Privacy Policy

1. Who we are

Quathos Sign is an electronic and digital document-signing platform. It is owned and operated by Quathos LLC, a company based in Dallas, Texas, United States. For any privacy request, write to contact@quathos.com.

Quathos Sign is a multi-tenant service. When your organization is the customer, it is the controller of the personal data it processes through the platform. Quathos LLC is the processor, acting on its behalf.

2. Data we collect

We collect only the data needed to operate the Service:

• Account data: name, email address, and a hash of your password. We never store passwords in plain text.
• Organization data: company name, members, and settings of your tenant.
• Documents and envelopes: the PDF files you upload and their metadata.
• Signer data: name, email, IP address, device and user-agent, and the timestamp of each signing action.
• Audit events: an append-only, hash-chained record of the actions taken on documents and envelopes.
• API tokens: stored only as hashes. The plaintext is shown once, at creation.
• Payment data: handled by our payment provider. We do not store full card numbers.
• Technical cookies: session, CSRF, and preference cookies. See the Cookie Policy.

3. How we use data

We use personal data to:

• Provide and operate the signing service and the audit trail.
• Authenticate users and keep accounts and tenants isolated and secure.
• Send transactional messages (invitations, reminders, confirmations, receipts).
• Prevent fraud and abuse, and comply with legal obligations.
• Bill paid plans and support customers.

4. Legal bases

Depending on the law that applies, we process personal data on these bases: performance of a contract, our legitimate interest in operating and securing the Service, compliance with legal obligations, and, where required, your consent. For customers in Brazil, processing follows the LGPD (Lei nº 13.709/2018). For residents of U.S. states with comprehensive privacy laws — including California (CCPA/CPRA), Virginia, Colorado, Connecticut, and their successors — we process personal information to provide the Service you requested and for the compatible purposes described in this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA. We do not use sensitive personal information to infer characteristics about you.

When we process personal data on behalf of a customer organization, that organization is the controller (or "business") and we act as processor (or "service provider"). We process it only on documented instructions, for the limited purpose of providing the Service, and we make a data processing agreement available on request.

5. How we share data

We do not sell personal data. We share it only with service providers that help us run the platform, such as cloud hosting, email and SMS delivery, and payment processing. Those providers work under contracts that limit how they use the data. We may also disclose data when the law requires it, or to protect our rights and our users.

6. International transfers

Quathos LLC is based in the United States. We may process data there and in other countries where our providers operate. Where the law requires it, we apply appropriate safeguards for international transfers.

7. Data retention

We keep personal data while your account or your organization’s account is active, and for as long as we need it to provide the Service.

What is deleted automatically: files for documents you deleted, once the recovery window has passed; and files for drafts that were never sent for signature. In those cases we remove the file and keep only the record that it existed and was purged.

What is NOT deleted while the account exists: signed documents, the record of each signing act, the evidence dossier, and the audit trail. This data is the proof of the signature — deleting it would destroy the legal value of the document you signed, including against you. The audit trail is immutable by construction: it allows neither modification nor deletion.

Before closing your account, we recommend exporting your signed documents and their evidence dossiers. Deletion requests are honored within the limits of art. 16 of the Brazilian LGPD, which preserves data required to comply with legal obligations and to exercise rights.

8. Security

We apply technical and organizational measures. These include tenant isolation enforced at the database layer (Row Level Security), short-lived signed URLs for document access, password hashing with argon2id, hashed API tokens, and an append-only, hash-chained audit log. No system is perfectly secure, but security is built into the platform’s design.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data. You may also request portability, information about how we process it, and, where processing relies on consent, its withdrawal. To exercise these rights, write to contact@quathos.com. If your data is processed on behalf of an organization (tenant), we will direct your request to that organization as controller.

If you are a California resident, you also have the right to know what personal information we collect and how we use and disclose it; to delete it; to correct it; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising any of these rights. We will not deny you service, charge a different price, or provide a different quality of service because you exercised a privacy right. Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have equivalent rights, including the right to appeal a decision on your request — to appeal, reply to our decision at the same address.

We verify requests before acting on them, since honoring an unverified deletion request would itself be a breach. Where the request touches signed documents or their evidence, see the retention section: proof of a signature is preserved, and we will tell you plainly when that is why a request cannot be fully honored.

10. Children

The Service is not intended for individuals under 18, and we do not knowingly collect their personal data.

11. Marketing communications

We only send news about Quathos products (marketing communications) if you opted in — the legal basis is your consent, and it is never a condition for using the Service. The purpose is limited to telling you about Quathos products and features; it is a single preference that covers the whole Quathos family and is managed centrally in your Quathos account. Not opting in, or never being asked, means we do not send you marketing.

You can withdraw this consent at any time, free of charge and without giving a reason: through the communications preference in your Quathos account profile, or through the unsubscribe link included in every marketing email — the link works without signing in. Withdrawal does not affect transactional messages the Service needs to send (signature invitations, one-time codes, receipts, password resets), which are sent on the legal bases described above, not on consent.

12. Changes

We may update this Policy. When changes are material, we will update the effective date above and, where appropriate, give notice within the Service.

13. Contact

Questions about privacy? Email us at contact@quathos.com.