Caissonix Privacy Policy (DRAFT, not legal advice, not published)

Draft prepared for Gregor's review on Oct 26, 2026, intended for https://caissonix.com/privacy/. Covers caissonix.com (including the HOA coverage review service and VendorGuard pages) and the VendorGuard CA and HOA Docs AI apps (app.caissonix.com, docs.caissonix.com). It is written to satisfy CalOPPA (any site collecting personal information from California residents) and to be ready for CCPA/CPRA "sharing" duties once ad pixels go live. Have a California attorney review. Bracketed items need a decision. Update the "Service providers" list before turning on any tool not listed.

Effective date: [date]

Who we are: Caissonix LLC ("Caissonix", "we"), Oakland, California [LLC not yet formed; filing planned on or after Dec 17, 2026]. Contact: [email protected], [mailing address].

1. Information we collect

You give us:

• Contact and demo-request forms: name, work email, phone (optional), company, number of associations, and your message.
• VendorGuard account: name, work email, organization, user role, and billing details (card data is handled by our payment processor, not stored by us).
• Customer Data in VendorGuard: vendor names and contacts, certificates of insurance and other uploaded documents, contractor license numbers, requirements, and notes. Customers (management companies and associations) control this data; we process it for them.
• Vendor uploads: when a vendor or its insurance agent uses an upload link, the file and the uploader's name and email if provided.
• Emails you send us.

Collected automatically:

• Basic technical data: IP address, browser type, pages requested, and timestamps in server and security logs.
• A sign-in session cookie for the VendorGuard app (strictly necessary).
• Cookieless, aggregate site analytics (Cloudflare Web Analytics), which does not track you across sites.
• [Only after ads launch: advertising tags such as the Google tag and LinkedIn Insight Tag, which use cookies or similar technology to measure ad conversions. See section 5.]

From public sources: contractor license status from the California Contractors State License Board's public data, and public business contact details used for business-to-business outreach.

2. How we use it

To provide, secure, and support the Service; to read uploaded certificates and compare them with the Customer's requirements; to send sign-in links, vendor requests, reminders, and account notices; to answer inquiries and schedule demos; to bill; to improve the Service using de-identified or aggregated data; to send business marketing emails (you can opt out anytime with the unsubscribe link); and to comply with law and protect rights and safety.

3. How we share it

We do not sell personal information for money. We share it only with:

• Service providers acting for us, under contracts limiting their use: Cloudflare (hosting, database, file storage, analytics, email routing), Web3Forms (website form delivery), [email delivery provider, e.g. Resend or Postmark], [Stripe (payments)], Cloudflare Workers AI (HOA Docs AI answers: the question and the matching document passages are sent to the model; not used to train models), [AI text-reading provider for certificates, e.g. OpenAI or xAI, only if enabled], [Google Workspace (email)].
• The Customer that controls the data (for example, a vendor's upload is visible to the management company that requested it).
• Legal and safety reasons, or in a merger, acquisition, or sale of the business, subject to this policy.

[After ad tags go live: advertising partners (Google, LinkedIn) receive device and browsing data from our site through their tags. Under California law this may be "sharing" for cross-context behavioral advertising. See section 5.]

4. Retention

Form inquiries: up to [24 months] after last contact. VendorGuard Customer Data: for the life of the account, then deleted within [60] days of termination after an export window, except limited backups and records required by law. Logs: up to [90 days]. Billing records: as long as tax law requires.

5. Your choices and California rights

• Marketing email: use the unsubscribe link or email us.
• Cookies: the app's session cookie is required to sign in. [After ad tags: you can opt out of ad tags through the "Do Not Sell or Share My Personal Information" link in our footer, and we honor the Global Privacy Control (GPC) browser signal by not loading ad tags.]
• Do Not Track: browsers' DNT signals are not a uniform standard; we [do not respond to DNT, but honor GPC as described above].
• California residents: to the extent the California Consumer Privacy Act applies to us, you may ask to know, access, correct, or delete your personal information, and to opt out of sale or sharing, and you will not be discriminated against for doing so. Email [email protected] with the subject "Privacy request." We will verify your request by confirming control of your email address. An authorized agent may submit a request with your signed permission. If your information is in VendorGuard as part of a Customer's records (for example as a vendor contact), we may refer you to that Customer and assist it.
• Shine the Light (Cal. Civ. Code 1798.83): we do not share personal information with third parties for their own direct marketing.

6. Security

We use encryption in transit, access controls, and per-organization separation of Customer Data. No method is completely secure. We will notify affected people and Customers of a breach as required by law.

7. Children

Our services are for businesses and are not directed to children under 16. We do not knowingly collect their information.

8. Changes

We will post changes here with a new effective date and email account holders about material changes.

9. Contact

[email protected], [mailing address].