Privacy Policy

1. Who we are

Quathos Mailer is an email delivery platform (transactional, OTP and campaigns) with white-label domains, webhooks and SDKs, through a web portal and an API with tokens. It is owned and operated by Quathos LLC, a company based in Dallas, Texas, United States. For any privacy request, contact us at contact@qsendyx.com.

Quathos Mailer is a software and orchestration layer over third-party carriers and email providers; we are not a telecom operator. It is offered as a multi-tenant service. When your organization is the customer, it acts as controller of the personal data it processes through the platform (including the recipient data in your contact lists), and Quathos LLC acts as processor on its behalf.

2. Data we collect

We collect only the data needed to operate the Service:

• Account data: name, email address and a hash of your password (we never store passwords in plain text).
• Organization data: company name, members and settings of your tenant.
• Contact and recipient data: the phone numbers, email addresses, names and consent status you upload or send to.
• Message data: the content and metadata of the email you send: subject, body, sender, recipient and timestamps.
• Delivery and engagement events: sent, delivered, bounced, failed, complaint, opened and clicked, as reported by carriers and email providers.
• Suppression data: opt-outs, STOP requests, hard bounces and complaints, kept to stop us sending to those recipients again.
• API tokens: stored only as a prefix, a hash of the secret and its last characters; the plaintext is shown once, at creation.
• Billing data: your credit ledger and usage. Card payments are handled by our payment provider. We do not store full card numbers.
• Technical cookies: session, CSRF and preference cookies (see the Cookie Policy).

3. How we use data

We use personal data to:

• Send your messages and track their delivery and engagement.
• Authenticate users and keep accounts and tenants isolated and secure.
• Send transactional messages about your own account (confirmations, alerts, receipts).
• Prevent fraud and abuse (spam, phishing and OTP abuse) and comply with legal obligations.
• Meter usage, charge paid plans and pay-as-you-go credits, and support customers.

4. Legal bases

Depending on the applicable law, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and, where required, consent. Consent to receive your messages is obtained by you from your recipients, not by us. For customers in Brazil, processing follows the LGPD (Lei nº 13.709/2018).

5. How we share data

We do not sell personal data. We share it only with service providers that help us run the platform (cloud hosting, email infrastructure and payment processing) under contracts that limit their use of the data. To deliver a message, its content and recipient are necessarily passed to the receiving mail server. We may also disclose data when required by law or to protect our rights and users.

6. International transfers

Quathos LLC is based in the United States and may process data there and in other countries where our providers operate. Where the law requires it, we use appropriate safeguards for international transfers.

7. Data retention

We keep personal data for as long as your account or your organization’s account is active and as needed to provide the Service. Message metadata and delivery logs are retained to provide analytics, billing and abuse investigation. Suppression records are retained for as long as needed to honor opt-outs. After that, data is deleted or anonymized, subject to legal retention duties.

8. Security

We apply technical and organizational measures including tenant isolation enforced at the database layer (Row Level Security), password hashing with argon2id, API tokens stored only as hashes, DKIM private keys encrypted at rest, an immutable append-only billing ledger, and signed, idempotency-checked provider webhooks. See our Security page for detail. No system is perfectly secure, but security is built into the platform’s design.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, as well as portability, information about processing and, where processing relies on consent, its withdrawal. To exercise these rights, contact contact@qsendyx.com. If your data is processed on behalf of an organization (tenant), for example because you are a recipient of messages a customer sent through Quathos Mailer, we will direct your request to that organization as controller.

10. Quathos product news (marketing)

When you create your Quathos Account you may opt in — through a separate, unticked checkbox — to receive news about Quathos products. The legal basis for these messages is your consent (for Brazil, LGPD art. 7, I and art. 8, §4). Opting in is never a condition for using the Service, and transactional messages (receipts, proposals, security codes, password resets, service notices) do not depend on this choice.

You can withdraw consent at any time, free of charge: through the “Quathos communications” toggle in your Quathos Account profile, or through the one-click unsubscribe link included in every marketing email. Withdrawal takes effect immediately and, like the original opt-in, is recorded in an append-only consent history.

11. Children

The Service is not intended for individuals under 18, and we do not knowingly collect their personal data.

12. Changes

We may update this Policy. Material changes will be signaled by updating the effective date above and, where appropriate, by notice within the Service.

13. Contact

Questions about privacy? Email us at contact@qsendyx.com.