Privacy Policy
Portal Origin is committed to protecting your privacy. This policy outlines our data collection, processing, and storage practices, including your specific rights under the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and federal regulations.
1. Introduction & Scope
Portal Origin ("Portal Origin", "we", "us", or "our") operates the workspace operating platform accessible at portalorigin.com and its multi-tenant workspace subdomains (collectively, the "Service"). Portal Origin is based and operated in the State of California, United States.
This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of personal information when you:
- Visit our public marketing website at
www.portalorigin.com. - Register for an account or create a multi-tenant workspace organization.
- Apply for employment openings through our public careers portal.
- Interact with our platform documentation, communication channels, or APIs.
2. Categories of Information We Collect
Depending on how you interact with Portal Origin, we may collect the following categories of personal information:
| Category | Examples | Collected For |
|---|---|---|
| Identifiers | Full name, business email address, username, unique user ID, IP address, device identifier. | Account setup, authentication, security monitoring, communications. |
| Commercial Info | Workspace tier, subscription records, transaction history, feature entitlement tiers. | Billing administration, service delivery, account management. |
| Internet / Network Activity | Browser type, operating system, page views, access timestamps, referral URLs, interaction logs. | Application diagnostics, security logging, performance optimization. |
| Employment / Job Applicant Data | Resumes/CVs, cover letters, employment history, LinkedIn/portfolio URLs submitted via careers. | Candidate recruiting, job requisition evaluations, interview scheduling. |
| Workspace Member Content | Department names, desk/seat location coordinates, peer recognition shoutouts, time logs, service tickets. | Core workspace platform functionality according to tenant configuration. |
3. Sources of Personal Information
We collect personal information from the following primary sources:
- Directly from You: When you register an account, fill out contact forms, apply for a job requisition, or submit customer support tickets.
- From Your Employer / Organization Administrator: When your organization sets up a tenant workspace and provisions your user account, assigns reporting relationships, or manages access roles.
- Single Sign-On (SSO) & SAML Identity Providers: When your organization configures SAML 2.0 or OAuth authentication (such as Google Workspace, Microsoft Entra ID, Okta, or OneLogin), we receive identity tokens and profile attributes.
- Automated Technologies: Server error logs, session security cookies, and application diagnostic telemetry.
4. Business & Commercial Purposes for Processing
Portal Origin uses collected information exclusively for valid business and commercial purposes, including:
Service Provisioning
Operating employee directories, floorplan desk locators, recognition feeds, time tracking, and service tickets.
Authentication & Security
Enforcing RBAC permissions, preventing unauthorized tenant cross-access, detecting fraud, and audit logging.
Recruitment
Evaluating job candidate applications, conducting interviews, and communicating recruitment status.
Legal & Regulatory Compliance
Complying with applicable California and US state and federal laws, subpoenas, and regulatory audits.
5. Disclosure of Personal Information
We Do Not Sell Your Personal Information
Portal Origin does not sell, rent, or lease your personal information to third parties, nor do we share your personal information for cross-context behavioral advertising (as defined by the California Consumer Privacy Act / California Privacy Rights Act).
We disclose personal information strictly to the following categories of recipients:
- Service Providers & Subprocessors: Cloud infrastructure hosts (e.g., AWS database/storage), email dispatch services (e.g., transactional email systems), and enterprise security partners under strict confidentiality agreements.
- Your Organization Administrators: Workspace administrators have access to employee activity, timesheets, tickets, and directory profiles within their tenant boundaries.
- Legal Obligations: When required by lawful requests from public authorities, law enforcement agencies, or in connection with court proceedings.
- Business Transfers: In connection with any merger, acquisition, or sale of company assets, subject to standard confidentiality protections.
6. Notice to California Residents (CCPA / CPRA)
If you are a resident of the State of California, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights regarding your personal information:
1. Right to Know & Access
You have the right to request disclosure of the specific pieces and categories of personal information we have collected about you, the categories of sources, and the business purposes for collecting it.
2. Right to Delete
You have the right to request deletion of your personal information that we have collected, subject to legal and contractual exceptions (e.g., maintaining billing records or security logs).
3. Right to Correct Inaccurate Personal Information
You have the right to request that we correct any inaccurate personal information maintained in our systems.
4. Right to Opt-Out of Sale or Sharing
Portal Origin does not sell or share personal information for cross-context behavioral advertising. If this practice ever changes, we will provide a prominent "Do Not Sell or Share My Personal Information" link.
5. Right to Limit Use of Sensitive Personal Information
We only collect and process sensitive personal information (such as login credentials) strictly as necessary to deliver the Service and maintain security.
6. Right to Non-Discrimination
We will never discriminate against you (by denying services, charging different prices, or providing a different level of quality) for exercising any of your CCPA/CPRA rights.
How to Submit a Verifiable Consumer Request
To exercise your California privacy rights, you or your authorized agent may submit a request by:
We will acknowledge receipt within 10 business days and respond substantively within 45 calendar days after verifying your identity.
California "Shine the Light" Law (Civil Code Section § 1798.83)
California residents may request information once per calendar year regarding our disclosure (if any) of personal information to third parties for their direct marketing purposes. Portal Origin does not disclose personal information to third parties for direct marketing.
7. CalOPPA & Do Not Track (DNT) Signals
In compliance with the California Online Privacy Protection Act (CalOPPA):
- Users can visit our public website anonymously without registering.
- Our Privacy Policy link is prominently displayed in the footer of every public page with the exact word "Privacy".
- Do Not Track (DNT) Signals: While there is currently no universal industry standard for recognizing DNT browser headers, Portal Origin does not track users across third-party websites or serve targeted third-party advertising.
8. Multi-Tenant Workspace Data Isolation
Portal Origin is built on a strict multi-tenant architecture:
- Tenant Boundary Isolation: Data associated with one customer organization is logically segregated in the database and inaccessible to other organizations.
- Customer Ownership: All employee rosters, seating plans, kudos shoutouts, time logs, and custom form requests uploaded to a workspace remain the exclusive property of the respective tenant.
- Search Engine Exclusion: Multi-tenant workspace subdomains are private and configured with
X-Robots-Tag: noindex, nofollow, noarchiveto block web crawlers.
9. Data Retention & Deletion
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, deliver our services, resolve disputes, enforce our agreements, and satisfy legal obligations.
When a customer workspace is deleted or terminated, all associated member data is securely purged in accordance with our data destruction protocols within 90 days, unless longer retention is required by law.
10. Security Safeguards
We implement administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, loss, misuse, or alteration:
- Encryption in Transit & at Rest: All web traffic is encrypted via TLS 1.3/HTTPS, and database backups are encrypted at rest using industry-standard AES-256.
- Credential Security: User passwords are cryptographically hashed using salted bcrypt.
- Role-Based Access Control (RBAC): Granular permissions restrict operational access strictly to authorized personnel.
- Continuous Monitoring: Real-time error and security event logging to promptly investigate anomalous activity.
11. Children’s Privacy (COPPA & CCPA)
Portal Origin is an enterprise business workspace platform and is not intended for or directed at children under 13 years of age (or under 16 for California residents). We do not knowingly collect or maintain personal information from individuals under these ages. If you become aware that a child has provided us with personal information, please contact us immediately so we can remove such data.
12. Contact Us & California Privacy Inquiries
If you have questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our designated privacy compliance team: