Privacy Policy
Company: Caliagua Inc. (“Caliagua,” “we,” “us”)
Contact: it@caliagua.net
1) Overview
This Privacy Policy explains how Caliagua collects, uses, discloses, and protects information when you use our web application (the “Service”) designed for subcontractors and vendors to access bid-related information, documents, and communications.
This Service is intended for business users. It is not intended for consumer or personal use.
Your use of the Service is also governed by our Terms & Conditions.
2) Information We Collect
A. Information you provide
We may collect:
- Account information: name, email address, phone number (optional; used as business contact information and, if you separately enroll and verify it, for SMS sign-in codes once that feature is available), phone extension (optional), job title (optional)
- Company information: company name, company type (vendor/subcontractor/etc.), business contact information, business address, website, license number, and certifications (e.g., DBE/MBE/WBE/SBE/VOB) if provided
- Communications: messages you send to us and your email notification preferences
B. Authentication and security information
To provide secure access and prevent abuse, we collect:
- OTP and session data: tokens and timestamps used to authenticate and maintain sessions
- Phone verification data: if you choose to enroll a phone number for SMS sign-in once that feature is available, we will record the timestamp at which it is verified via a one-time code. The verification code itself will not be retained in readable form (it will be stored only as a one-way hash and cleared on successful verification).
- Login and access activity: last login time, session expiration details
- Security telemetry: IP address and device/browser information (user agent) in connection with logins, listing views, and document downloads
C. Usage, diagnostics, and analytics
We collect information about how the Service is used, including:
- Listing views, document downloads, and related timestamps
- Error and performance data (e.g., crash reports and diagnostics)
3) How We Use Information
We use information to:
- Provide, operate, and maintain the Service (including account approval and access control)
- Authenticate users via one-time passcodes (OTPs) delivered by email or SMS, and manage active sessions
- Deliver transactional and service-related communications (such as login codes, security notices, policy updates, and subscription-based notifications you request)
- Monitor usage, maintain security, prevent fraud/abuse, and investigate incidents
- Improve Service performance, reliability, and user experience
- Maintain internal records and audit logs related to platform activity
4) Email Communications and Preferences
To deliver email communications, we use your email address and notification preferences. Emails may be sent through a third-party email delivery provider (see Section 6).
We do not send marketing or promotional emails. All emails are transactional or service-related, such as login codes, security notices, policy updates, and subscription-based notifications you request
We store your notification preferences so that we can deliver the alerts you request. You may update these preferences at any time using the notification controls available in the Service or by contacting it@caliagua.net.
5) SMS Communications and Phone Verification
SMS sign-in is being rolled out and is not yet enabled on all accounts. The practices described in this section will apply once the feature is available to you.
Once available, we may use your mobile phone number to deliver one-time verification codes (SMS OTPs) when you choose SMS as a sign-in method, and to send a one-time code when you enroll or change your phone number. SMS messages will be delivered through a third-party SMS delivery provider on our behalf (see Service Providers).
Providing a phone number in your profile does not by itself enroll the number for SMS. Users may opt in to SMS verification only from within their authenticated account by entering or confirming a mobile number and completing a one-time verification step. SMS sign-in is available only for mobile numbers with a United States (+1) country code.
Purpose and frequency
SMS from the Service is used only for account verification — one-time sign-in codes and phone number verification. We do not send marketing or promotional SMS. Messages will be sent in response to your sign-in or enrollment activity; message frequency will vary based on how often you sign in.
Carrier charges
Message and data rates may apply. Contact your wireless provider for details about your text or data plan.
Opt-out
Once SMS is available, you may reply STOP to any SMS from the Service to opt out of receiving further SMS. You may also revoke your consent to SMS by any other reasonable means, including by emailing it@caliagua.net. Opting out will disable SMS sign-in for your account; you can continue to sign in by email. Reply HELP for assistance.
Phone number privacy
We do not share mobile numbers or SMS consent data with third parties or affiliates for their marketing or promotional purposes. We may share this information with service providers, messaging vendors, carriers, and other vendors as necessary to deliver and support the Service, comply with law, prevent abuse, or protect our rights. Our SMS delivery provider does not share end user phone numbers with third parties for marketing or promotional purposes.
Retention
Retention of phone numbers, verification events, and SMS delivery records is described in Data Retention below.
7) Service Providers
Depending on system configuration and usage, this Service may use third parties such as:
- Amazon Web Services (AWS) for hosting, databases, and file storage
- Cloudflare for security and web analytics
- Microsoft (Microsoft Graph) for email delivery
- A third-party SMS delivery provider for one-time passcode and phone verification messages, once SMS sign-in is available. This list will be updated when a provider is selected.
- Sentry.io for error monitoring and diagnostics
9) Data Retention
We retain information for as long as needed to:
- provide the Service and maintain your account
- comply with legal obligations
- resolve disputes
- enforce agreements
- maintain security and audit logs
Security and activity logs
Some records (like security logs, listing views, and document download logs) may be retained for a reasonable period even after account deactivation to protect the platform and support auditing.
Phone numbers and SMS records
We retain contact phone numbers as part of your account record. Once SMS sign-in is available, we may also retain records related to phone verification and SMS delivery — including timestamps, delivery status, masked destination details, provider message identifiers, and related security logs — on the same basis as other authentication and audit records, including after account deactivation, to support security, fraud prevention, abuse investigation, legal compliance, and auditing. You may request deletion subject to the exceptions described in Your Rights.
10) Security
We use administrative, technical, and organizational safeguards designed to protect information, including access controls and encryption in transit where applicable. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Breach Notification: In the event of a data breach involving your personal information, we will notify affected users in accordance with applicable law, including California Civil Code § 1798.82.
11) Your Rights (California and Similar Laws)
If you are a California resident, and to the extent applicable law applies to our handling of your personal information, you may have the right to:
- request information about the categories and specific pieces of personal information we have collected about you;
- request information about the categories of sources from which we collected personal information, the purposes for which we use it, and the categories of third parties with whom we disclose it;
- request correction of inaccurate personal information;
- request deletion of certain personal information, subject to exceptions including security, fraud-prevention, legal, and record-retention obligations;
- request correction or deletion of your phone number and certain related SMS verification records, subject to the retention exceptions described in this Policy;
- opt out of the sale or sharing of personal information, if applicable (as noted in How We Share Information, we do not sell or share personal information as those terms are defined by California law); and
- not receive discriminatory treatment for exercising applicable privacy rights.
You may also manage your notification preferences in your account settings where those controls are available.
To submit a request, contact it@caliagua.net. You may also designate an authorized agent to submit a request on your behalf; we will require written authorization and may verify your identity before acting on the request.
12) Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children.
13) Changes to This Policy
We may update this Privacy Policy from time to time. We will update the “Effective Date” above and may provide additional notice where appropriate.
14) Contact
Questions or requests: it@caliagua.net
Caliagua Inc., California