Privacy Notice
Last updated: October 12, 2026
How Corvo processes account data, fiscal documents, certificates and personal data when issuing NFS-e.
1. Who operates the Service
Corvo is operated by Greenflow Desenvolvimento de Software LTDA, CNPJ 61.469.487/0001-40. This Notice explains personal data processing on the website, dashboard and NFS-e issuance and management API. The Data Processing Addendum also applies to data customers submit in their fiscal operations.
2. Data processed
We process account and workspace data, such as names, email addresses, members and permissions; issuer and customer data, such as CPF or CNPJ tax identifiers, municipal registration, names, addresses and contact details; and fiscal data, such as service descriptions, amounts, taxes, service dates, identifiers, statuses, XML and PDF. We also process digital certificates and their passwords when submitted for issuance, webhook configurations and deliveries, authentication and access records, billing information and support communications. Submit only data needed for the operation; avoid including sensitive personal data in service descriptions.
3. Purposes and legal bases
We use data to authenticate users, administer accounts, process issuance, sign documents when authorized, store and provide XML and PDF, send emails and webhooks, process payments and provide support. We also process data to protect the Service, prevent fraud and meet legal obligations. Where we act as controller, legal bases include contract performance, legal obligations, the exercise of rights and legitimate interests, depending on the purpose and data-subject rights. We use consent for optional website analytics. Where we act as processor, we follow the customer’s documented instructions.
4. Customer and Greenflow roles
The customer determines the purposes and lawful basis for fiscal data it submits, acting as controller or an authorized representative of a controller. Greenflow processes that data as processor to execute instructions and provide the Service. Greenflow acts as controller for account administration, billing, security and support. If a data-subject request concerns a customer’s fiscal data, we may refer it to the responsible party for assessment and provide appropriate assistance.
5. Sharing
We share necessary data with fiscal systems involved in issuance, including the competent tax authority, and with hosting, storage, email, payment, monitoring and support providers. Sending an invoice by email shares the documents with the address designated by the customer; webhooks send events to the configured destination. Stripe processes payments through Checkout and the billing portal; Corvo receives identifiers, statuses and records needed for the subscription without collecting the full card number through its own form. We may also share data to meet legal obligations. We do not sell personal data.
6. Cookies and browser storage
We use session cookies for authentication and browser storage for language, fiscal environment and cookie preferences. When configured, Google Analytics loads on the public website after cookie acceptance and does not load on login or dashboard routes. It helps analyze navigation and traffic. You can remove cookies and the saved preference in browser settings to choose again on a later visit. Restricting necessary cookies may prevent login or features from working.
7. International transfers
Service providers may process data outside Brazil. International transfers must follow the mechanisms and safeguards required by the LGPD and applicable regulations, including standard contractual clauses where that mechanism is used. This Notice does not promise exclusive hosting in a specific country. You may request information about providers and transfers through the contact below.
8. Storage and retention
We store fiscal documents and records needed for operations. Retention depends on the data category, purpose, contractual relationship and applicable legal obligations; we do not promise automatic deletion after 90 days or indefinite storage. Data may be retained after termination where there is a lawful basis, with access restricted to the retention purpose. Access, export and deletion requests are assessed under the LGPD, contract and retention obligations. Keep your own copies of documents needed for your activity.
9. Security measures
We use access controls and separate data by workspace and environment. API keys are verified using one-way hashes. Digital certificates and passwords stored with them are encrypted; webhook events are signed so recipients can verify them. These measures reduce risk, but no system is completely secure. Protect credentials and report suspected unauthorized access.
10. Data-subject rights
Where provided by law, you may request confirmation of processing, access, correction, sharing information, portability and anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data. You may also withdraw consent, request deletion of data processed with consent subject to lawful retention exceptions, and complain to the competent authority. Send requests to the contact below. We may request proportionate information to verify your identity and authority before responding.
11. Contact
For personal data requests and questions, email legal@corvo.tech. Correspondence address: Greenflow Desenvolvimento de Software LTDA, Rua Doutor Arlindo Luz, 540, Sala 01, Centro, Ourinhos, São Paulo, postal code 19900-011, Brazil. Describe your relationship with the account or issuer company; do not send passwords or certificate files to this contact.
12. Notice updates
We may update this Notice to reflect changes to the Service and data processing. The date at the top identifies the latest update. We will communicate relevant changes through Service channels where applicable. Changes requiring new consent are not authorized solely by continued use.