Privacy Policy

Effective from: September 3, 2026

Translated document

This is a courtesy translation of the official Spanish document. The Spanish version is the legally binding document; this translation is provided for informational purposes only to facilitate understanding.

At PORTA REAL, protecting your privacy and your personal data is a priority. We want you to have clarity about what information we collect, what we use it for, who we share it with, and how we protect it.

In this Policy we explain what personal data is, who is the controller responsible for its processing, what data we collect depending on how you use the platform, what rights you have over your information, how you can exercise them, and our contact channels for any inquiry or request. This Policy is governed by Ley N.° 8968, Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Costa Rica's data-protection law), and its regulations.

I. What Is Personal Data?

We mean any information that could be used to identify you, whether directly or indirectly: for example, your name, your email address, your phone number, your IP address, or a combination of data that, taken together, makes it possible to know who you are.

II. Who Is the Data Controller?

The Controller responsible for collecting, managing, and determining the purpose of the personal data you share when using our site is:

3-102-939791 SOCIEDAD DE RESPONSABILIDAD LIMITADA
Cédula Jurídica (corporate ID): 3-102-939791
Registered Office: Condominio Blue, Casa 21, Residencial Los Arcos, Heredia, Costa Rica

3-102-939791 Sociedad de Responsabilidad Limitada (hereinafter, "PORTA REAL"), registered with the Registro Nacional de Costa Rica under Tomo 2025, Asiento 571526, makes available to internet users the platform hosted on this website, as well as the contents contained therein. PORTA REAL® is a service mark registered under Registro N.° 414509 with the Registro de la Propiedad Intelectual, and is the commercial identity under which we operate.

III. What Data Do We Collect?

a. If you are a registered user

We collect:

Identification and contact: first name, last name, email address, phone and WhatsApp number, profile photo, address (province, canton, district).
Identity document (cédula): when we request it, it is collected exclusively for identity verification purposes. We do not use it for any other purpose.
Card payment information (when card payment is enabled): the card number, expiration date, security code, and cardholder name are captured and processed directly by TILOPAY SOLUCIONES COMERCIALES LTDA, cédula jurídica 3-102-833000, an external payment gateway. PORTA REAL does not collect, does not store, and does not have access to that data; it only receives from the gateway the confirmation of the payment's outcome and the minimum reference data for the transaction.
Manual payment data when you choose to pay by SINPE Móvil or bank transfer: the phone number or account you send the money from, the reference code for the charge, any note you add, and the proof of payment you voluntarily attach, verified directly by PORTA REAL without the payment gateway's involvement.
Data from your real estate publication: location, price, characteristics, contact information you authorize to be displayed, as well as the documents, videos, and images attached to your publication — including those imported via URL or external file, over which you declare ownership or authorization.
Background checks for agents and agencies: this service is not active at this time; when it is enabled, it will be governed by a specific policy that we will inform you of before any processing.
Reviews and ratings of agents: when this feature becomes available, we will collect the reviews and ratings you publish and those you receive.
Real estate preferences and interests: favorites, collections, search alerts, and private notes.
Search history: including intelligent natural-language search (see section V, which identifies the artificial intelligence provider and what is transmitted to it; we recommend not including sensitive data in your queries).
Customer support information and communications with our support team.
Internal messaging between users: the messages and attached files you exchange within the platform (no end-to-end encryption; avoid sharing sensitive data).
Connection and usage data, technical browsing data, and account changes (the latter retained for audit purposes), and any other information you provide voluntarily.

b. If you use the professional layer (Red Porta, CRM, and document custody)

If you activate the platform's professional features — the Porta Agent Network (the "Red Porta" or "the Network"), the CRM, and document custody — we additionally collect:

Commission terms: the shared-commission conditions you publish on your listings (whether you share commission, percentage, conditions, type of agreement, and attribution window). These terms are confidential among Network members and are never public.
Alliance records: the requests, acceptances, and terminations of alliances between professionals. The existence of an alliance is private: who works with whom is never shown publicly.
Collaboration records: the terms frozen at the moment of acceptance, the collaboration's events, and the sharing links you generate.
Records of referred buyers (pseudonymized): when a buyer contacts a listing through a collaboration, we record the contact pseudonymously (for example, "Buyer #3"). The buyer sees a notice at the point of contact: "Your contact is recorded as referred by {agent}" (text shown in the app). The collaborating professional does not receive the buyer's identity through this record.
Documents in custody: the already-signed agreement document that either of the two parties to a professional relationship uploads to the platform, its digital fingerprint (SHA-256), both parties' confirmations, and the access log. Access to a document in custody is limited to the two parties to the relationship, and every access is logged. PORTA REAL does not verify the authenticity or content of these documents.
CRM client data: if you are an agent or agency and use the CRM, we process your clients' data. When the client is a Porta user, we do not duplicate their personal information. When you register a manual client (a person who is not a Porta user), the data you enter is data about your client: you declare and warrant that you obtained it lawfully and hold a legal basis for its use, and PORTA REAL acts solely as a processor for the storage and status management of that information, in accordance with the processing terms of the service contract (Terms and Conditions). The stages, notes, and tasks of your sales pipeline are your private data and are never visible to the client.
Appointments and visits: when a buyer requests a visit to a property and the professional confirms it, the requesting person is automatically registered as a linked client in the professional's CRM, with the contact details the platform already holds. Likewise, when you send a first message to an advertiser about one of their properties, the advertiser may register you as a client in their CRM to follow up on your inquiry.
Demand cohorts (voluntary participation): if you explicitly activate this option (off by default and revocable at any time), your search alert is added to an anonymous demand grid. See the processing details in section IV.

c. Operational server logs

For operational, security, and abuse-prevention reasons, our servers record the following. These logs are generated because they are strictly necessary for the security of the platform and the prevention of fraud and abuse, in compliance with the security duty imposed by article 10 of Ley 8968; they are not used to profile you or for commercial purposes:

Searches: every search executed on the platform is logged with the IP address, the browser's user agent, the filters applied, and, if a session is active, the account that performed it. This also applies to visitors without an account.
Listing reports: when you report a publication, we record the reason, the details you write, your IP address, and, if you have an active session, your account, in order to manage moderation.
Listing view and contact metrics: collected only in aggregate form, without identity; the IP address is used transiently (with a deduplication mechanism of at most one hour) and is not stored associated with the metric.

d. If you are a visitor

We collect device and browser information, IP address, connection and platform usage data, search history (see section V, which identifies the artificial intelligence provider and what is transmitted to it; we recommend not including sensitive data in your queries), and interaction with the website. Some of this data is collected through cookies; please review our Cookie Policy. The retention period is 2 years from the date of the last visit.

e. Data of persons who are not users

In some cases we process personal data of persons who do not have a Porta account:

Email invitations: when an agency invites an agent, or when a user shares a property collection, the invitation is sent to an email address that may not belong to any Porta account, at the request of the inviting person or agency, who declares that they hold that address legitimately. We use that address solely to deliver the invitation and manage its acceptance or expiration; we do not add it to marketing lists or use it for any other purpose.
Manual CRM clients: described in section III.b — data provided by the agent under their own warranties of lawfulness.
Third-party contact details in imported content: the documents or URLs a user imports to create a publication may contain third-party contact details; the person importing declares that they hold authorization over that content.

If you are not a Porta user and believe we process data about you, write to us at soporte@porta.cr. We will handle your request directly when PORTA REAL is the controller of the processing (for example, the invitations described above). When your data was registered by an agent or agency in their CRM, PORTA REAL acts solely as a processor: we will forward your request to the agent or agency acting as controller, inform you that we have done so, and cooperate with whatever technically depends on the platform.

f. Mandatory or optional nature of the data and consequences of not providing it

Of the data described in this section, only the data strictly necessary for the feature you request is mandatory to provide, identified as required in the corresponding form: for example, the account registration data, the minimum listing information required by section 6.1 of the Terms and Conditions, the identity document when requested from you to complete a verification, or the data for the chosen payment method. The consequence of not providing it is that it will not be possible to complete the corresponding action (creating the account, publishing the listing, completing the verification, or processing the payment, as the case may be); there is no other consequence.

All other data is optional: declining to provide it does not prevent you from using the platform, although it may limit the specific feature that depends on it (for example, the profile photo, search alerts, or the visibility of your phone number).

IV. How Do We Use the Data We Collect?

We process your personal data to:

Offer and operate the PORTA REAL platform: create your account, manage your profile, process payments, publish and search for properties, facilitate communication between users, send messages and notifications, provide support, manage reviews when available, and operate the Porta Agent Network ("Red Porta"): alliances, collaborations, commission terms, document custody, CRM, and demand cohorts.
Ensure security and prevent fraud: verify identity, detect fraudulent activity (including, in the referral program, cross-checking phone numbers between accounts to detect self-referrals and abuse), manage reports, maintain audit logs, and, when the service is active, carry out background checks.
Maintain records for proof and evidence: in the professional features (collaborations, alliances, and document custody), PORTA REAL records the agreements, their frozen terms, and the relevant events as evidence for the parties. PORTA REAL is not a party to those agreements and does not intervene in disputes between users; each party may request the evidence records to which it is a party.
Develop and improve the platform: usage analysis, improvement of our features — including AI-assisted ones — and training of our support team.
Comply with legal obligations under Ley 8968 and other applicable law, and handle the exercise of the rights described in section VIII.
Carry out communications and marketing only when you have given us your consent (see section VII).

Demand cohorts: how the processing works

If you activate participation in demand cohorts (an option that is off by default):

Your search alert is added to an anonymous demand grid. Each cell of the grid groups at least 5 people; counts are shown only as ranges, never exact figures, and there is no function to look up who makes up a cell.
A professional can express interest in a cell (an area and type of search), never in a person. Professionals never receive your identity or your contact details through this feature.
When there is interest in a cell that matches your alert, it is Porta that notifies you, within the application. Only if you have enabled email notifications might the notification also reach you through that channel.
You can mute a specific professional so as not to receive further notifications originated by them, and you can revoke your participation at any time; the revocation is honored at delivery time, so you will not receive notifications after it.

Artificial intelligence: what it does and what it does not do

Some features use a third party's artificial intelligence models (see section V): natural-language search, assisted description generation, and assisted listing import.

PORTA REAL does not use your content or your personal data to train artificial intelligence models of its own, and contracts its AI features under conditions pursuant to which the provider does not use them to train its models. The "platform improvement" purpose described above covers analyzing how these features perform in order to improve the service, but does not include training models on your content. Keep in mind that the content you publish with public visibility is distributed to search engines, artificial intelligence assistants, and social platforms as part of the distribution service (Terms and Conditions, section 7.3), and those third parties process it under their own policies, which may include training models on publicly accessible content. If our own use were to change in the future, we would update this Policy and ask for your prior consent.

Agents and agencies as independent controllers

When you expressly authorize your data to be shared with selling agents or real estate agencies (for example, when contacting a listing or requesting a visit), they will act as Independent Data Controllers, governed by their own policies. We recommend reviewing those policies before authorizing the exchange.

Public visibility of your profile and your listings

When you publish a listing or maintain a public profile, the information you choose to display becomes publicly accessible on the internet: your name and your identity as a seller, agent, or agency, your photograph, the contact information you authorize to be shown, and your listings' data (location, price, characteristics, photographs, and videos). As part of the distribution service you accept when publishing, that information is also delivered to search engines, assistants and artificial intelligence systems, and social platforms, as described in the license and public distribution section of the Terms and Conditions (section 7). You can adjust what is displayed with the controls described in section VIII: the "Public profile" switch (available for accounts without published listings or visible closed transactions) and the visibility switches for your phone number and the WhatsApp button.

V. Disclosure of Personal Data to Providers

PORTA REAL may disclose your data to service providers that provide it with technical and operational support, who process it on behalf of PORTA REAL and following its instructions, except for those processing operations the provider itself carries out for its own security and fraud-prevention purposes under its own policies, as indicated in each case and in the Cookie Policy:

Amazon Web Services (AWS): cloud infrastructure — database, file and image storage (S3), email delivery (SES), search engine (OpenSearch), and content delivery network (CloudFront). It also acts as a sub-processor for the storage of the CRM data described in section III.b.
AWS Bedrock (Anthropic Claude models): artificial intelligence service used for three features: (1) natural-language search — the free text you type or dictate is transmitted to this provider to convert it into search filters; (2) assisted description generation — your property's data and the text you provide are transmitted to generate a draft that you review before applying; and (3) assisted listing import — the URLs you indicate and the files you upload (documents and images; images are read multimodally) are transmitted to extract the property's data.
Auth0: authentication and digital identity provider. It manages sign-in and the security of your account.
Google Maps / Google Places: maps and addresses service used to display and search for the location of properties.
Google Analytics 4: site usage analytics. It is only activated if you accept the Performance category in the cookie preference center.
Sentry: technical error monitoring. Error reports are scrubbed of personal data before being sent; performance measurement is only activated with your consent in the cookie preference center.
Tilopay: when card payment is enabled, it will be the provider in charge of the secure processing of your card transactions and payment data. Payments by SINPE Móvil or bank transfer are not disclosed to this provider: PORTA REAL verifies them directly.
Meta — WhatsApp: when WhatsApp notifications are enabled and you activate them, the data necessary for that channel will be transmitted to the corresponding provider.
Meta — Pixel / Conversions API: when Meta advertising measurement is enabled, it will only be activated if you accept the Marketing category in the cookie preference center.
Google Calendar: future CRM appointment-sync feature; it will only apply if you yourself connect your calendar, and we will inform you of its scope at the moment you connect it.

VI. International Data Transfers

The providers described in section V operate wholly or partly outside Costa Rica, mainly in the United States of America. By accepting this Policy, you expressly authorize your data to be transferred, stored, and processed in those countries, under the terms and with the safeguards described below.

PORTA REAL adopts the safeguards necessary for these transfers to comply with Ley 8968 and its regulations: we contract only providers that offer contractual data-protection guarantees and security measures equivalent to those required by Costa Rican law, and the processing they carry out is limited to the purposes described in this Policy.

VII. Communications and Emails

The communications we send you are divided into three levels:

1. Essential communications (cannot be disabled)

They are necessary to operate your account and your contractual relationship with PORTA REAL:

Security and account management emails: email verification, password reset, and account security notices.
Transactional billing emails: payment instructions when a charge is generated, confirmation of payment received, and notice when a payment could not be confirmed.
Invitations: when an agency invites you to join or someone shares a collection with you (these may reach email addresses of people who are not yet users — see section III.e).
Referral program notices: one-off notifications that you obtained a benefit already granted (for example, a free "Destacado" featured listing).
Legal notices: notifications about changes to the Terms and Conditions, to this Privacy Policy, or to the Cookie Policy.

2. Operational notifications (configurable by category)

They inform you about your account's activity, and you can turn them on or off by category from your account settings on the platform:

Search alerts: new properties matching your saved alerts.
My listings: notices about the status of your listings (for example, if a publication is blocked by moderation).
Expirations: notices before and after your publications expire.
Messages: notices of new messages received in internal messaging.
Weekly digest: a periodic activity summary, when enabled.
Billing reminders: reminders before the end of your trial period, additional reminders during the grace period, and notice of the change to the free plan. (The first notice that a payment could not be confirmed is an essential transactional communication — item 1.)

When they are enabled, the professional layer's notifications (collaborations, alliances, CRM reminders, and appointments) and demand cohort notifications will also be configurable by category (the latter by email only if you have additionally enabled email notifications). Categories on this list that do not yet appear in your settings panel will be added gradually; in the meantime, those notifications are sent with the default configuration described in this section.

3. Marketing (only with your consent)

We will only send you marketing communications or newsletters if you expressly activate that option, which is off by default. We do not currently send any marketing communications.

Your communication preferences are managed from your account settings on the platform. Platform emails are sent from addresses on the porta.cr domain: notificaciones@porta.cr, alerts@porta.cr, expirations@porta.cr, digest@porta.cr, and suscripciones@porta.cr. Authentication and account security emails (email verification, password reset, and security notices) are sent by our identity provider, Auth0, from its own sender. If WhatsApp notifications are enabled, the same model will apply: you will only receive them if you activate that channel.

VIII. Your Rights

Under Ley 8968 de Protección de la Persona frente al Tratamiento de sus Datos Personales (Costa Rica's data-protection law), you have the following rights:

Access: to know what data we process, for what purpose, and whether it has been shared with third parties.
Rectification: to correct inaccurate, incorrect, outdated, or incomplete data.
Revocation: to withdraw your consent to the processing of your data at any time.
Deletion or Erasure: to request the total or partial deletion of your data, in particular when it is no longer necessary for the purposes of this Policy, when you revoke your consent, or when the processing is contrary to Ley 8968. Deletion will not extend to the data PORTA REAL must retain under a legal obligation or for the periods in section IX, which will be explained to you in the response.

To exercise these rights, write to us at soporte@porta.cr stating the details of your request and attaching a copy of your identity document (cédula de identidad, DIMEX, or passport). If you act through a representative, the representative must prove their own identity and the power of attorney or authorization empowering them. Exercising these rights is free of charge. We will confirm receipt within no more than seventy-two (72) hours and resolve your request within no more than five (5) business days. If you believe your request was not addressed or that your rights have been violated, you may turn to the Agencia de Protección de Datos de los Habitantes (PRODHAB, www.prodhab.go.cr), Costa Rica's data-protection authority.

Privacy controls within the platform

In addition to the rights above, the platform offers you direct controls:

Public profile: you can disable your profile's public visibility from the privacy settings (visible by default). Accounts with published listings or with closed transactions visible on their profile cannot disable it, because their listings require displaying the advertiser's contact information; and if you publish a listing while your profile is hidden, the profile is automatically reactivated at that moment.
Phone and WhatsApp: the visibility of your phone number on your profile is optional and off by default; the WhatsApp button's visibility is on by default and you can turn it off.
Cookies: you can change your cookie preferences at any time from the preference center (see the Cookie Policy).
Demand cohorts: participation is voluntary, off by default, and revocable at any time; you can also mute specific professionals.
Notifications: per-category preferences under section VII, including per-conversation muting in messaging.

IX. Retention of Personal Data

We retain your data while you maintain an active account or continue using the platform, as well as for the periods required by legal, tax, accounting, and audit obligations, and the applicable limitation periods under Costa Rican law. The specific periods are:

Data category	Retention period
Visitor data	2 years from the last visit
Billing records (amount, dates, period, reference, payment method)	Four (4) years (Código de Comercio and tax regulations), or any longer period a rule requires; dissociated from your identity if you delete the account
Click-behavior data (subject to cookie consent)	12 months
Aggregated listing impression metrics	90 days
Aggregated view counters	120 days
Documents in custody	5 years after the professional relationship ends
Collaboration evidence records	5 years after the professional relationship ends
Messages and messaging attachments	While the conversation exists in your account
Search, intelligent search, AI generation, and import logs	While the account exists (deleted with it)
Records of acceptance of terms and policies	While the account exists

What happens when you delete your account?

When you delete your account:

Deleted: your profile, your publications and their photos, videos, and documents, your favorites, collections, alerts, search histories, acceptance records, messages, your personal subscription, and the payment receipts you attached. Your identity at the authentication provider (Auth0) and your stored files are also deleted; in external systems, deletion is handled using reasonable efforts.

Retained, to the extent described in this section:

Billing records, dissociated from your identity, for the periods of the Código de Comercio.
Security audit logs.
The collaboration evidence records and documents in custody of professional relationships you were a party to are retained for the period in the table above, so that the record both parties consented to when activating the professional features preserves its evidentiary value for the other party. In these records, your identifying data is limited to what is strictly necessary for that record: your name as registered when the agreement was accepted, and the signed document as uploaded, whose integrity (SHA-256 fingerprint) prevents altering it. Buyers appear in these records only pseudonymously (for example, "Buyer #3"). Your profile, your contact details, and the rest of your account are indeed deleted.
If an agent registered you in their CRM, their sales pipeline history is retained without your identity (the data that identifies you is deleted; the agent sees only the anonymous trail of their own management).

X. Access by PORTA REAL Staff

Authorized PORTA REAL staff may access personal data only to the extent necessary to operate the platform, moderate content, ensure security, prevent fraud, and provide you with support. In internal messaging, content deleted by users may be retained temporarily for the review of abuse reports. All administrative access is subject to internal controls and duties of confidentiality.

XI. Personal Data Security

We adopt appropriate technical and organizational measures to protect your information. Our infrastructure runs on Amazon Web Services with encryption at rest and in transit. If a security breach affecting your personal data is detected, we will notify you and, where applicable under the Regulations to Ley N.° 8968, the Agencia de Protección de Datos de los Habitantes (PRODHAB), within no more than five (5) business days from the moment we become aware of the incident. The notification will include the nature of the incident, the personal data compromised, the corrective actions taken, and recommendations of measures you can take to protect your interests.

XII. Minors

Our services are not directed at persons under 18 years of age, and we do not knowingly collect, sell, or share information about minors. If you become aware of such a case, write to us at soporte@porta.cr so we can investigate and, if appropriate, delete the data.

XIII. Modifications to This Policy

PORTA REAL may modify this Policy when circumstances warrant it or in response to regulatory reforms. We will notify you at least ten (10) business days before any modification takes effect, through the contact channels registered in your account or through a visible notice on the platform. If the change involves new processing purposes that require your consent, we will request it before applying them, in accordance with Ley N.° 8968. The current version will always be available in this section.

XIV. Contact Information

For any inquiry, request, or complaint, write to us at soporte@porta.cr. This Policy is drafted in Spanish; translations into other languages are provided solely as an informational courtesy and, in the event of any divergence, the Spanish version prevails.

Informed Consent

By accepting this Policy you give your informed consent, freely, specifically, expressly, and unequivocally, for PORTA REAL to process your personal data as set out in this document. This consent expressly covers: (i) the disclosure of your data to the service providers described in section V, who process it on behalf of and under the instructions of PORTA REAL; (ii) its transfer, storage, and processing outside Costa Rica pursuant to section VI; and (iii) the retention periods in section IX. You may revoke this consent at any time pursuant to section VIII, without retroactive effect on processing already carried out.