Privacy Policy

1. Introduction

Portaal ("we", "us", "our") operates the portaal.io platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

We collect information in the following ways:

Account Information: When you create an agency account, we collect your name, email address, and password. We may also collect your company name, logo, and branding preferences.

Client Information: When agency clients use our onboarding links, we collect their name, email, and information they provide through intake forms configured by the agency.

Platform Access Tokens:When clients connect their advertising accounts (Meta, Google, TikTok, LinkedIn), we receive OAuth access tokens. These tokens are encrypted at rest using AES-256 encryption and are used solely to grant partner-level access to the agency's business manager or manager account.

Usage Data: We collect standard usage data such as IP addresses, browser type, pages visited, and actions taken within the platform.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Portaal platform
• Process client onboarding requests and grant platform access on behalf of agencies
• Monitor connection health and send automated alerts
• Send transactional emails (invitations, reminders, notifications)
• Process payments and manage subscriptions
• Improve our platform and develop new features
• Comply with legal obligations

4. Data Sharing

We do not sell, rent, or trade your personal information. We may share data with:

• Platform providers (Meta, Google, TikTok, LinkedIn) as necessary to complete OAuth flows and grant access permissions
• Service providers that help us operate our platform (hosting, email delivery, payment processing)
• Law enforcement when required by law or to protect our rights

5. Data Security

We implement industry-standard security measures including:

• AES-256-GCM encryption for all OAuth tokens at rest
• TLS 1.3 encryption for all data in transit
• Bcrypt hashing for passwords
• Role-based access controls
• Regular security audits

6. Data Retention

We retain account data for as long as your account is active. OAuth tokens are automatically deleted when a connection is revoked or an account is closed. You may request deletion of your data at any time.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw consent for data processing
• Object to automated decision-making

8. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect and how it is used
• The right to request deletion of your personal information
• The right to opt-out of the sale of personal information (we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at privacy@portaal.io.

9. Third-Party Platforms

Portaal integrates with third-party platforms including Meta Platforms Inc., Google LLC, TikTok (ByteDance), and LinkedIn (Microsoft). Each platform has its own privacy policy. We encourage you to review their policies. Portaal is not affiliated with, endorsed by, or sponsored by any of these companies.

10. Cookies

We use essential cookies to maintain your session and preferences. We do not use third-party advertising cookies. Analytics cookies (PostHog) are used to improve the platform and can be opted out of.

11. Children's Privacy

Our service is not directed to individuals under 18. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or through the platform.

13. Contact

For privacy inquiries, contact us at privacy@portaal.io.

Portaal is operated by Boreal Tech Solutions, Inc., based in Saint-Alphonse-Rodriguez, Quebec, Canada.