Privacy Policy

1. Who we are

Quathos Webmail is a hosted email service: mailboxes on your organization’s own domain, with webmail, IMAP and SMTP access and migration from a previous provider. It is owned and operated by Quathos LLC, a company based in Dallas, Texas, United States. For any privacy request, contact us at contact@webmail.quathos.com.

Quathos Webmail is offered as a multi-tenant service. When your organization is the customer, it acts as controller of the personal data it processes through the service (including the mail stored in its mailboxes and the addresses it corresponds with), and Quathos LLC acts as processor on its behalf.

2. Data we collect

We collect only the data needed to operate the Service:

• Account data: name, email address and a hash of your password (we never store passwords in plain text).
• Organization data: company name, members and settings of your tenant.
• Mailbox data: the addresses, display names and passwords (stored only as hashes) of the mailboxes your organization creates.
• Mail data: the messages stored in those mailboxes, including headers, body, attachments and folders, and the messages in transit through our servers to deliver them.
• Connection and delivery logs: the IP address, client and time of each sign-in and connection, and the transit record of each message (sender, recipient, time, result), as needed to operate the service and investigate abuse.
• Migration data: the credentials of your previous provider, used only during an import and destroyed at the end of each pass, and the map of which messages have already been copied.
• Domain data: the domain names you add and the DNS records we ask you to publish and verify.
• Billing data: your subscription, the number of mailboxes billed and your invoices. Card payments are handled by our payment provider. We do not store full card numbers.
• Technical cookies: session, CSRF and preference cookies (see the Cookie Policy).

3. How we use data

We use personal data to:

• Provide the mailboxes: receive, store and deliver your mail, and make it available through the webmail, IMAP and SMTP.
• Authenticate users and keep accounts and tenants isolated and secure.
• Send transactional messages about your own account (confirmations, alerts, receipts).
• Prevent fraud and abuse (spam, phishing, account takeover and outbound abuse from a mailbox) and comply with legal obligations.
• Meter usage, bill the subscription and support customers.

4. Legal bases

Depending on the applicable law, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and, where required, consent. The people who write to your mailboxes, and the people your users write to, are not our customers; the lawful basis for that correspondence is yours as controller. For customers in Brazil, processing follows the LGPD (Lei nº 13.709/2018).

5. How we share data

We do not sell personal data. We share it only with service providers that help us run the service (cloud hosting, DNS and payment processing) under contracts that limit their use of the data. To deliver a message to another domain, its content and recipient are necessarily passed to the mail server that receives it. We may also disclose data when required by law or to protect our rights and users.

6. International transfers

Quathos LLC is based in the United States and may process data there and in other countries where our providers operate. Where the law requires it, we use appropriate safeguards for international transfers.

7. Data retention

We keep personal data for as long as your account or your organization’s account is active and as needed to provide the Service. The mail in a mailbox stays until you delete it or remove the mailbox; after a subscription ends, mailbox data is kept through the retention window announced in the panel and then removed. Connection and delivery logs are retained for a limited period, for security and abuse investigation. After that, data is deleted or anonymized, subject to legal retention duties.

8. Security

We apply technical and organizational measures including tenant isolation enforced at the database layer (Row Level Security), password hashing with argon2id, DKIM private keys and migration credentials encrypted at rest, TLS on every connection to the mail servers, and a tamper-evident audit trail. See our Security page for detail. No system is perfectly secure, but security is built into the service’s design.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, as well as portability, information about processing and, where processing relies on consent, its withdrawal. To exercise these rights, contact contact@webmail.quathos.com. If your data is processed on behalf of an organization (tenant), for example because you correspond with a mailbox hosted by one of our customers, we will direct your request to that organization as controller.

10. Quathos product news (marketing)

When you create your Quathos Account you may opt in, through a separate, unticked checkbox, to receive news about Quathos products. The legal basis for these messages is your consent (for Brazil, LGPD art. 7, I and art. 8, §4). Opting in is never a condition for using the Service, and transactional messages (receipts, proposals, security codes, password resets, service notices) do not depend on this choice.

You can withdraw consent at any time, free of charge: through the “Quathos communications” toggle in your Quathos Account profile, or through the one-click unsubscribe link included in every marketing email. Withdrawal takes effect immediately and, like the original opt-in, is recorded in an append-only consent history.

11. Children

The Service is not intended for individuals under 18, and we do not knowingly collect their personal data.

12. Changes

We may update this Policy. Material changes will be signaled by updating the effective date above and, where appropriate, by notice within the Service.

13. Contact

Questions about privacy? Email us at contact@webmail.quathos.com.