Privacy notice | Nalanbi

Who is responsible

Primeland Peninsular, which operates Nalanbi (“we”), is responsible for the personal data described in this notice, under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties.

Our address is the corporate center on the 3rd floor of the City 32 condominium, lot 298, Calle 32 (Avenida García Lavín), Colonia Montebello, Mérida, Yucatán, C.P. 97113, Mexico.

For any question about this notice or your data, write to privacy@nalanbi.com.

What we collect

When you create an account

Your name, email address, phone number and preferred language.
Your password, which our sign-in provider stores only in hashed form.
Your account settings, such as the workspace you used last.

When you manage properties

The properties, units, listings, photos, documents and prices you add.
The people you work with (leads, tenants, property owners and teammates) and the contact details and notes you enter for them.
Showings, offers, tasks, messages, leases, payments, costs and maintenance requests.

When you contact an owner or request a tour

The name, phone number, optional email and message you send, and the listing it is about. We deliver it to the owner or company that manages the listing.
A salted hash of your IP address (not the address itself) and the result of a Cloudflare Turnstile check, used only to stop automated abuse.

When you are a tenant or a property owner on Nalanbi

The lease or properties a company shares with you, your messages with them, and the maintenance requests and photos you send.

When a company connects Facebook or Instagram

If a company admin connects the company’s Facebook Page, we store:

The Page’s id and name.
The id and username of the Instagram professional account linked to that Page, if there is one.
A Page access token, encrypted, which lets Nalanbi post to that Page and Instagram account when a member of the company asks it to.
For each post: the network, the post’s id and link, the caption, the number of photos, who posted it and when.

We do not keep your personal Facebook access token, and we do not read your friends, messages, personal posts or Page insights. Photos are copied to temporary storage only while a post is being published, and deleted when publishing finishes.

On your device

A sign-in cookie shared by nalanbi.com and app.nalanbi.com, so you stay signed in on both.
A short-lived cookie that keeps the loading animation smooth when you move from the site to the app.
Your saved listings on nalanbi.com, kept only in your browser.

We do not use advertising or third-party analytics cookies.

Why we use it

To run your account and sign you in.
To publish your listings on nalanbi.com and deliver contact and tour requests to the right owner.
To let you and your team manage leads, leases, tenants, property owners and maintenance.
To post your listings to your company’s Facebook Page and Instagram account when you ask.
To send the emails the service needs, such as confirming your address or resetting your password.
To keep the service secure and prevent abuse.

All of these are needed to provide the service. We do not use your data for secondary purposes such as marketing, we do not sell it, and we do not use it for advertising.

These providers run parts of Nalanbi. They process data on our behalf and only for that purpose; some of them do so outside Mexico.

Supabase: database, sign-in and file storage.
Cloudflare: website hosting, security and the Turnstile bot check.
Mapbox: maps, and address suggestions while you type an address.
Stadia Maps: turning a property’s address into map coordinates.
Meta (Facebook and Instagram): only when your company connects its Page and posts a listing. What you post becomes public on those networks and is governed by Meta’s own terms.

Listings you publish are public on nalanbi.com. Contact and tour requests go to the owner or company that manages the listing. What a company enters about a tenant or a property owner is shown to that person in their portal. We may also disclose data when the law requires it.

How long we keep it

Account data: while your account exists. When you delete your account we delete your profile, your files and your sign-in; data that belongs to a company you are part of stays with that company.
Facebook and Instagram connection: until a company admin disconnects it, which deletes the Page access token and the connection at once.
Records of past posts: until the listing they belong to is deleted, or until you ask us to delete them.
Temporary photo copies made for a post: deleted when publishing finishes.
The IP hash from contact and tour requests: only as long as needed to limit repeated requests.

Backups may hold deleted data for a limited time before they are overwritten.

Your rights

You can access your data, correct it, ask us to delete it, object to its use, or withdraw your consent (your ARCO rights). You can see and correct most of it yourself in the app, under Profile.

To exercise any of these rights, email us with your name, the email address on your account and what you are asking for. We reply within 20 business days. Write to privacy@nalanbi.com.

If a company entered your data as a lead, tenant or property owner, you can also ask that company directly. If you believe we have mishandled your data, you can complain to Mexico’s data protection authority.

Data deletion

Disconnect Facebook and Instagram

In the Nalanbi app, open Profile, then Companies, and choose Manage Company on your company.
Open the Social tab and choose Disconnect.

The Page access token and the connection are deleted immediately, and Nalanbi can no longer post to the Page or its Instagram account. Posts already published stay on Facebook and Instagram; delete them there if you want them gone.

Remove Nalanbi from Facebook

On Facebook, open Settings and privacy, then Settings.
Open Business integrations.
Select Nalanbi and choose Remove.

This revokes Nalanbi’s access to your Pages right away. To also delete the stored connection, disconnect it in the app as described above, or write to us.

Delete your Nalanbi account

In the app, open Profile and choose Delete account. This deletes your profile, your files and your sign-in. If you are the last admin of a company that has other members, you will be asked who takes over.

Anything else

To delete any other data, including the records of past posts, email us from the address on your account and we will confirm when it is done. Write to privacy@nalanbi.com.

Changes to this notice

If we change this notice we will update the date at the top and, for important changes, let you know in the app or by email.