Versión en español ← Back to home

Privacy Policy

Last updated: July 13, 2026

This Privacy Policy describes how Francisco Javier Pérez Bouquet Lazcano (the "Controller" or "Portia"), located in Guadalajara, Jalisco, Mexico, and reachable at privacidad@portia.mx, collects, uses, and protects the personal data that users provide when using the Portia platform (the "Platform"), available at portia.mx.

Portia is a case- and file-management platform for lawyers and law firms in Mexico. This Policy is issued in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) published in the Official Gazette of the Federation on March 20, 2025 and effective from March 21, 2025 —which repeals the prior law of July 5, 2010— and its implementing regulations. The competent authority for the protection of personal data held by private parties is the Ministry of Anti-Corruption and Good Governance, which assumed the functions previously held by the now-dissolved National Institute for Transparency, Access to Information and Protection of Personal Data (INAI).

Portia's role in data processing

Portia acts in a dual capacity depending on the type of data involved:

• Data Controller with respect to the data of lawyers and users who register directly on the Platform (name, email, account settings, payment history).
• Data Processor with respect to the data of clients and of the case files that lawyers enter into the Platform (client contact data, case files, notes, scanned documents, matter finances). In this case, the lawyer is the Controller under the LFPDPPP and is bound by professional secrecy and the rules governing legal practice; Portia processes such data solely under the lawyer's instructions and to operate the service. This relationship is formalized upon accepting the Terms of Use.

1. Personal data we collect

Depending on the type of user, we collect the following data:

Lawyers:

• Full name and email address (via Google OAuth).
• Google calendar and scheduling information (events, availability), if the lawyer connects Google Calendar.
• Client data the lawyer voluntarily records: full name, email, phone number, address and, where applicable, tax ID (RFC).
• Case files, notes, scanned documents, and matter financial information entered by the lawyer.
• Account settings and preferences.

Clients:

• Full name and email address (via Google OAuth), upon linking their account with an invitation code from their lawyer.
• Documents and files the client uploads in response to their lawyer's requests.
• Read receipts for hearing reminders and case updates.
• Validations and correction requests regarding their own personal data.
• Acceptance of the applicable lawyer's privacy notice.

Authorized users (collaborators and paralegals):

• Full name and email address (via Google OAuth), upon linking with the lawyer's invitation code.
• Notes and case-file pages they contribute to the files to which the lawyer granted access (attributed to their author).

Sensitive personal data. By their nature, court files may contain sensitive personal data about the parties (for example, health, criminal, origin, or family/financial information). Such data is entered and managed by the lawyer as Controller, under professional secrecy and the legal basis applicable to their engagement; Portia processes it as Processor, solely to operate the service, and does not access it except for the reasons described in Section 12.

2. Purposes of processing

Primary purposes (necessary for the service):

• Authenticate the user's identity via Google OAuth.
• Manage the lawyer's schedule and sync hearings and appointments with Google Calendar.
• Store and display case files, notes, scanned documents, and matter financial information.
• Automatically monitor the judicial bulletin of the Judicial Council of the State of Jalisco by case number (see Section 5 bis).
• Enable communication between the lawyer and their client within the Platform (document requests, hearing reminders, case updates).
• Generate reminder and invitation messages to be sent via WhatsApp, using the name and contact information the lawyer recorded.
• Allow the lawyer to grant scoped access to collaborators and paralegals (authorized users).

Secondary purposes (the data subject may decline without affecting use of the service):

• Sending communications about improvements, new features, or Platform updates.

3. Use of the Google Calendar API

The Platform uses the Google Calendar API to read, create, modify, and delete events in the lawyer's calendar, exclusively with their express consent through Google's OAuth 2.0 authorization flow.

Access to Google Calendar is used solely to:

• Display the lawyer's weekly schedule within the Platform.
• Create, move, or cancel hearings and appointments linked to a case file.
• Check availability to propose time slots.

Data obtained from Google Calendar is not shared with third parties, is not used for advertising, and is not transferred outside the context of the service described here. The Controller complies with the Google API Services User Data Policy, including the Limited Use requirements.

The lawyer may revoke Google Calendar access at any time from the "Agenda" (schedule) section of the Platform or directly at myaccount.google.com/permissions.

4. Google data: retention and deletion

What Google data we store and for how long:

• Google Calendar authorization tokens — OAuth 2.0 tokens that let the Platform access the lawyer's calendar on their behalf. They are stored securely on Google Cloud servers (Firestore and Google Secret Manager), with access restricted exclusively to server-side Cloud Functions — never accessible from the browser. They are retained while the lawyer keeps Google Calendar connected. They are permanently deleted when the lawyer disconnects Google Calendar from the Platform or revokes access at myaccount.google.com/permissions.
• Google profile information (full name and email) — obtained at sign-in and stored in the Platform's database. Retained while the user keeps an active account. Deleted upon an account-closure request within a maximum of 30 days.
• Calendar event data — the Platform reads events in real time to display the lawyer's weekly schedule. Only the specific fields of each appointment (date, time, event title and Google Calendar event identifier, along with the case file it is linked to) are stored in the Platform's database to sync appointments with the client app. This data is retained until the lawyer deletes the corresponding appointment or requests account closure. Calendar event content is not stored beyond what is strictly necessary for the described purpose.

How to delete your Google data:

• Only disconnect Google Calendar: click "Disconnect" in the "Settings" section of the Platform. This immediately revokes and deletes the stored authorization tokens. You may also revoke access directly at myaccount.google.com/permissions.
• Delete all Google data (full account closure): send a request to privacidad@portia.mx with the subject "Google data deletion request". All data originating from Google (profile, tokens, synced calendar appointments) will be permanently deleted within a maximum of 30 days of confirming the request.

Deletion requests are irreversible. Case files and client data entered manually by the lawyer are subject to the lawyer's own retention and professional-secrecy obligations as Controller, and are handled through the data-subject-rights (ARCO) process described in Section 8.

5. Use of WhatsApp for reminders and invitations

The Platform generates pre-drafted text messages (for example, with hearing information or a client's or authorized user's invitation code) for the lawyer to send manually via WhatsApp. The Platform does not send messages automatically and has no access to the WhatsApp account of the lawyer or the recipient; sending is always a voluntary, manual action by the lawyer. WhatsApp is a service of Meta Platforms, Inc., subject to its own terms and privacy policy.

5 bis. Judicial bulletin monitoring (CJJ)

At the lawyer's request, the Platform queries the public judicial bulletin of the Judicial Council of the State of Jalisco (through its official online system) to monitor published rulings for the case files the lawyer configures. To do so, it sends that official system the case number and court —public information of the court file— and stores the ruling extracts that the bulletin itself publishes. Clients' personal data recorded in the Platform is not sent to the CJJ. The Judicial Council is a public authority subject to its own regulations.

6. Data transfers and sub-processors

Personal data is not sold, assigned, or transferred to third parties, except in the following cases necessary to operate the service. All listed providers act as data sub-processors and maintain adequate protection levels consistent with international standards. Data is stored on servers located primarily in the United States of America.

• Google LLC (USA) — authentication (Firebase Authentication), database (Firestore), server functions (Cloud Functions), and file storage (Cloud Storage). Google Privacy Policy.
• Google LLC (USA) — Google Calendar API integration, under the lawyer's express consent. See Section 3.
• Browser push notification services — when the client or authorized user enables push notifications, delivery is handled by the corresponding browser or operating-system messaging service (for example, Google's for Chrome). Only the minimal notification content is transmitted.
• Stripe, Inc. (USA) — subscription payment processing, once paid plans are enabled. Stripe handles card data directly; Portia does not store payment-instrument data. Stripe Privacy Policy.

The Platform also queries the public judicial-bulletin system of the Judicial Council of the State of Jalisco, as described in Section 5 bis.

7. Data security

The Controller implements the following technical and organizational measures:

• Encrypted transmission via HTTPS/TLS for all communications.
• Data access restricted by Firestore security rules: each user can access only their own data.
• Google Calendar access tokens stored securely in Google Secret Manager, inaccessible from the browser.
• Access log for case files and sensitive documents.
• Abuse protection via Firebase App Check.
• Mandatory authentication via a Google account for all users.

8. ARCO rights

The data subject has the right to Access, Rectify, Cancel, or Object to the processing of their personal data. To exercise these rights, send a request to:

• Email: privacidad@portia.mx.
• Subject: "Exercise of ARCO rights".

Where the data subject is a client whose data is managed by a lawyer, Portia will route the request to the responsible lawyer (Controller) or provide the necessary support, as appropriate. The request will be handled within a maximum of 20 days as established by the LFPDPPP. Where applicable, changes will be made within the following 15 days.

If the data subject believes their request was not adequately handled, they may turn to the competent authority for the protection of personal data held by private parties, the Ministry of Anti-Corruption and Good Governance (which assumed the functions previously held by the now-dissolved INAI).

9. Cookies and tracking technologies

The Platform uses browser local storage (localStorage and IndexedDB) solely to keep the user's session active and to store application preferences. No tracking cookies or third-party advertising are used.

10. Data of minors

The Platform is not directed at minors. A court matter may involve minors' data (for example, in family-law cases); the lawyer records it under their professional responsibility and with the legal basis and consents applicable under the LFPDPPP and applicable regulations. Portia does not independently verify the existence of such consents; that responsibility rests with the lawyer as Controller.

10 bis. Data retention and deletion

Data is retained for the following periods:

• Case files, notes, and documents — while the lawyer keeps the file on the Platform and in accordance with their professional retention and secrecy obligations. The lawyer may delete them at any time.
• Judicial-bulletin extracts — while the lawyer keeps monitoring active for the corresponding case file.
• Google Calendar tokens — until the lawyer disconnects the calendar or closes their account. See Section 4.
• Payment data (Stripe) — once billing is enabled, Stripe retains transaction records per its policy; Portia retains only the customer and subscription identifiers for as long as necessary to manage the account.
• Account data (name, email) — until the user requests account closure, with a maximum deletion period of 30 days from confirmation.

Audit data (case-file access logs) may be retained for as long as necessary to demonstrate compliance with security measures.

11. Changes to this Policy

The Controller reserves the right to modify this Policy at any time. Substantial changes will be notified through the Platform or by email at least 30 days in advance.

12. Google API Limited Use compliance

Portia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google Calendar data is used only to provide and improve the schedule-management features described in this policy; it is not used for advertising, is not sold or transferred to third parties for any other purpose, and user data is not read by humans except where necessary for security reasons, to comply with legal obligations, or with the user's express consent.

13. Contact