Privacy
Policy

Flouvia and CORD are trade names of Andre Valle Ortega, the individual who is the controller of the data described in this notice. If Andre Valle Ortega assigns the operation of Cord to a company that he controls, incorporates or that acquires the business, that company will become the controller: this will be notified by email at least 15 days in advance, stating its name and address, and this notice will be updated with its details. An optional integration processes data only when the Customer turns it on.

01 Identity of the Controller

For legal and operational purposes, it is important to distinguish how we interact with data:

• As Data Controller: We act as controllers over the data of you and your team (our direct clients) when creating an account or subscribing, and over the data of people who use Cord’s public tools without an account, such as the quote builder.
• As Data Processor: We act as processors over the data of your own clients and suppliers, including data transmitted to tax authorities on your behalf. We only process this information following your instructions on the platform.

Even with data of a business’s customers and suppliers, Cord acts as controller when it processes them for its own purposes:

• preventing fraud and abuse and protecting the platform’s security;
• calculating and collecting its fees;
• producing statistics to improve the product;
• establishing the contract and defending against claims and disputes; and
• meeting the identity verification requirements the payment processor sets for the business’s payment account.

Controller: Andre Valle Ortega, an individual who operates the Flouvia and Cord services, with address at Ejido San Francisco Culhuacán 3, Coyoacán, 04400, Mexico City, Mexico. Privacy contact: legal@flouvia.com.

Representatives: Flouvia is in the process of appointing its representative in the European Union (Article 27 GDPR) and in the United Kingdom (Article 27 UK GDPR). In the meantime, individuals located in those territories and their supervisory authorities may contact Flouvia directly at legal@flouvia.com, in Spanish or English, and this notice will be updated with each representative’s details once appointed. For Brazil’s LGPD, the channel for data subjects and for the National Data Protection Authority is legal@flouvia.com.

02 Personal Data Collected

Data comes from forms and files supplied by you or the business, activity on the service, and responses from configured providers and integrations. Categories depend on the feature used; not every category is requested from every person.

Account and access: name, email, account identifiers, session information and acceptance evidence. Native-login passwords are verified using hashes; they are not described as reversibly encrypted passwords. Alternative sign-in methods process the identifiers and technical credentials necessary for the selected method.

Business and tax data: catalogs, contacts, quotes, invoices, communications and the issuer and recipient details each document requires: tax identifier, name or legal name, address and, depending on the country, tax regime, tax status, line of business or activity. If the business uses coupons, Cord records which coupon was applied to which customer and document to enforce the usage limits the business sets. When the business enables a tax rail, Cord also keeps what the authority returns: authorizations, receipts, acknowledgments, codes, rejections and the signed XML. Holding a certificate or a generated record does not establish that the authority received or accepted it.

Business tax credentials: when the business uploads them, Cord stores encrypted the digital certificates, with their keys or passwords, that the business uses to identify itself and sign before its authority (in Argentina, Brazil, Chile, Colombia, Peru and Spain), Chile’s authorized folio files with their key, Peru’s SOL user and password, and Colombia’s software PIN and technical key. A certificate may identify an individual, such as the user authorized before the authority or a representative, with their name and identifier. These credentials are never returned to the browser: Cord only displays their validity, holder and fingerprint, and uses them to sign and transmit the business’s own documents, check their status, answer its suppliers in Chile and, if the business expressly authorizes it, sign its Facturae; for that authorization Cord keeps the accepted text, its version, the person who granted it, the date, the IP address, the browser and its revocation.

Financial data: bank account and holder, CLABE where applicable, payments, payouts, refunds and disputes. CLABE is stored encrypted with a suffix retained for display. For a bank transfer with a reference, the processor assigns the payer a virtual bank account and receives the sender details provided by the payer’s bank; for Canadian pre-authorized debit, the payer declares whether the account is personal or business, and for U.S. ACH debit the payer’s bank reports it; in both cases the payer may save the account to pay each invoice in one click: Cord keeps its bank, its last digits, the account type and the identifiers of the method and the mandate, and the record of each payment the payer authorizes (text, date, IP address and browser). Card data is collected through processor components; Cord does not store the full card number or security code.

Customer portal and automatic payments: if a business shares a personal invoice link with its customer and that customer saves a payment method, the processor stores the method and, for a bank debit, the mandate. Cord keeps its identifier, type, brand or bank, last digits and expiry, and the evidence of each automatic-payment authorization: version and hash of the accepted text, payment method, date, full IP address, browser and intent identifier. A new authorization does not erase earlier ones: Cord keeps the history. That IP is deliberately kept in full, like a signature’s, because it evidences a charge authorization. Cord also records who turned automatic payments off and why, and the attempts and declines of each charge. When the customer pays by direct debit, from the portal or from an invoice, Cord sends them, in the business’s name, the mandate confirmation and the notice of each charge the scheme requires, and keeps a copy of each notice: the email address it was sent to, the last digits of the account, the mandate reference, the amount and the date.

The business’s notice: toward its clients, the business is the controller of their data. The business can link its own privacy notice on its quotes, invoices, portal and collection pages, and Cord shows this notice next to it.

United States sales tax: if the business enables address-based calculation, Cord sends the processor, within the business’s payment account, the customer’s address (state, ZIP code, city and, if available, street), whether the customer is exempt and the sale amounts, and keeps the calculation with that address. The exemption certificate number is stored in Cord and printed on the document; it is not sent to the processor.

Invoices received from suppliers (Chile): if the business uses Cord’s exchange mailbox or uploads the file, Cord receives and stores as received the electronic tax documents its suppliers address to it, with the sender’s email, the supplier’s RUT, legal name and email, the amounts and the business’s decision. This is data of third parties who do not use Cord.

Identity verification: information about individuals, representatives, directors and beneficial owners required by the processor for the specific account. No universal ownership threshold applies across all countries and entity types. Files are temporarily processed for transmission; the flow removes unnecessary image metadata, such as location, while retaining technical orientation when needed.

Cord does not persistently retain the identity-document image sent through that flow. The technical submission record may include account/person identifiers, file hash, format, size, quality measurements, date, IP, user-agent and provider response. It is not an image copy or proof that every submission was recorded without failure. Current configuration provides for five years, as explained in the retention section; that period is not attributed to a universal anti-money-laundering obligation.

Approval, payment and disputes: when a quote is approved, Cord keeps on the business’s behalf the name entered, the email if provided, the date and time, the full IP address and the browser; on payment, the date, amount, method and the processor’s reference. The approval and payment pages say so at that moment. If a charge is disputed, the business may submit to the payment processor the approval record included in the dispute receipt (approver’s name, date and IP address), the automatic payment authorization record, which it obtains from its data export, and the relevant documents or communications it retains or selects. Confirming evidence-file preparation transmits the files to the processor and saves their identifiers in a draft before the final response is submitted. Once uploaded, a file stays with the payment processor, which keeps it under its own rules, and Cord cannot withdraw it even if the response is never submitted.

Public API, MCP server and log: when the Customer uses the public API or connects an assistant through Cord’s MCP server, Cord records for each request the method, path, status, duration, IP address, key used, request identifier, error code and message, version, origin and idempotency key; it never stores the request or response body. An action with external effects requested by an assistant waits for approval by a person at the Customer.

AI collections: if the business turns them on, Cord keeps the messages sent to its debtors, the opt-out of anyone who asks not to be contacted again and, if a debtor accepts an installment plan, the evidence of that acceptance: version and hash of the text, date, IP address and browser. The debtor’s name, email and phone number and the payment link are not sent to the artificial intelligence provider.

Cord Workflows: the automations the Customer configures, their versions and approvals, and each run with the data of the event that triggers it and the result of each step.

HubSpot sync: while they are being sent, Cord keeps in a queue the contact and quote data going to the Customer’s HubSpot account.

Connected integrations: when the Customer connects a third-party account (for example Google, Microsoft, Shopify, QuickBooks, Xero, HubSpot, Slack, WhatsApp Business or Mercado Pago), Cord stores that connection’s technical credentials encrypted, the connected account’s identifier or email, the identifiers linking each Cord record to the third party’s record, and the technical fingerprint that prevents duplicates. Cord does not receive or store the password of those accounts.

Public tools without an account: a person using the public quote builder on cordhq.app sends text or up to four photos or PDF files of an order, which may contain third-party data such as a customer’s name, phone number or address. Cord sends them to its artificial intelligence provider to propose the line items and does not keep them: they are not written to the database or to files. The PDF is generated in memory and returned without being stored. Usage limits are applied with the IP address converted into a hash that is deleted within one day at most. Dictation uses the browser’s speech recognition; the audio does not pass through Cord.

Cord community: a person who registers for a community meetup gives their name, their email address and, optionally, their company; Cord also keeps the language of the page they registered from, the status of the registration (confirmed, on the waitlist or canceled) and, after the meetup, whether they attended. Cord uses this data to send the confirmation with a link to view or cancel the registration, the reminders, a notice if they move from the waitlist to a confirmed spot, and notices of changes to or cancellation of the meetup; it does not use it for advertising or subscribe the person to the newsletter. Meetups are organized by community leaders who are not part of Flouvia: the Cord team shares with each leader the list of registrants for their meetup (name, email address and, if provided, company), and each leader agrees in writing to use it only to organize that meetup. Online meetups take place on Google Meet: the person joins the video call on Google’s platform, under its terms and its privacy notice. When photos are taken or a recording is made at a meetup, notice is given on the meetup page, at registration and at the venue, and a person’s image is only published, on social media or on Cord’s site, with their permission. A person who asks to lead a community sends their name, email address, city, country, topic and a message: that request is not stored in Cord’s database, but it does remain in the Cord team’s email inbox, and requests that are not accepted are deleted from that inbox 90 days after they are received.

During payment onboarding, the person completing it gives, in a separate checkbox, express authorization for the processing of their financial and asset data, and whoever enters the data of other representatives or beneficial owners represents that they have authority to provide it and that they informed them. Cord records each authorization and representation with its text, version, date, IP address and browser. Acknowledging this notice is not blanket consent to all processing.

03 Purposes

Primary purposes are those necessary for the relationship with Cord: creating and managing the account, providing the contracted service, charging the subscription and fees, providing support, protecting the platform, preventing fraud, meeting legal obligations and defending against claims. Secondary purposes are not necessary for the service: browser product analytics and the newsletter. Each requires your consent, and you may refuse or withdraw it at any time from the cookie notice or from the newsletter’s unsubscribe link without affecting your account. The newsletter uses double confirmation. AI use or collections messages depend on enabling or invoking those features and may transmit context to their providers.

Depending on the enabled functions, operational purposes include:

• Generate, store and send quotes and invoices and, when the business enables a tax rail, sign them with its credentials, transmit them to the relevant authority, check their status and report the statuses the law provides for, such as payment or rejection.
• Manage the billing of your monthly subscription and calculate excess usage.
• Payment Processing (Stripe Connect Custom): Connect the Client's payment account, receive and reconcile payments, calculate and collect Cord transaction fees, schedule payouts, process refunds, manage chargebacks and negative balances, and comply with financial verification requirements. Banking data is encrypted in CORD and transmitted to Stripe by API. Document images are transmitted to Stripe without persistent storage in CORD, with their metadata stripped beforehand. Where the business enables it, store its customers’ payment methods and direct-debit mandates (SEPA or ACH) for automatic payments.
• Artificial Intelligence: Process the text, images and PDFs, with the necessary context (for example, the business’s product and price catalog), required by the AI feature the user or a public quote builder visitor invokes. Cord uses Anthropic's commercial API; the provider's current published policy states that commercial inputs and outputs are not used for model training unless the commercial customer opts in. Cord does not present that provider policy as a guarantee that AI processing is risk-free.
• Autonomous AI Collections (optional): If the account Administrator enables it, Cord processes receivables data (client name, email, amount owed, due date, and the conversation context selected by the workflow) to draft or send reminders on the creditor's behalf. It is disabled by default.
• Send transactional emails and notifications.
• Customer portal and automatic payments: Show the business’s customer their invoices and balances through a personal link, collect several invoices at once and, if the customer authorizes it, charge each invoice on its due date with the saved method, retry a declined charge and email the customer, in the business’s name, when a charge fails or needs their action, and send them the mandate confirmation and the notices of each direct debit charge each scheme requires.
• United States sales tax: Calculate each line’s tax from the customer’s address using the business’s own state registrations and record the sale so the business can report it.
• Invoice exchange in Chile: Receive and validate the documents suppliers address to the business, send them acknowledgments signed with the business’s certificate and register with the SII the acceptance or claim the business decides.
• Customer-directed integrations: Exchange with a third-party account the Customer connects the data that integration needs, under the Customer’s instruction: write quotes and invoices to their spreadsheet; record final invoices, customers and lines in their accounting; bring in their store’s catalog and customers and create the order when a quote closes; post notifications to their channels; and send, from their email account, the documents addressed to their customers. Each integration is enabled separately and can be disconnected.
• Gmail add-on: On the email the user has open, read the sender, subject and a quote number to show whether the sender is a customer and that quote’s status. The email text is transmitted to Cord and its AI provider only when the user clicks “Quote with AI”, to propose quote lines that the user reviews before creating it. The add-on does not read the full inbox.
• Public API, MCP server and Cord Workflows: Handle the requests of the Customer and of the assistants it connects, run the automations it configures, limit their use and keep the log for diagnostics and security.
• Public quote builder: Propose the line items of a quote from the text or images a visitor sends, generate its PDF and protect the tool against abuse with usage limits and bot detection.
• Organizing Cord community meetups: registering attendees, keeping the waitlist, sending them the meetup notices, sharing the list of registrants with the leader who organizes the meetup and handling requests to lead a community.

Legal bases (GDPR and LGPD)

When Cord processes data as a business’s processor, that business determines the legal basis and Cord follows its instructions. Where the basis is legitimate interest, you may object by writing to legal@flouvia.com.

04 Anonymized and Aggregated Data

We may create aggregated or de-identified statistics to analyze trends and improve Cord. Removing direct identifiers alone does not make data anonymous: if a dataset can reasonably be linked back to a person, we continue treating it as personal data. We do not promise that every de-identification technique makes re-identification impossible.

05 Cookie Policy

CORD uses cookies and tracking technologies in a minimalist and non-invasive manner. We do not sell your browsing data to third-party advertising networks.

• Strictly Necessary Cookies: Used to keep your session active, authenticate your identity, and prevent Cross-Site Request Forgery (CSRF) attacks. Without these cookies, the application cannot function securely. These are always on and cannot be disabled from the cookie banner.
• Browser analytics (PostHog and Vercel): Only if you accept analytics in the cookie notice does PostHog measure views and feature usage, and Vercel Web Analytics and Speed Insights measure visits and page performance. Without that acceptance they neither load nor store anything on your device. In the app, PostHog identifies the person and their organization only by their internal identifiers, the plan, the role, and the organization’s sign-up date; it does not receive the email, the person’s name, or the organization’s legal or trade name. Your choice is stored in the cord_cookie_consent cookie with the notice version and the date you gave it; if the notice changes, you are asked again. You may withdraw it at any time: capture stops immediately and Cord deletes PostHog’s cookies and storage from your device. Before anything is sent, Cord strips query strings and replaces identifiers of customers, documents, disputes, SSO, invitations, public links, and identity capture.
• Server analytics: Separately, Cord’s server records business events in PostHog at the organization level, without creating person profiles and without reading or storing anything on your device, so it does not depend on the cookie notice. Account sign-up is recorded with the person’s internal identifier, without their email, to measure where sign-ups come from. Public quote builder events are joined to the browser’s PostHog identifier only if the person accepted analytics; without that acceptance they are recorded with a fixed, anonymous identifier. No event carries emails, names, phone numbers, tax identifiers, or addresses. The legal basis is Cord’s legitimate interest in measuring and improving the service; you may object by writing to the privacy channel.
• Public quote builder local storage: The browser stores on the device the quote in progress, the logo, recent quotes and prices used. These are not cookies and do not leave the device unless the person creates an account and saves the quote.
• Links received by the business’s customers (quotes, invoices, portal, and embeds): Measuring the activity the business sees on them stores no cookies or other data on the device of whoever opens them. If the person opens the link from the European Economic Area, the United Kingdom, or a territory with equivalent rules (Gibraltar, Jersey, Guernsey, and the Isle of Man), from the province of Quebec in Canada, or without an identifiable country or, in Canada, an identifiable province, the page measures nothing from the browser (no presence, reading time, sections viewed, or typing indicator), and the business only sees when the link was first opened, which the server records when it serves the page. For other visitors, the open page measures that activity and, to count how many devices open a link, Cord computes on its server an identifier from the truncated IP network, the browser, and the link, with a key that changes every day; it does not store the IP or the browser, and one day’s identifier cannot be linked to another day’s.

The invoice portal a business shares with its customer loads no product or web analytics, is not indexed and does not pass its address to other sites as a referrer, because the link works as a credential.

Each cookie and each item stored on the device, with its purpose and duration, is listed in the Cookie Policy.

You can change your analytics cookie preference at any time. Manage cookie preferences

06 Processing roles and third parties

This notice does not replace a data processing agreement (DPA): the CORD Data Processing Agreement forms part of the Terms and governs the processing Flouvia carries out on the Customer’s behalf. The current list of sub-processors, with each one’s entity, country and transfer mechanism, and the subscription to change notices are on the Sub-processors page. The table below states each third party’s role; not every recipient is a sub-processor.

When Cord transmits a document to an authority, it acts as the business’s invoicing system, on its instruction and with the business’s own credentials: the party obliged before the authority is the issuing business. In Peru and Colombia, Cord does not transmit documents until it holds the registration or authorization each authority requires of anyone issuing on a taxpayer’s behalf. In France, issuing through an approved platform is not yet available; when Flouvia enables it, it will update this notice with a new version. Exchange responses the business sends its suppliers in Chile are signed with its certificate.

Google user data

Cord’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Cord uses that information only to provide and improve the user-facing features the user enables; does not sell it; does not use it for advertising; does not allow humans to read it except with the user’s affirmative consent, for security purposes, to comply with applicable law, or when aggregated and anonymized for internal operations; and does not use it to develop, improve or train generalized artificial intelligence or machine learning models. The text of an email the user chooses to send to “Quote with AI” is processed with the AI provider listed in the table above solely to produce that proposal. The user can revoke access from Cord’s integration settings or from their Google account’s security settings.

07 International Data Transfers

Cord operates from Mexico, and its main providers process data in the United States and other countries. Transfers rely on the following:

• Data from the European Economic Area: when Cord processes as processor the data a Customer transfers to it, the Standard Contractual Clauses adopted by the European Commission in 2021 (module 2, controller to processor), incorporated into the data processing agreement.
• Data from the United Kingdom: those same clauses, with the International Data Transfer Addendum issued by the Information Commissioner’s Office.
• To sub-processors in the United States: their certification under the EU–U.S. Data Privacy Framework and its UK Extension, where they hold it, or the Standard Contractual Clauses (module 3, processor to processor). Facturapi, which only stamps CFDI for businesses established in Mexico, follows the rule in section 6 of the Data Processing Agreement: if the business is subject to the GDPR, the safeguard is those clauses, annexed to its processor agreement, and until Facturapi has signed them, that business must not use CFDI stamping to invoice persons located in the European Economic Area.
• Data subject to Brazil’s LGPD: the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024).

Tax documents are transmitted to the authority of the issuer’s country because its law requires it; Cord does not choose that destination.

08 Business Transfers (M&A)

Information relevant to the Services may form part of a merger, acquisition, financing, restructuring, insolvency, or sale of assets, subject to confidentiality, purpose limitation, and notice duties that apply to the transaction. This does not authorize an unrelated buyer to disregard this notice or applicable law.

09 Retention and Security

Cord uses protection in transit and encryption of specific fields such as CLABE, the invoice payee account, tax certificates, keys and passwords, folio files and configured secrets. It does not claim that all data is application-level encrypted, that hashing is anonymization or that code controls alone establish production deployment status. Access, credentials and each integration’s configuration require their own controls.

Cord keeps each piece of data only while it serves its purpose. The periods are:

Each country’s tax law requires the issuing business to keep its records for several years; the business can download all of them in a single file from Settings before closing its account. Database backups are overwritten when their recovery window ends, so deleted data may remain in them until then. Providers with their own duties, such as the payment processor, the PAC or tax authorities, keep their records under their own rules.

10 Security Breach Protocol

If Cord becomes aware of a personal-data breach affecting Customer Data for which it acts as processor, Cord will inform the applicable Customer without undue delay and provide information reasonably available for that Customer's assessment and notifications. When Cord acts as controller, it will assess notice to authorities and affected people under the law that applies to the incident. The GDPR's 72-hour supervisory-authority period is not described as a 72-business-hour processor-to-customer deadline.

11 Data Portability and Deletion

Settings provide JSON export of organization data, CSV exports of products and clients, and all tax documents with their XML and acknowledgments in a single file. Deleting the organization requires explicit confirmation and is scheduled with a 30-day grace period, during which you can download your data and cancel the deletion. After that, its primary Cord database row and dependent operational rows are erased.

Deletion does not by itself erase records that a provider keeps under its own legal duties, data already delivered under a Customer instruction, backups still within their recovery window, or the pseudonymous legal-acceptance evidence Cord retains to establish the contract. Nor does it cancel documents already authorized by the authority or close the account the business holds with the payment processor, whose closure is confirmed separately. Requests concerning those records are assessed under the applicable law.

12 Minors Privacy

Cord is directed to persons with capacity to contract and users authorized to operate a business, not to children as intended service users. Corporate authorization is not equivalent to authorization by a parent or guardian. If a child’s data is identified, the relationship, Cord’s role, the controller of the data and the appropriate response must be assessed; automatic immediate deletion is not promised as a solution in every case.

13 Privacy Rights

You may also request withdrawal of consent or limitation of data use where applicable. Rejecting analytics or unsubscribing from the newsletter does not cancel the account or reject the contract. Non-automated requests are handled through the privacy channel, with proportionate verification, and are answered within the deadlines set by the applicable law (in Mexico, the LFPDPPP; in the European Economic Area, one month under the GDPR, extendable where the law allows).

The name and legal basis of each right depends on the applicable law. Mexico provides Access, Rectification, Cancellation, and Objection (ARCO); GDPR regimes include access, rectification, erasure, restriction, portability, and objection; Brazil's LGPD provides its own statutory rights. Settings supports organization export, selected CSV exports, tax document download, correction of account data and organization deletion. Other requests are handled through the privacy channel.

Requests that cannot be completed in Settings may be sent to legal@flouvia.com. Describe the right and the account or relationship involved. Do not attach an identity document unless Cord asks for a proportionate verification method after reviewing the request; requesting a full ID by default would collect more data than necessary.

If you are a customer or supplier of a business that uses Cord (for example, you receive its invoices, pay in its portal or authorized automatic payments), that business is the controller of your data and your first point of contact; Cord assists it as processor. You can turn automatic payments off at any time from your portal.

If you believe your request was not handled as the law requires, you may contact the competent data protection authority: in Mexico, the Secretariat of Anti-Corruption and Good Governance; in the European Union, your country’s supervisory authority; in the United Kingdom, the Information Commissioner’s Office; and in Brazil, the National Data Protection Authority (ANPD).

14 Changes to the Policy

Each published notice has a version and a content hash. Material changes that require a new acknowledgement are presented through Cord's legal re-acknowledgement screen and recorded against the exact version shown. Continued use is not described as “explicit acceptance.” A change to a sub-processor or transfer also follows the notice and objection procedure in the DPA signed with the Customer, if one exists. A change of controller through the assignment described at the beginning is notified by email at least 15 days in advance and does not require a new acknowledgment.