Last updated: September 2026
This notice describes how Enkoras (the "Platform") handles personal data pursuant to Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP). The controller's contact email is contacto@enkoras.com; the legal name and address will be published once the company is formalized, and this notice will be updated then.
Account: email, name and password (stored encrypted by our authentication provider). If you invite someone to your team, we collect their email to deliver the invitation and operate their access.
Company: trade name, line of business, description, catalog, location, business contact details (phone, WhatsApp, email, website and social profiles), logo and photos. This is commercial data the company chooses to publish; direct contact details (phone, WhatsApp and email) are shown only to signed-in users, never to anonymous visitors.
For verification: RFC and tax status certificate (see its own section below).
Bids: what the calling company publishes (title, description, quantity, location, folio and its identity as caller), participants' offers and amounts, and the award records documenting what happened in each room.
Payments (plans): charges happen directly with Stripe; we only store customer and subscription identifiers, never card data.
Usage: messages between companies (visible only to participants), reviews you publish (rating, comment and your company's identity as author), suppliers you save (a private list), notifications, ephemeral collaboration signals visible to your own team (who is online, who is typing, who is handling a chat) and minimal technical session data.
Operating the Platform: publishing profiles and catalogs, classifying content with artificial intelligence, showing availability, running bids and their records, routing demand to suppliers in the relevant line of business, enabling chat, teams and notifications, and charging for plans.
Protecting the Platform: preventing fraud and company impersonation, and preserving the records that give operations certainty.
We do not use your data for third-party advertising, nor do we sell it.
To verify a company we request its RFC and tax status certificate. We retain the certificate after resolving the request, for one concrete purpose: security and fraud prevention — it is the documentary evidence if a profile turns out to be impersonated or its data does not match reality.
The certificate is never published or shared: it lives in private storage and only Enkoras' verification team can consult it. It is permanently deleted when you delete your account, or earlier if you exercise your cancellation right and no obligation or legitimate interest requires keeping it (for example, an ongoing fraud investigation).
We use artificial intelligence to classify the commercial content you publish (catalog, bids) into the directory's categories and to order search results by objective signals. These processes make no decisions with legal effects on persons: classification can always be reviewed and corrected by the user (when publishing and from their panel), and no Platform interaction puts you in conversation with an artificial intelligence posing as a person.
Your company profile, your current availability and your open bids are public pages by design: publishing them is the dissemination decision. That public content may be indexed by search engines and cited by AI assistants — that is how the directory brings you customers. What is not public (direct contact details, chats, closed-room offers, verification documents) is not exposed to search engines.
We use providers that process data on our behalf: Supabase (database, authentication and storage), Vercel (hosting), Stripe (plan billing), Google (artificial intelligence to classify catalog and bid texts — no personal contact data sent — and Analytics for aggregate statistics) and Resend (operational email delivery).
Beyond these processors, we do not transfer personal data to third parties except under legal obligation or a competent authority's requirement.
We send operational emails only: team invitations and account notices (verification, free-trial expiry). Activity notifications live inside the Platform. We do not send advertising email without your consent.
We use essential cookies (user session and preferred language) and Google Analytics measurement cookies, which give us aggregate statistics to improve the site. We do not use advertising cookies or sell browsing data.
We keep data while the account is active or as needed for the purposes described. Bid, offer, record and message data are preserved as the operations' history: they are the parties' documentary certainty. Deleting your account deletes your company and its data, including verification documents.
We enforce row-level access controls in the database (RLS) so each party sees exclusively their own data, private realtime channels, and private storage for documents.
You may exercise your rights of Access, Rectification, Cancellation and Objection, and revoke consent, by writing to contacto@enkoras.com; we respond within the LFPDPPP's timeframes. In addition, your company information can be edited directly from the My company panel, and you can delete your entire account — including your company and all its data — from Account settings.
The Platform is a business-to-business service: it is not directed at minors and we do not deliberately collect sensitive personal data (health, origin, beliefs). Please do not publish such data in free-text fields.
Any update will be published here. Substantial changes — such as a change in purposes or retention — will be announced on the Platform.