Privacy Policy

Quathos LLC, a limited liability company organized under the laws of the State of Texas, United States, operates Quathos Invoice, a service that issues electronic service invoices (NFS-e) in Brazil. This policy explains what we do with personal data, and it is written to be read.

1. Two roles, and why the difference matters

• Account data: the people who sign in, their roles, their sessions, and what visitors write to us through the contact form. Here we are the controller. We decide why and how it is processed, and this policy is our promise about it.
• Fiscal data: the issuer, its certificate, the clients it invoices (the "tomadores"), the services, the invoices and the spreadsheets our customer loads to issue them. Here we are a processor (an operator, under the LGPD): the customer decides what is invoiced and to whom, and we execute. We do not mine it, sell it, or use it to train anything.

2. Who we are

• Controller: Quathos LLC, a limited liability company organized under the laws of the State of Texas, United States, at 3008 Ross Ave, Suite 100, Office 210, Dallas, TX 75204, United States.
• Data protection officer (Encarregado, under LGPD art. 41): [dpo]. Until the appointment is published here, privacy@quathos.com reaches the people responsible for privacy requests.
• We are established in the United States and serve customers in Brazil, so the LGPD applies to us (art. 3). If we become required to appoint a representative in the European Union or the United Kingdom under Article 27 GDPR, we name them here before that obligation applies.
• Security reports and incident notices: security@quathos.com.

3. What we collect

As controller, for the account:

• Identification and sign-in: name, email address, and either a password stored only as a salted hash or, when you sign in through Quathos Account, an identifier issued by that hub. We cannot recover your password.
• Session records: creation and expiry, the IP address and the browser user agent of the sign-in. This is what lets you, and us, tell a legitimate session from a stolen one.
• Membership: which organisation you belong to and with what role (owner, admin, member or accountant), and the invitations sent to join it: the invitee’s email, the role offered and who sent it. The invitation link is stored only as a hash and expires in 7 days.
• Organisation audit trail: invitations, role changes and similar acts, with the actor, the moment and the IP address, in an append-only, hash-chained record.
• Contact: the name, email, company, phone and message you send through the contact form, with the IP address and user agent of the request, so that we can answer and keep the form free of abuse.
• Technical logs: request metadata needed to run and defend the service. Passwords, the certificate, its password and session tokens are not written to logs.

As processor, on our customers’ instructions:

• Issuer: corporate name, trade name, CNPJ, municipal registration, tax regime, address, email and phone.
• The issuer’s A1 digital certificate, which identifies the company and, through it, may carry the name of its legal representative. It is stored encrypted, as described in section 4.
• Clients ("tomadores"): CPF or CNPJ, name, address, email, phone, municipal registration and internal notes. When the client is a person, the CPF and the address are personal data, and the law requires both on the invoice.
• Invoices: a copy of the client’s data frozen at issue, the service description, amounts, taxes, the signed XML, the government’s answer and the DANFSe, plus an append-only event trail of who did what to each invoice.
• Spreadsheets uploaded for batch issuing: the original file and each row as read, so that the batch report can show what became an invoice and why the rest did not.
• Invoice history imported from the national system (ADN) when the customer asks for it, to block re-invoicing what a previous system already invoiced: invoice number, client document and name.

4. The certificate

The certificate file is encrypted (AES-256-GCM) with a key of its own, and that key is wrapped by a master key kept in the server environment, never in the database. The password is used in memory during the upload and is never stored in readable form. The certificate is decrypted only to sign a document you confirmed or to open the mutual-TLS session with the government; the temporary material that session needs is removed right after. Replacing a certificate keeps the previous one encrypted and inactive, so the record of which certificate signed which invoice stays whole.

5. Why we process it, and on what legal basis

We do not sell personal information, we do not share it for cross-context behavioural advertising, we run no advertising, and we do not make automated decisions about you. The validation of a spreadsheet row checks fiscal rules; it decides nothing about a person.

6. Who else touches the data

Only the parties needed to run the product, each under a written agreement and only for the purpose we set. The current list is published on our Subprocessors page:

• Hetzner Online GmbH, which hosts the server, the database, the object storage and the backups in Germany (Falkenstein and Nuremberg).
• Quathos Mailer, the sibling product that delivers invitations to join an organisation and what you send through the contact form. No email leaves through any other route.
• Quathos Account, our identity hub, when your organisation signs in through it.

For an invoice to exist, the law requires the signed document to reach the tax authority. Each time you confirm an invoice, its data goes to the Brazilian national NFS-e system (Sefin Nacional, with the national data environment, ADN) or, for issuers registered in Fortaleza, to the municipal ISS system of Fortaleza. Those public bodies receive it by legal obligation and act as independent controllers, not as our subprocessors. Beyond that, we disclose data only when the law compels it, and when we are allowed to tell you first, we do. If the business is ever sold or merged, data follows the service, and this policy binds whoever takes it over until they publish their own and tell you.

7. International transfers

Three places are involved, and we name each one. The people in the invoices are mostly in Brazil. The data rests in the European Union, on Hetzner Online GmbH infrastructure in Germany (Falkenstein and Nuremberg). And Quathos LLC, which operates the service, is established in the United States, and its team reaches the systems from there. Under LGPD art. 33, an international transfer needs a lawful mechanism:

• Brazil to the European Union: the ANPD recognised the EU and the EEA as providing an adequate level of protection (Resolution CD/ANPD No. 32/2026), so storage in Germany rests on LGPD art. 33, I.
• Access from the United States: there is no adequacy decision for the United States. For that access we rely on the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024; LGPD art. 33, II, b), incorporated into our Data Processing Addendum.
• Where European law applies to a transfer, we use the European Commission’s Standard Contractual Clauses, with the UK Addendum where relevant.
• The transmission of an invoice to the tax authority stays in Brazil: it goes from our servers to the Brazilian government systems, under the issuer’s legal obligation.

8. How long we keep things

9. How we protect it

• Isolation between organisations is enforced by the database itself, through row-level security, and the application connects with a role that cannot bypass it; the server refuses to start if it can. The organisation is taken from your session, never from the request.
• Authorized invoices are immutable, and the event trail is append-only and hash-chained: a database trigger refuses updates and deletes, and tampering with one row breaks verification from that row onward.
• The session cookie is HttpOnly and never reaches page scripts; the browser never talks to the API directly. State-changing requests carry a double-submit CSRF token.
• Traffic is encrypted in transit. Storage buckets are private; files are served through signed links valid for five minutes. Session tokens are stored only as hashes.
• Roles limit who does what: an accountant reads and downloads, a member issues, and only an administrator uploads a certificate or cancels an invoice.
• No security measure is perfect. If an incident affects personal data, we notify the customer, the people and the authorities the law requires, including the ANPD where LGPD art. 48 applies, and we tell you what we know rather than what sounds best.

10. Your rights

Over the account data we control, we offer the same rights wherever you live: those of LGPD art. 18 and of GDPR articles 15 to 22.

• Confirm that we process your data, know what we hold and why, and get a copy.
• Correct what is wrong or incomplete.
• Ask for anonymisation, blocking or deletion of what is unnecessary or excessive, within the limits of the retention table above.
• Take it elsewhere, in a machine-readable format.
• Know who we shared data with.
• Object to processing based on legitimate interests, or ask us to restrict it.
• Withdraw consent at any time, as easily as you gave it. The cookie preferences are one click from every page.
• Be free from discrimination for exercising any of this.

Fiscal documents are the exception the law makes: an authorized invoice cannot be deleted or edited before the retention period ends, because the issuer is obliged to keep it (LGPD art. 16, I). We say so when we answer, and we tell you when that period ends.

To exercise any of this, write to privacy@quathos.com. We answer within 15 days, the deadline of LGPD art. 19, II, and may need to confirm your identity first, which we do with the data we already have. If our answer does not satisfy you, you may petition the Brazilian National Data Protection Authority (ANPD, gov.br/anpd), your supervisory authority in the EU or the UK, or your state Attorney General in the United States.

11. Children

Quathos Invoice is a tool for work and is not directed to children. We do not knowingly create accounts for anyone under 16. An invoice may name a minor as the client when the law requires it; that data is processed only to issue the invoice, on the issuer’s legal obligation.

12. Changes to this policy

When something material changes (a new purpose, a new category of data, a new party), we update the version and the date at the top of this page and tell account holders by email before it takes effect.

13. Encarregado, ANPD and contact

Data protection officer (Encarregado): [dpo]. Privacy: privacy@quathos.com. Security: security@quathos.com. Everything else: contact@quathos.com. Supervisory authority in Brazil: Autoridade Nacional de Proteção de Dados (ANPD).