Data Processing Addendum

This Addendum forms part of the Terms of Service between you ("Controller") and Quathos LLC ("Processor") and applies whenever we process personal data on your behalf through Qnexyx. Where it conflicts with the Terms, this Addendum prevails on data protection matters.

1. Roles

You are the controller of the personal data in your workspace and you decide its purposes and means. We are the processor (operator, under the LGPD) and act only on your documented instructions. Using the product is how you instruct us: creating a contact, sending a proposal, configuring a webhook and issuing an API token are all instructions. We will tell you if an instruction appears to breach applicable data protection law, and we may pause that instruction until it is resolved.

2. Our obligations

• Process personal data only for the purposes of providing the service, and never for our own purposes, for advertising, or to train models.
• Bind everyone with access to a duty of confidentiality, and limit access to those who need it to do their job.
• Keep the technical and organisational measures described in Annex II, and not weaken them during the term.
• Assist you with data subject requests, with data protection impact assessments and with consultations with authorities, in each case taking into account the nature of the processing and what we actually have.
• Forward to you, without answering it ourselves, any data subject request we receive that concerns your workspace.
• Notify you without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting your data, with what we know and what we are doing about it.

3. Subprocessors

You give general authorisation for the subprocessors listed on our Subprocessors page. We impose on each of them, by written contract, obligations no weaker than these, and we remain fully responsible to you for what they do. We announce a new or replacement subprocessor at least 30 days before it starts processing; if you reasonably object on data protection grounds within that window, you may terminate the affected part of the service and receive a pro-rata refund of the unused prepaid cycle.

4. International transfers

Where processing involves a transfer out of the EEA, the UK or Brazil to a country without an adequacy decision, the parties adopt the European Commission’s Standard Contractual Clauses (Module Two, controller to processor), with the UK International Data Transfer Addendum where the UK GDPR applies, and the corresponding instruments recognised by the ANPD for Brazilian data. Those clauses are incorporated here by reference, with this Addendum and its annexes supplying the information their appendices require.

5. United States privacy laws

For personal information subject to California law, we act as a "service provider" and equivalent roles under other state laws. We do not sell or share it, we do not retain, use or disclose it outside the direct business relationship or for any purpose other than performing the service, and we do not combine it with personal information from other sources except as those laws permit. We certify that we understand and will comply with these restrictions.

6. Audits

On request, we provide the information reasonably necessary to demonstrate compliance with this Addendum. Where that is not enough for your regulator or your own obligations, you may audit us — or appoint an independent auditor who is not our competitor — once per year, on 30 days’ notice, during business hours, without disrupting the service and without accessing other customers’ data. Your own audit trail, which is append-only and hash-chained, is available to you at any time and answers most of what an audit asks.

7. Return and deletion

You can export your data yourself at any time, on any plan. When the agreement ends, your data remains exportable for 30 days and is then deleted, except what law requires us to keep and what remains in backups until they rotate out, within 30 days. We do not restore a backup to recover data you asked us to delete.

Annex I — Details of processing

Annex II — Technical and organisational measures

• Tenant isolation enforced by row-level security in the database, with the application connecting through a role that cannot bypass it. The tenant identity is derived from the session or the API token and is never accepted from the client request.
• Append-only, hash-chained audit trail, protected by database triggers rather than by application convention, so that tampering is detectable by an ordered query.
• Encryption of data in transit; passwords and the tokens we issue stored only as hashes, which cannot be reversed. The credentials you connect yourself — calendar, AI provider, advertising page — must be replayed to work, so they are stored encrypted at rest instead, and disconnecting deletes them. Secrets, tokens, one-time codes and customer attachment contents are never written to logs.
• Session cookies marked HttpOnly and never exposed to page scripts; the browser never calls the API directly; state-changing requests protected by a double-submit CSRF token.
• File access through signed links valid for minutes; public proposal links expiring in 30 days and revocable at any time; single-use email confirmation links valid for 24 hours.
• Role-based access within each workspace, controlled by you; write operations covered by transactions and idempotency keys; regular backups with a defined rotation.
• Separation of environments, with test and mock providers technically blocked from running in production.