Privacy
Policy

Flouvia and CORD are trade names used by Andre Valle Ortega, the operator identified in this notice. This document describes the processing evidenced in the current Cord code and configuration; it does not turn an optional or unconfigured integration into an active data flow.

01 Identity of the Controller

For legal and operational purposes, it is important to distinguish how we interact with data:

• As Data Controller: We act as controllers over the data of you and your team (our direct clients) when creating an account or subscribing.
• As Data Processor: We act as processors over the data of your own clients. We only process this information following your instructions on the platform.

Open compliance item: the controller’s verified service address has not yet been published. This omission does not restrict any privacy right or request channel.

02 Personal Data Collected

Data comes from forms and files supplied by you or the business, activity on the service, and responses from configured providers and integrations. Categories depend on the feature used; not every category is requested from every person.

Account and access: name, email, account identifiers, session information and acceptance evidence. Native-login passwords are verified using hashes; they are not described as reversibly encrypted passwords. Alternative sign-in methods process the identifiers and technical credentials necessary for the selected method.

Business and tax data: catalogs, contacts, quotes, invoices, communications and issuer/recipient information. CFDI may involve RFC, tax regime, tax address and CSD. In Spain, a configured feature may process NIF/CIF and an electronic certificate and password. Possession of a certificate or chained record does not establish AEAT submission.

Financial data: bank account and holder, CLABE where applicable, payments, payouts, refunds and disputes. CLABE is stored encrypted with a suffix retained for display. Card data is collected through processor components; Cord does not store the full card number or security code.

Identity verification: information about individuals, representatives, directors and beneficial owners required by the processor for the specific account. No universal ownership threshold applies across all countries and entity types. Files are temporarily processed for transmission; the flow removes unnecessary image metadata, such as location, while retaining technical orientation when needed.

Cord does not persistently retain the identity-document image sent through that flow. The technical submission record may include account/person identifiers, file hash, format, size, quality measurements, date, IP, user-agent and provider response. It is not an image copy or proof that every submission was recorded without failure. Current configuration provides for five years, as explained in the retention section; that period is not attributed to a universal anti-money-laundering obligation.

Signatures and disputes: name, contact information, signature or purchase IP, and relevant documents or communications the business retains or selects as evidence. Confirming evidence-file preparation may transmit files to the processor and save their identifiers in a draft before the final dispute response is submitted. Saving a draft does not mean files remain only within Cord.

Connected integrations: when the Customer connects a third-party account (for example Google, Microsoft, Shopify, QuickBooks, Xero, HubSpot, Slack, WhatsApp Business or Mercado Pago), Cord stores that connection’s technical credentials encrypted, the connected account’s identifier or email, the identifiers linking each Cord record to the third party’s record, and the technical fingerprint that prevents duplicates. Cord does not receive or store the password of those accounts.

Payment onboarding requests electronic authorization concerning financial and identity data from the user completing it. That record does not by itself prove consent from every person whose data a representative supplies. The applicable basis, information to third parties and authority to act must be verified for each flow; acknowledging this notice is not blanket consent to all processing.

03 Purposes

Purposes are distinguished by feature and are not all treated as necessary to enter the contract. Security, authentication, support and contractual evidence relate to account operation. The newsletter is optional, uses double confirmation and provides an unsubscribe mechanism; optional browser analytics is managed separately. AI use or collections messages depend on enabling or invoking those features and may transmit context to their providers. The legal basis is assessed per processing activity and jurisdiction; the contract does not replace that assessment.

Depending on the enabled functions, operational purposes include:

• Generate, store, and send quotes, and process the stamping of electronic invoices.
• Manage the billing of your monthly subscription and calculate excess usage.
• Payment Processing (Stripe Connect Custom): Connect the Client's payment account, receive and reconcile payments, calculate and collect Cord transaction fees, schedule payouts, process refunds, manage chargebacks and negative balances, and comply with financial verification requirements. Banking data is encrypted in CORD and transmitted to Stripe by API. Document images are transmitted to Stripe without persistent storage in CORD, with their metadata stripped beforehand.
• Artificial Intelligence: Process the text required by the AI feature the user invokes. Cord uses Anthropic's commercial API; the provider's current published policy states that commercial inputs and outputs are not used for model training unless the commercial customer opts in. Cord does not present that provider policy as a guarantee that AI processing is risk-free.
• Autonomous AI Collections (optional): If the account Administrator enables it, Cord processes receivables data (client name, email, amount owed, due date, and the conversation context selected by the workflow) to draft or send reminders on the creditor's behalf. It is disabled by default.
• Send transactional emails and notifications.
• Customer-directed integrations: Exchange with a third-party account the Customer connects the data that integration needs, under the Customer’s instruction: write quotes and invoices to their spreadsheet; record final invoices, customers and lines in their accounting; bring in their store’s catalog and customers and create the order when a quote closes; post notifications to their channels; and send, from their email account, the documents addressed to their customers. Each integration is enabled separately and can be disconnected.
• Gmail add-on: On the email the user has open, read the sender, subject and a quote number to show whether the sender is a customer and that quote’s status. The email text is transmitted to Cord and its AI provider only when the user clicks “Quote with AI”, to propose quote lines that the user reviews before creating it. The add-on does not read the full inbox.

04 Anonymized and Aggregated Data

We may create aggregated or de-identified statistics to analyze trends and improve Cord. Removing direct identifiers alone does not make data anonymous: if a dataset can reasonably be linked back to a person, we continue treating it as personal data. We do not promise that every de-identification technique makes re-identification impossible.

05 Cookie Policy

CORD uses cookies and tracking technologies in a minimalist and non-invasive manner. We do not sell your browsing data to third-party advertising networks.

• Strictly Necessary Cookies: Used to keep your session active, authenticate your identity, and prevent Cross-Site Request Forgery (CSRF) attacks. Without these cookies, the application cannot function securely. These are always on and cannot be disabled from the cookie banner.
• Browser Product Analytics (PostHog): Measures page views and feature adoption after you accept analytics in the banner. Signed-in browser events may be linked to the user and organization. Separately, if PostHog is configured, Cord's server may record organization-level business events with person-profile creation disabled; those events do not depend on a browser cookie.
• Cookieless Web Analytics (Vercel): Records aggregated page-view dimensions without third-party cookies. Cord removes query strings and replaces customer, document, dispute, SSO, invitation, public-link, and identity-capture identifiers before transmission. Vercel still processes the technical request needed to provide its service, so this is described precisely rather than as “identifies nobody.”

You can change your analytics cookie preference at any time. Manage cookie preferences

06 Processing roles and third parties

This privacy notice does not make a complete Article 28 DPA effective merely through use of Cord. A standalone DPA is still a controlled draft and must be completed with verified party details, processing schedules, transfer mechanism, and execution evidence before a customer relies on it. The inventory below states each third party's actual role; not every recipient is a sub-processor.

Google user data

Cord’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Cord uses that information only to provide and improve the user-facing features the user enables; does not sell it; does not use it for advertising; does not allow humans to read it except with the user’s affirmative consent, for security purposes, to comply with applicable law, or when aggregated and anonymized for internal operations; and does not use it to develop, improve or train generalized artificial intelligence or machine learning models. The text of an email the user chooses to send to “Quote with AI” is processed with the AI provider listed in the table above solely to produce that proposal. The user can revoke access from Cord’s integration settings or from their Google account’s security settings.

07 International Data Transfers

Some providers may process data outside the country where the user or Customer is located. A provider's public DPA or sub-processor list is evidence of its published terms, but it does not prove Cord's account-specific region, configuration, or executed transfer mechanism. Those records remain part of the release checklist. Where Chapter V GDPR applies, an adequacy decision, the applicable 2021 Standard Contractual Clauses, or another valid mechanism must be identified for the particular transfer; consent to this notice is not used as a blanket substitute.

08 Business Transfers (M&A)

Information relevant to the Services may form part of a merger, acquisition, financing, restructuring, insolvency, or sale of assets, subject to confidentiality, purpose limitation, and notice duties that apply to the transaction. This does not authorize an unrelated buyer to disregard this notice or applicable law.

09 Retention and Security

Cord uses protection in transit and encryption of specific fields such as CLABE and configured secrets. It does not claim that all data is application-level encrypted, that hashing is anonymization or that code controls alone establish production deployment status. Access, credentials and each integration’s configuration require their own controls.

The technical KYC submission record currently uses a deletion threshold of five years from creation. Cleanup depends on successful execution of the scheduled task; this is not a guarantee of deletion at an exact time. That setting is an implemented policy requiring validation by purpose, role and jurisdiction, not proof of one legal obligation covering all records.

Fiscal retention by a provider is not a guaranteed five-year archive within Cord. Organization deletion removes dependent primary records and may affect locally stored documents. Customers must retain the records for which they are responsible and verify retrieval; Cord does not promise a perpetual local archive or uniform retention of all data.

A category-specific schedule remains to be completed for operational data, payments, disputes, acceptance evidence, logs, providers and backups, including justified exceptions and deletion verification. Storage capacity alone does not justify retaining data beyond what is necessary.

10 Security Breach Protocol

If Cord becomes aware of a personal-data breach affecting Customer Data for which it acts as processor, Cord will inform the applicable Customer without undue delay and provide information reasonably available for that Customer's assessment and notifications. When Cord acts as controller, it will assess notice to authorities and affected people under the law that applies to the incident. The GDPR's 72-hour supervisory-authority period is not described as a 72-business-hour processor-to-customer deadline.

11 Data Portability and Deletion

Deleting an organization also does not establish that an external subscription was successfully canceled or that the processor payment account was closed. The flow attempts subscription cancellation, but a failure requires follow-up; it does not automatically delete the connected account. Closure of each external service and any outstanding obligations must be confirmed separately.

Account settings provide JSON export of organization data and CSV exports of products and clients. Deleting an organization removes its primary Cord database row and dependent operational rows. It does not by itself erase records that a provider keeps under its own legal duties, data already delivered under a Customer instruction, backups still within their rotation period, or the pseudonymous legal-acceptance evidence Cord retains to establish the contract. Requests concerning those records are assessed separately under the applicable law.

12 Minors Privacy

Cord is directed to persons with capacity to contract and users authorized to operate a business, not to children as intended service users. Corporate authorization is not equivalent to authorization by a parent or guardian. If a child’s data is identified, the relationship, Cord’s role, the controller of the data and the appropriate response must be assessed; automatic immediate deletion is not promised as a solution in every case.

13 Privacy Rights

You may also request withdrawal of consent or limitation of data use where applicable. Rejecting analytics or unsubscribing from the newsletter does not cancel the account or reject the contract. Non-automated requests are handled through the privacy channel, with proportionate verification, and are answered within the deadlines set by the applicable law (in Mexico, the LFPDPPP; in the European Economic Area, one month under the GDPR, extendable where the law allows).

The name and legal basis of each right depends on the applicable law. Mexico provides Access, Rectification, Cancellation, and Objection (ARCO); GDPR regimes include access, rectification, erasure, restriction, portability, and objection; Brazil's LGPD provides its own statutory rights. Settings currently supports organization export, selected CSV exports, correction of account data, and organization deletion. Other requests require individual assessment and are not described as automated merely because a Settings page exists.

Requests that cannot be completed in Settings may be sent to legal@flouvia.com. Describe the right and the account or relationship involved. Do not attach an identity document unless Cord asks for a proportionate verification method after reviewing the request; requesting a full ID by default would collect more data than necessary.

14 Changes to the Policy

Each published notice has a version and a content hash. Material changes that require a new acknowledgement are presented through Cord's legal re-acknowledgement screen and recorded against the exact version shown. Continued use is not described as “explicit acceptance.” A change to a sub-processor or transfer also follows the notice and objection procedure in the applicable executed DPA, if one exists.