Privacy Notice

1. What data we process

• From shops and their users (our customers): name, email, phone, business name and details, tax details when required for invoicing, Service usage data and payment data. Card data is received and processed directly by Stripe; Phorlan does not store it.
• From each shop’s customers: name, phone, email, company, vehicle details (make, model, year, plate, VIN, mileage), vehicle photos and videos, on-screen signature, appointments, orders, estimates and payments. The shop collects this data while providing its service; Phorlan processes it on the shop’s behalf, and the shop is the controller towards its customers.
• From visitors to this site: technical browsing data (IP address, device and browser type, pages viewed) and, only with consent, measurement cookies. If you leave your email on the waitlist, only that email and the page language.

2. What we use it for

Purposes necessary for the Service: creating and managing the account; providing the Service’s features (including generating documents, notifications and the end-customer portal); charging the subscription; providing support; maintaining security and backups; complying with legal and tax obligations.

Secondary purposes: sending you product news and notices about Phorlan. You may object to these at any time by writing to info@phorlan.com or using the unsubscribe link in our emails, without affecting the Service.

3. Who we share it with

We do not sell personal data. To operate the Service we use providers that process data on our behalf (processors), some located outside Mexico, mainly in the United States and Canada:

• Supabase: database, authentication and file storage.
• Vercel: hosting of the application and the site.
• Cloudflare: domain, delivery network and backup copies.
• Stripe: subscription billing.
• Mercado Pago: payment links the shop sends to its customers, when the shop connects its account.
• Anthropic: artificial intelligence models for assisted features. Data sent is not used to train models.
• Resend: transactional email delivery.
• Sentry: technical error logging, with personal data filtered out.
• Tools each shop connects on its own (for example, respond.io for WhatsApp): the shop decides to connect them and transmits its customers’ data to them under that tool’s terms.

4. Transfers

Beyond the processors above, we only transfer data when the law requires it or an authority demands it. Any other transfer will require your consent.

5. Your rights and how to exercise them

You may access, rectify, cancel or object to the processing of your data, as well as revoke your consent and limit its use (ARCO rights under Mexican law). Write to info@phorlan.com stating your name, a way to reply to you, the data concerned and what you request; we may ask you to prove your identity. We respond within 20 business days. If you are a customer of a shop that uses Phorlan, address your request to the shop, which is the controller of your data; you may also write to us and we will forward it. If you believe your rights have been violated, you may contact Mexico’s National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

6. Cookies and similar technologies

This site uses technical storage needed to work and, only if you accept it in the corresponding banner, Google measurement cookies to understand site usage and the effectiveness of our ads. You may reject them without the site ceasing to work and delete them from your browser. The application uses local storage on the device to work offline and keep preferences; it is not used for advertising.

7. How long we keep it

While the shop’s account is active and for 30 days after it ends, to allow reactivation or export. After that it is deleted, except what we must keep under legal or tax obligations. Backups rotate and expire on short schedules. Waitlist emails are kept until we notify you or you ask for their deletion.

8. How we protect it

Encryption in transit and at rest, isolation of each shop’s information, role-based access control, temporary links for files, change logs and daily backups. No measure is infallible; should an incident affect your data, we will notify you as required by law.

9. Minors

The Service and this site are not directed at minors and we do not knowingly collect their data.

10. Changes to this notice

We will publish any change on this page with its update date. If the change is significant, we will also notify you by email or inside the Service.

11. Contact

Phorlan Technologies, S. de R.L. de C.V. · Ciudad de México, México · info@phorlan.com