Skip to content
Clauhub

Try “69-B”, “DIOT” or “stamp”.

Create account
Book a demoLog inEspañol

Comprehensive privacy notice

Privacy policy

Last updated: October 25, 2026Service operated by Clauhub Software LLC.

On this page
  1. 1. Data controller
  2. 2. Data we process
  3. 3. Purposes
  4. 4. Legal basis
  5. 5. Transfers and subprocessors
  6. 5 bis. Your e.firma and CSD
  7. 6. Retention period
  8. 7. ARCO rights
  9. 8. Security
  10. 9. Changes to this notice

1. Data controller

Clauhub Software LLC (“Clauhub”) is the controller of the personal data of those who create an account and use the service: their name, email, sign-in and the billing of their subscription.

For the data your organization keeps or processes in Clauhub —its invoices, customers, suppliers, members, employees and operations— your organization is the controller and Clauhub acts as processor: it processes them on the organization's behalf, following its instructions and the Terms, and for no other purpose.

This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties published on March 20, 2025.

2. Data we process

  • Account: name, email, photo, password (only its hash), sessions, two-factor authentication and, if you sign in with them, your Google or GitHub accounts.
  • Organization and subscription: name, RFC, billing email, plan, usage and credits. Your card details are captured by Stripe; Clauhub does not receive them.
  • Tax: RFC, legal name and tax regime; the invoices (CFDI) you issue and those we download from the SAT, with their XML and PDF; official documents such as the tax status certificate and the 32-D opinion; and, if you connect them, your e.firma and your CSD.
  • Your business operations, depending on the apps you use: journal entries and accounting, sales and inventory, customers and members, income, expenses and bank statements, and the messages in Channels and in the channels you connect.
  • Portals: the data and documents suppliers or customers upload to your organization's portals.
  • Technical: activity and error logs, the IP address for abuse limits, and the audit log.

3. Purposes

We use the data exclusively to:

  • Provide the service: create and protect your account, run the apps you use, issue and cancel CFDI, download and review your invoices from the SAT, and produce your reports.
  • Bill your subscription and measure your plan's usage.
  • Send you service notices: invitations, alerts (such as the 69-B list or your e.firma's expiry), reports and changes to these documents.
  • Keep things secure: prevent abuse, investigate incidents and keep the audit log.
  • The AI features you choose to use (assistant, agents, document reading).

We do not sell your data or use it for advertising, and we do not share it with third parties beyond the subprocessors listed.

We process your account data to perform the contractual relationship you have with us when you use the service and to meet our legal obligations, tax ones included; your organization's data, on its behalf. For customers in applicable jurisdictions, we also rely on the corresponding legal bases of the GDPR (Art. 6.1.b and 6.1.c) and CCPA/CPRA.

5. Transfers and subprocessors

We share personal data only with the processors we need to provide the service, all under contract with equivalent protection clauses: Cloudflare (hosts the app, files and technical logs), PlanetScale (PostgreSQL database), Resend (email), Autumn and Stripe (subscriptions and payments), OpenRouter and Mistral AI (AI features and document reading, only when you use them), a PAC authorized by SAT (invoice stamping) and Google (loyalty cards in Google Wallet, if your business turns them on). Services you connect (payments, messaging channels, mailboxes, sign-in) receive data only if you connect them.

The full list, with what each one does and which data it processes, is at Subprocessors. SAT is not a subprocessor: it is the authority from which we validate and download your tax documents on your behalf.

Some subprocessors are located outside Mexico; transfers are carried out with contractual safeguards in accordance with the LFPDPPP.

5 bis. Your e.firma and CSD

If your organization uses Fiscal, these additional conditions apply:

  • How they are stored. The certificate, the private key and its password are sealed with AES-256-GCM, each credential under its own data key. They are never returned to the browser or the API: only their serial number, holder, RFC, validity and status are shown.
  • What they are used for. The e.firma, only to sign in to the SAT on behalf of your RFC: download your invoices, request official documents and request or renew certificates. The CSD, only to seal the invoices you issue before an authorized PAC stamps them. Connecting them gives your consent to that use; each certificate request or renewal asks for it again.
  • Control. You can replace or remove them from the app at any time. We warn you 30 and 7 days before they expire.
  • Third-party data. Invoices contain data about your suppliers, customers and, for payroll, your employees, including CURP and social security numbers. Your organization is the controller for this processing because it decides to collect these data.
  • Deletion. Deleting an organization deletes its invoices, XML files and credentials. Deleting your account also deletes organizations where you were the only member; these are shown before you confirm.

6. Retention period

We keep the data while your account and your subscription are active. On the Free plan, information is kept for 90 days from the day you create the account and deleted when that period ends. Deleting an organization or your account deletes its data. Keeping your tax documents for the periods set by the Federal Tax Code (CFF) is the taxpayer's obligation: you can export them before deleting. Audit logs are retained for at least 12 months.

7. ARCO rights

As the data subject, you may exercise the following rights at any time:

  • Access — know what data we hold about you.
  • Rectification — correct inaccurate or outdated data; your account's, also from your profile.
  • Cancellation — request deletion of data when it is no longer necessary.
  • Opposition — object to processing for specific purposes.

To exercise them, write to soporte@clauhub.com. If your data is in Clauhub because an organization keeps it (you are its customer, supplier or employee), contact that organization; we help it answer you. We respond within a maximum of 20 business days. If you believe your rights are not being respected, you may turn to the Secretaría Anticorrupción y Buen Gobierno, which replaced the INAI as the supervisory authority.

8. Security

For the details of the technical and organizational measures we apply, see Security and trust.

9. Changes to this notice

If we make material changes to this notice, we will let you know by email or with a notice in the app before they take effect. The “last updated” date always reflects the current version.