At VORTA we take the privacy of your data seriously. This policy explains what information we collect, how we use it, and the rights you have over it.
1. Data controller
VORTA Company, domiciled in Zapopan, Jalisco, Mexico, is the controller of your personal data under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
2. Data we collect
We collect the following personal data: • Identification data: full name, email address. • Company data: name, line of business, number of employees, country. • Usage data: modules used, sessions, interactions with the system. • Payment data: processed by PCI DSS-certified third parties — VORTA does not store card data. • Technical cookies: to keep your session active and improve your experience.
3. Purposes of processing
We use your data to: • Create and manage your VORTA Client Hub account. • Provide, personalize, and improve the service. • Send you communications related to your account (no advertising without consent). • Comply with legal and accounting obligations. • Analyze product usage in an aggregated, anonymized way to improve features.
4. Cookies
We use essential technical cookies required for the service to function (authentication, language preferences). We do not use third-party advertising tracking cookies. You can disable cookies in your browser settings, although this may affect the functionality of the service.
5. Data transfers
Your data may be shared with: • Supabase (database infrastructure — USA, compliant with EU SCCs). • Vercel (hosting platform — USA). • Anthropic (AI processing for diagnostics — USA). • OpenAI (AI processing — USA). We do not sell or transfer your personal data to third parties for commercial purposes.
6. ARCO rights
You have the right to Access, Rectify, Cancel, or Object to the processing of your personal data (ARCO rights under Mexican law). To exercise them, send an email to: admin@vorta.mx With the subject "Ejercicio de derechos ARCO" and include: your full name, registered email, the right you wish to exercise, and any supporting documentation where applicable. We will respond within a maximum of 20 business days.
7. Data retention
We retain data for the duration of the service and according to documented applicable periods. An account-closure request starts a traceable export, restriction, and deletion process. Fiscal, accounting, security, or legally held data may be retained for the required period and is deleted or anonymized when that period ends. The applicable timeline is communicated when the request is confirmed.
8. Security
We implement verifiable technical and organizational controls: HTTPS/TLS, tenant isolation, role-based permissions, operational audit trails, and mandatory TOTP AAL2 for privileged Commerce access in production. Backup, restore, monitoring, and independent review are release gates for each environment. For more information, see our Security page.
9. Changes to this policy
We may update this policy from time to time. We will notify you by email if the changes are material. The current version will always be available at vortacompany.com/privacidad.
10. Contact
For any questions about this policy: Email: admin@vorta.mx Address: Zapopan, Jalisco, Mexico