Privacy Policy

Quathos LLC, a Texas limited liability company, operates Qnexyx, a customer relationship and proposal platform. This policy explains what we do with personal data, and it is written to be read — not to be survived.

1. Two roles, and why the difference matters

Almost every complaint about a business platform starts with someone asking the wrong company to delete their data. So, before anything else:

• Account data — the people who sign in: our customers, their team members, our own prospects. Here we are the controller. We decide why and how it is processed, and this policy is our promise about it.
• Workspace data — the leads, contacts, companies, deals and proposals a customer puts into their own workspace. Here we are a processor (an operator, under Brazilian law): the customer decides everything, we only execute. We do not mine it, we do not sell it, we do not use it to train anything, and we do not use it to build any product.

2. Who we are

• Controller: Quathos LLC, a Texas limited liability company, at 3008 Ross Ave, Suite 210, Dallas, TX 75204, United States.
• Data protection contact: [email protected]. That address reaches the people responsible for privacy requests, including any Data Protection Officer or Encarregado we are required to appoint.
• We are established in the United States. If we become required to appoint a representative in the European Union or the United Kingdom under Article 27 GDPR, we name them here before that obligation applies.
• Security reports and incident notices: [email protected].

3. What we collect

As controller, for the account:

• Identification and sign-in: name, email address, and either a password stored only as a salted hash or, when you sign in through a Quathos Account, an identifier issued by that hub. We never store your password in a readable form and we cannot recover it.
• Session records: creation and expiry, the IP address and the browser user agent of the sign-in. This is what lets you — and us — tell a legitimate session from a stolen one.
• Workspace membership: which workspaces you belong to and with what role.
• Billing: plan, subscription status, cycle, invoices and the customer identifier issued by our payment provider. Card numbers never reach us — the payment page is the provider’s.
• Audit trail: an append-only, hash-chained record of what happened in the workspace — the action, the entity, who did it, when, and the IP address. It stores identifiers and minimal values (a proposal number, a version, a total), not copies of your content.
• Support and contact: what you write to us, so that we can answer it.
• Technical logs: request metadata needed to run and defend the service. Tokens, passwords, one-time codes, secrets and the contents of customer attachments are never logged — that is a rule enforced in the codebase, not an aspiration.

As processor, on our customers’ instructions, the workspace holds whatever they put there: names, business email addresses and phone numbers of leads and contacts, company records, deal values, proposal contents, and — when a proposal is accepted — the accepting person’s name, IP address, browser user agent and the moment of acceptance, which together are what make an acceptance provable.

4. Why we process it, and on what legal basis

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not profile you to make decisions about you by automated means. No part of your data trains any model.

5. Who else touches the data

Only the parties needed to run the product, each under a written agreement and only for the purpose we set. The current list, with roles and locations, is published and kept up to date on our Subprocessors page. In summary:

• Quathos Account, our identity and subscription hub, when your account is created or signs in through it.
• Qsendyx, the sibling product that delivers every email. No transactional email leaves through any other route, in any environment.
• Qsignyx, the sibling product that handles signatures. Qnexyx issues no signature of its own.
• Our payment provider, for checkout, subscription and invoices.
• Our hosting and storage provider, which holds the database, the object storage and the backups.
• Any endpoint a customer themselves points us at: webhooks they configure, or integrations they authorise with their own API token. That is their instruction, and their responsibility.

Beyond those, we disclose data only when the law compels it. When we are legally allowed to tell you first, we do — a demand we are permitted to disclose is a demand you deserve to know about. If the business is ever sold or merged, data follows the service, and this policy binds whoever takes it over until they publish their own and tell you.

6. International transfers

Your data is stored at rest in the European Union, on infrastructure operated by Hetzner Online GmbH in Germany (Nuremberg and Falkenstein). We are established in the United States, our payment provider operates from the United States and Ireland, and our team reaches the systems from where it is — so personal data crosses borders even though it rests in one place. Where the law requires a transfer mechanism, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) and, for Brazilian data, on the equivalent instruments recognised by the ANPD, plus the safeguards described in the next two sections.

7. How long we keep things

8. How we protect it

• Isolation between workspaces is enforced by the database itself, through row-level security, and the application connects with a role that cannot bypass it. A bug in application code does not become a leak across customers, because the rule is not in application code.
• The tenant is never taken from the client request. It is derived from your session or from the API token you issued.
• The audit trail is append-only by database trigger and hash-chained: tampering with one row breaks verification from that row onward, and the check is a plain ordered query — no third party has to be trusted for it.
• The session cookie is HttpOnly and never reaches page JavaScript; the browser never talks to the API directly. State-changing requests carry a double-submit CSRF token.
• Traffic is encrypted in transit. Files are served through short-lived signed links, valid for minutes, not forever.
• Passwords are stored only as hashes; tokens are stored only as hashes. We cannot show you your own token twice, and we consider that a feature.
• No security measure is perfect. If a breach ever affects your personal data, we notify the people and authorities the law requires, without undue delay, and we tell you what we know rather than what sounds best.

9. Your rights

Wherever you live, and regardless of which law applies to you, we offer the same set of rights over the account data we control:

• Know what we hold about you and why, and get a copy of it.
• Correct what is wrong or incomplete.
• Delete it, within the limits of the retention table above.
• Take it elsewhere, in a machine-readable format.
• Object to processing based on legitimate interests, or ask us to restrict it.
• Withdraw consent at any time, as easily as you gave it — the cookie preference panel is one click from every page.
• Know who we shared data with, and ask us to confirm the anonymised or public status of anything we hold.
• Be free from discrimination for exercising any of this: the price and the product do not change because you asked.

Californians: we do not sell or share personal information, and we do not use or disclose sensitive personal information beyond what is necessary to provide the service, so the "Do Not Sell or Share" and "Limit the Use of Sensitive Personal Information" rights have nothing to act upon here. We still honour Global Privacy Control signals as a refusal of all non-essential cookies. If we deny a request, you may appeal by replying to our answer; if the appeal fails, you may complain to your state Attorney General.

To exercise any of this, write to [email protected]. We answer within 30 days — the shortest deadline among the laws that reach us — and we may need to confirm your identity first, which we do with the data we already have, never by asking for a new document. An authorised agent may act for you with proof of authority. If our answer does not satisfy you, you may complain to the ANPD in Brazil, to your supervisory authority in the EU or the UK, or to your state Attorney General in the United States.

10. Children

Qnexyx is a tool for work and is not directed to children. We do not knowingly create accounts for anyone under 16, and if we learn that we hold a child’s personal data without a lawful basis, we delete it.

11. Changes to this policy

When something material changes — a new purpose, a new category of data, a new party — we update the version and the date at the top of this page and tell account holders by email before it takes effect. Quiet edits to a privacy policy are how trust is spent.

12. Contact

Privacy: [email protected]. Security: [email protected]. Everything else: [email protected].