analytics, Google Ads, Tag Manager), and Meta (Facebook, Instagram, Meta Pixel), operate globally and may process data in different jurisdictions, including the United States and other territories outside your country of residence.

When the data protection laws of your country consider that these countries do not offer an equivalent level of protection, we will adopt appropriate measures to protect your data, which may include, among others:

Entering into standard contractual clauses approved by the European Commission or equivalent instruments for international data transfers, where applicable (for example, for users located in the European Union or the European Economic Area).
Verifying that our providers have appropriate technical and organizational security measures to protect your data.
Carrying out internal assessments of data protection in the destination countries and the associated risks, when necessary.

In any case, international data transfers will be limited to what is strictly necessary to:

Provide you with the Portal Orange service.
Manage payments, communications, and integrated features (such as the AI modules).
Analyze the use of the Platform and improve our services, under the terms described in this Privacy Notice.

If at any time it becomes necessary to carry out additional or substantially different transfers from those described, we will update this Privacy Notice and, where appropriate, inform you clearly and/or request your consent, in accordance with applicable regulations.

8. How long we keep your personal data

We keep your personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice, to maintain the provision of the service, and to address possible legal or contractual responsibilities. Once the data is no longer necessary, we seek to delete it, anonymize it, or aggregate it so that it no longer reasonably allows you to be identified.

8.1. User accounts and profiles

While your account is active (that is, while you continue to use Portal Orange or maintain a valid subscription), we keep your profile data, your spaces, brands, and associated content, to the extent necessary to provide you with the service.
In the case of free accounts, if we detect a prolonged period of inactivity (for example, no access to the Platform for at least 12 months), we may cancel and delete the account and the content associated with the free plan, keeping only certain minimal information that may be necessary for legal, security, or historical record purposes under the terms indicated below.
If you request to delete your account, we will proceed to:
- Delete or dissociate your main identification data (for example, name, email, and credentials) from the active systems, to the extent that they are not necessary for legal, security, or billing reasons.
- Keep, when necessary, anonymized or aggregated information for internal statistical purposes.
- Keep certain minimal information for the periods required by law or necessary for the defense of our rights (for example, basic billing records or proof that we handled a request).

8.2. Content, posts, briefs, and chat

The content that you or your team create in Portal Orange (posts, briefs, marketing plans, comments, review statuses, etc.) is kept while the corresponding account and space/brand remain active, unless you delete it manually from the Platform.
When you delete specific content (for example, a post, a brief, or a file), our intention is for that content to stop being available in production systems and user interfaces. It may continue to exist for a limited time in backups or logs until they are periodically overwritten.
When a user is removed from a space or when a person requests the deletion of their account, we may keep in the space’s historical records (for example, in internal chats, comments, or approval history) the reference to the user’s name and the messages or actions they performed, to the extent necessary to:
- Maintain the consistency of the history of conversations and decisions made within the space.
- Allow other members to understand the context of past decisions. This processing is based on our legitimate interest in keeping a complete and reliable record of interactions within the Platform. When applicable law grants you additional rights (for example, to erasure or objection), you may exercise them and we will assess appropriate measures case by case (such as the pseudonymization of certain references).

8.3. Billing and payment data

Data related to billing and payments (for example, name or business name, tax data, amounts, and charge dates) is kept for the periods legally required for accounting and tax purposes, which, depending on applicable regulations, usually range between 5 and 10 years from the issuance of the corresponding receipt or invoice.

8.4. Technical records, logs, and security

Data used for security and technical record purposes (such as IP addresses, access events, error logs, and certain technical activity records) is normally kept for a period of approximately 1 year, unless it is necessary to keep it longer in the context of a specific investigation, a security incident, or a legal proceeding.

8.5. Support and contact communications

The communications you maintain with us through email or other support channels are kept:

For the time necessary to manage and resolve your request or incident.
Afterwards, for the time during which such communications may remain relevant for the provision of the service, the improvement of our processes, or the defense of our rights in the event of possible claims.

When they are no longer necessary for these purposes, we seek to archive or delete them in accordance with our internal retention policies.

8.6. Data for commercial communications and suppression list

If you have subscribed to our commercial communications, we keep your email and, where applicable, your name while you maintain your consent and do not unsubscribe.

If at any time you decide to unsubscribe from our newsletters or marketing communications:

We will stop using your data for commercial purposes.
We will keep your email on a suppression list (a “do not send” list) to ensure that we do not send you commercial communications again by mistake, in accordance with good practices and the usual configuration of tools such as Resend.

8.7. Social media connections and access tokens

The access tokens and identifiers of the social media accounts you connect are kept while the connection remains active, and are deleted from our active systems when you disconnect the brand, when you revoke the permission from the social network itself, or when you close your Portal Orange account.
In the case of TikTok, authorization expires by TikTok’s decision after a maximum of 365 days from when you granted it. If you do not reconnect the account before that date, the connection becomes ineffective and the tokens stop being valid.
The content you have created or scheduled for that account is kept in your work history in accordance with section 8.2, even if the connection no longer exists, and posts already made on the social network are managed from that social network, not from Portal Orange.

8.8. Additional retention and deletion criteria

In all cases:

We periodically review the data we process to ensure that it is not kept longer than necessary.
When there is no longer a legitimate need to keep certain data, we seek to delete it or transform it into aggregated or pseudonymized information.
The complete deletion of data in backups may not be immediate, but that data stops being used for operational purposes and is only kept for the normal life cycle of those backups.

9. Your rights and choices regarding your personal data

Depending on the legislation applicable to you, you may have different rights in relation to the personal data we process about you. In general terms, and without prejudice to the legal requirements and limitations of each country, you may exercise the following rights:

9.1. Right of access

You have the right to request confirmation of whether or not we process personal data about you and, where applicable, to obtain:

A copy of the personal data we keep about you.
General information about how and why we process that data.

9.2. Right of rectification

If you consider that some of your personal data is inaccurate or incomplete, you can ask us to correct or update it. In many cases, you will be able to directly modify certain information from your user profile within Portal Orange (for example, display name, basic account data, space or brand information).

9.3. Right of erasure (“right to be forgotten”)

You can request that we delete your personal data when, among other cases:

It is no longer necessary for the purposes for which it was collected.
You withdraw your consent (when processing is based on it) and there is no other legal basis to justify the processing.
You have objected to the processing and there are no overriding legitimate grounds to continue it.

Please note that this right is not absolute. In particular, we may keep certain information when necessary to:

Comply with legal obligations (for example, accounting and tax retention periods).
Manage claims, liabilities, or litigation.
Keep the minimal records necessary to ensure the security of the Platform or to demonstrate that we have properly handled your request.

9.4. Right to object

In certain circumstances, you may object to the processing of your personal data when it is based on our legitimate interest, including:

Certain processing related to usage analysis and internal improvement of the service.
The use of your name and logo to identify you as a client on our website and commercial materials.

If you exercise this right, we will stop processing your data for those purposes, unless we can demonstrate overriding legitimate grounds to continue the processing or we need it for the establishment, exercise, or defense of claims.

Likewise, you may object at any time to the use of your data for direct marketing purposes (for example, receiving newsletters or commercial communications), in which case we will stop processing your data for those purposes.

9.5. Right to withdraw consent

When the processing of your data is based on your consent (for example, to receive commercial communications or for the use of certain cookies and similar technologies):

You may withdraw your consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
You can unsubscribe from our commercial communications using the “unsubscribe” link included in each email or by contacting us directly.
You may adjust your cookie preferences through the mechanisms we make available, when required by law.
You can withdraw at any time the permission you granted to Portal Orange over your social networks, in two ways: from the Connections section of the Platform, clicking Disconnect on the corresponding brand, or from the settings of your own account on the social network, where you can review and withdraw access of connected applications. As soon as the permission is withdrawn, Portal Orange can no longer publish to that account.
If you also want us to delete the data we had already stored from that connection, you can request it in accordance with our User Data Deletion Policy, available at https://www.portalorange.com/datos-de-usuarios/.

9.6. Right to restriction of processing

In certain cases provided for by law, you may request that we restrict the processing of your personal data, for example:

While we verify the accuracy of the data you have asked us to correct.
When we no longer need the data for the original purposes, but you require it for the establishment, exercise, or defense of claims.

During the restriction period, we will only process your data to the extent necessary to comply with legal obligations, defend our rights, or with your consent.

9.7. Right to portability (where applicable)

In certain cases and when applicable law provides for it (for example, under the GDPR), you may request to receive certain personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit it to another controller, when the processing is based on your consent or on the performance of a contract and is carried out by automated means.

9.8. Specific rights depending on your country or region

Depending on your place of residence (for example, certain Latin American countries, the European Union, the European Economic Area, the United Kingdom, or other territories), you may have additional or specific rights regarding data protection (for example, rights under local privacy laws, or specific rights for residents of certain states or countries).

If you have any doubts about which rights apply to you, you can contact us and we will do what is reasonable to guide you in accordance with applicable regulations.

9.9. How to exercise your rights

You can exercise your rights at any time by contacting us through:

ENSO MKTG LLC – Privacy Team / Portal Orange
📧 Email: privacy@portalorange.com

In order to handle your request, we may ask you for additional information that helps us verify your identity and confirm that you are the account holder or the person entitled to make the request. This is done to protect the security of the data and prevent unauthorized access.

We are committed to responding to your requests within a reasonable period and, when required by law, within the maximum periods established by applicable regulations.

9.10. Complaints before data protection authorities

Without prejudice to any other administrative or judicial remedy, if you consider that the processing of your personal data infringes the data protection regulations applicable to you, you have the right to file a complaint with the competent supervisory authority in your country or region.

Nonetheless, before approaching an authority, we invite you to contact us directly to try to resolve the matter amicably and promptly.

10. Cookies and similar technologies *

When you visit our websites (including portalorange.com and app.portalorange.com) or use the Platform, we and certain third parties may use cookies and similar technologies (such as pixels, tags, and scripts) to collect and store information automatically.

10.1. What are cookies?

Cookies are small text files that are stored on your device (computer, phone, tablet) when you visit a website. They are used, for example, to:

Remember your preferences and settings.
Keep your session logged in while you browse.
Understand how the site is used in order to improve its functioning.
Show more relevant ads based on your interests.

In addition to cookies, we may use similar technologies (such as tracking pixels and tags implemented through tools such as Google Tag Manager) that serve similar functions.

10.2. Types of cookies we use

In general terms, we may use the following types of cookies and similar technologies:

Strictly necessary cookies They are those that are essential for the basic functioning of the site and the Platform. For example, they allow:
- Remembering your session and identifying you as an authenticated user.
- Managing security and access to restricted areas. Without these cookies, some services would not work correctly.
Functionality and preference cookies They help us remember certain choices you make (for example, language, time zone, certain visual settings) to offer you a more personalized experience.
Analytics and performance cookies They allow us to understand how our sites and the Platform are used, detect errors, and improve performance. These may include tools such as:
- Google Analytics, implemented through Google Tag Manager, which collects aggregated information about pages visited, time spent, device type, etc.
Advertising and remarketing cookies They are used to measure the effectiveness of our campaigns and, in some cases, to show ads about Portal Orange to people who have visited our sites or interacted with the Platform. This may include:
- Meta Pixel and Conversions API, used to measure results of campaigns on Facebook and Instagram and, where appropriate, to carry out remarketing.
- Google Ads tags and similar technologies, to measure conversions and optimize advertising campaigns related to Portal Orange.

In some cases, these cookies are placed directly by us (“first-party cookies”) and, in others, by third parties that provide analytics or advertising services (“third-party cookies”).

10.3. Consent and cookie management

In those countries where legislation requires it (for example, in the European Union or territories with similar regulations), we will use a cookie banner or settings panel that will allow you to:

Accept or reject the use of non-essential cookies (for example, analytics and advertising cookies).
Obtain additional information about each category of cookies.
Modify your preferences at any time.

Strictly necessary cookies for the functioning of the site and the Platform will be installed whenever you access our services, since they are indispensable to provide you with the basic service.

In addition to the banner or settings panel, you can manage or delete cookies directly from your browser settings, which allows you to:

Block all cookies.
Block cookies from certain sites.
Delete existing cookies from your device.

Please note that if you decide to block or delete certain cookies, some Platform features may not be available or may not work correctly.

10.4. Third-party cookies

Some cookies and similar technologies are managed by third parties (for example, Google, Meta, or analytics and advertising providers). These third parties may also process the collected data for their own purposes, in accordance with their privacy policies.

We recommend reviewing the privacy and cookie policies of these third parties to obtain more detailed information about how they process your data, especially regarding:

Google (Google Analytics, Google Ads, Tag Manager)
Meta (Facebook, Instagram, Meta Pixel)

When the regulations of your country require it, we will request your consent before using cookies and similar technologies for analytics or marketing purposes.

11. Security measures

We take the security of your personal data and of the information you manage through Portal Orange seriously.

We implement reasonable technical, organizational, and administrative security measures to protect your data against unauthorized access, loss, misuse, alteration, or destruction. Among others, this includes:

Use of recognized cloud infrastructure providers (such as Amazon Web Services – AWS and Supabase) that offer advanced physical and logical security mechanisms.
Access controls based on credentials and permissions, with encrypted passwords and internal access restrictions limiting data to only the staff who need it to perform their duties.
Measures to protect communications and access to the Platform through secure protocols, as well as internal policies aimed at protecting information.
Backups and reasonable procedures for recovery in the event of incidents.

Nonetheless, no system is completely secure. Despite our efforts, we cannot guarantee the absolute security of the information transmitted or stored.

You also play an important role in protecting your data:

Keep your access credentials confidential and do not share them with third parties.
Notify us immediately if you detect or suspect any unauthorized use of your account, improper access, or security incident.

In the event of a security incident affecting your personal data and where applicable law so requires, we will take reasonable steps to notify you and, where appropriate, inform the competent authorities.

12. Processing of minors’ data

Portal Orange is intended exclusively for people over 18 years of age. We do not deliberately offer the Platform to minors, nor do we knowingly collect personal data from minors.

By creating an account or using the Platform, you declare that you are at least 18 years old and that, where applicable, you have the legal capacity necessary to enter into contracts in your jurisdiction or that you act in valid representation of a company or organization.

If we become aware that we have collected personal data from a minor under 18 without the necessary legal safeguards:

We will take reasonable steps to delete that information as soon as possible.
We may take measures to close the associated account, if applicable.

If you believe that a minor has provided us with personal data improperly, we ask you to contact us through the email indicated in this Privacy Notice.

13. Changes to this Privacy Notice

We may update this Privacy Notice from time to time, for example, to reflect:

Changes in applicable legislation.
New features, services, or integrations of Portal Orange.
Modifications to our internal processes or to the way we process personal data.

When we make significant changes, we will seek to:

Publish the updated version on our website, indicating the date of last update.
Inform you through reasonable means (for example, notices on the Platform or emails) when it involves relevant changes that may significantly affect your rights or the way we process your data.

We recommend reviewing this Privacy Notice periodically to stay informed about any updates. Continued use of the Platform after the publication of an updated version will mean that you accept those changes to the extent permitted by applicable legislation.

14. How to contact us

If you have questions, comments, or wish to exercise your data protection rights, you can contact us at:

ENSO MKTG LLC – Privacy Team / Portal Orange
📧 Email: privacy@portalorange.com

When writing to us, please try to include enough information for us to identify your account or relationship with Portal Orange (for example, the email you used to register on the Platform) and clearly detail your request.

We will do what is reasonably possible to respond within an appropriate period and in accordance with the regulations applicable to you.