Privacy
Policy

At Flouvia (legally represented by Andre Valle Ortega), we believe transparency is the pillar of trust. This document clearly explains how we protect your data and your company's data when using the CORD platform (cordhq.app), wherever you operate from.

01 Identity of the Controller

For legal and operational purposes, it is important to distinguish how we interact with data:

• As Data Controller: We act as controllers over the data of you and your team (our direct clients) when creating an account or subscribing.
• As Data Processor: We act as processors over the data of your own clients. We only process this information following your instructions on the platform.

02 Personal Data Collected

We collect information through three main channels:

• Identity Data: Name, email address, and passwords (managed securely via encrypted hashes).
• Tax Data (CFDI 4.0): RFC, Legal Name, Tax Regime, Zip Code, and Digital Seal Certificates (CSD).
• Tax Data (Verifactu, Spain): NIF/CIF, legal name, tax address, and the electronic certificate (.p12/.pfx) used to sign and remit invoicing records to the Spanish Tax Agency (AEAT). The certificate and its password are stored encrypted and are never displayed in plain text.
• Financial and Asset Data: Bank name, account holder, CLABE, payment movements, refunds, disputes, and negative balances. CORD stores the CLABE encrypted and keeps its last four digits for display. CORD does not store card numbers or security codes; Stripe tokenizes them directly.
• Identity Verification Data: Information on the legal representative, directors and beneficial owners (25% or more), and images of official identification and, where required, proof of address. Document images are transmitted directly to Stripe and are not persistently stored by CORD. Before transmitting them, CORD strips the file's metadata, including any GPS location the capturing device may have embedded. CORD retains a compliance record of each submission — which part of the document was sent, when, from which IP address, the technical form of the file and the verification system's reply — for five (5) years, as required by anti-money-laundering regulation. That record never includes the image, a thumbnail, the document number, the date of birth or the personal address.
• Business Data: Product catalog, price lists, and data of the companies you quote to.
• Buyer and Dispute Evidence: Buyer name, email, purchase IP address, commercial communications, receipts, delivery documents, service dates, and other evidence that the Client decides to save or send to contest a payment dispute.

Because payment onboarding may involve financial, asset, or identity-verification data, we request the data subject's express electronic consent before completing it. Consent may be revoked through the procedure in section 13, without retroactive effect; however, revocation or failure to provide required data may prevent CORD and Stripe from enabling or maintaining payment services.

03 Purposes

The collected data is used exclusively for the following essential purposes:

• Generate, store, and send quotes, and process the stamping of electronic invoices.
• Manage the billing of your monthly subscription and calculate excess usage.
• Payment Processing (Stripe Connect Custom): Connect the Client's payment account, receive and reconcile payments, calculate and collect Cord transaction fees, schedule payouts, process refunds, manage chargebacks and negative balances, and comply with financial verification requirements. Banking data is encrypted in CORD and transmitted to Stripe by API. Document images are transmitted to Stripe without persistent storage in CORD, with their metadata stripped beforehand.
• Secure Artificial Intelligence: Process text to build quotes. Flouvia contractually prohibits our providers (e.g. Anthropic) from using your data to train public models.
• Autonomous AI Collections (optional): If you, as the account Administrator, enable this feature, we process your receivables data (client name, email, amount owed, due date and message history) to draft and send payment reminders to your clients on your behalf and to propose installment plans. This is disabled by default and only runs after you explicitly turn it on. The email content is generated by our AI provider (Anthropic) under the same no-training guarantee described above.
• Send transactional emails and notifications.

04 Anonymized and Aggregated Data

We may create aggregated, de-identified or anonymized data from the information we collect by removing any identifier that makes the data point to a particular user (such as names or RFCs). We may use such anonymized data for our legitimate business purposes, such as analyzing trends, improving the platform or promoting our business, with the guarantee that such data can never be used to identify you.

05 Cookie Policy

CORD uses cookies and tracking technologies in a minimalist and non-invasive manner. We do not sell your browsing data to third-party advertising networks.

• Strictly Necessary Cookies: Used to keep your session active, authenticate your identity, and prevent Cross-Site Request Forgery (CSRF) attacks. Without these cookies, the application cannot function securely. These are always on and cannot be disabled from the cookie banner.
• Behavioral Analytics Cookies (PostHog): Set a persistent identifier to understand how you navigate and use the product (page views, feature adoption, conversion funnels). If you are signed in, this identifier is linked to your account (email, organization, plan) so Flouvia can improve the product; it is never sold or shared with advertising networks. These only load after you accept them in the cookie banner. Declining keeps them off.
• Cookieless Performance Measurement (Vercel Analytics): Measures page load times, UI errors, and traffic without setting any cookie or identifying you individually. The data is aggregated and anonymized by design, so it is not gated by the cookie banner.

You can change your analytics cookie preference at any time. Manage cookie preferences

06 DPA and Sub-processors

By using CORD, you and Flouvia enter into a Data Processing Agreement. You authorize us to process your clients' information using third-party infrastructure subject to contractual, technical, and organizational safeguards appropriate to each service. Below is our Official List of Service Providers (Sub-processors):

07 International Data Transfers

CORD is operated globally through cloud providers. By using the Services, you acknowledge that your information and your clients' information may be transferred, processed, and hosted in the United States or other countries whose data protection laws may differ from those of your country of residence. Flouvia applies the notices, consents, contractual measures, and security safeguards required by applicable law for those transfers.

08 Business Transfers (M&A)

All data we collect may be transferred to a third party if Flouvia undergoes a merger, acquisition, corporate restructuring, bankruptcy, or other transaction where such third party assumes control of our business (in whole or in part). In such event, we will make reasonable efforts to notify you via the platform or email before your information becomes subject to different privacy and security policies.

09 Retention and Security

We implement administrative and technical security measures, including TLS encryption in transit and field-level encryption for stored CLABEs and other configured secrets, to protect data against unauthorized access. Stamped invoices (CFDI) are kept for the minimum period required by Mexican tax authorities (5 years). Verifactu invoicing records are kept, unalterable, for the minimum period required by Spanish tax regulation (4 years) and are cryptographically chained (each record includes the hash of the previous one) so that the sequence itself is verifiable. Payment, account, and dispute records are retained while the account is active and afterward for the periods needed to resolve disputes, meet legal obligations, and defend claims. Document images sent to Stripe are not persistently stored by CORD. The compliance record of each identity submission described in section 02 is retained for five (5) years.

10 Security Breach Protocol

In the unlikely event of a security breach in our infrastructure or that of our sub-processors that compromises the confidentiality of your corporate data, Flouvia will activate its incident response protocol. We commit to notifying the account Administrator within 72 business hours after confirming the breach, detailing the scope of the incident and the mitigation measures taken.

11 Data Portability and Deletion

You are the sole owner of your operational information. If you decide to cancel your subscription, you have the right to request the export of your catalogs and clients in a structured format (CSV/JSON). Once the account is canceled and the mandatory tax retention period has concluded, Flouvia will irreversibly and permanently delete your operational databases from our servers.

12 Minors Privacy

CORD is a SaaS platform designed exclusively for businesses and professionals. We do not knowingly collect or solicit Personal Information from anyone under the age of 18. If we learn that we have collected information from a minor without proper verifiable corporate consent, we will delete that information from our servers as quickly as possible.

13 Privacy Rights

The specific name and legal basis of your privacy rights depend on your country. In Mexico, the LFPDPPP grants the rights of Access, Rectification, Cancellation, and Opposition (known as ARCO rights). In the European Union, the EEA, and the United Kingdom, the GDPR grants the rights of access, rectification, erasure, restriction of processing, data portability, and objection. In Brazil, the LGPD grants equivalent rights. Wherever you or your business are located, you can exercise the rights applicable to you the same way: most of them directly from the Settings panel of your account.

For complex requests, the Administrator must send an email to legal@flouvia.com, detailing the request and attaching an official ID.

14 Changes to the Policy

If we make significant changes, or if we add a new Sub-processor to our official list, we will notify the organization's Administrator via email or through a prominent notice within the CORD application. Your continued use of the Services after such changes will constitute your explicit acceptance of them.