Privacy Policy

2.1 Account Information

When you create an account, we collect your email address. You can sign in either with a one-time link sent to your email, or with a password. If you choose a password it is stored only as a salted hash by our authentication provider, Supabase — Calchis never sees the password itself and cannot recover it. Your email is used for account access, subscription management, and disaster alerts (if you opt in). We may also collect your name and organization if you provide them.

2.2 Saved Locations (Precise Geolocation)

If you save locations (home, work, or custom addresses), we store the address text, geographic coordinates (latitude and longitude), and the label you assign. Under the California Privacy Rights Act (CPRA) and other state privacy laws, saved home and work addresses constitute sensitive personal information because they include precise geolocation data. We process this data only for the purposes you direct: generating proximity alerts when active disaster events affect your saved locations.

You may add, edit, or delete saved locations at any time. Saved locations are associated with your account and are never shared with other users, sold, or used for advertising.

2.3 Search Queries

Address searches are processed via the Mapbox Geocoding API. We do not log individual search queries on our servers. Mapbox processes geocoding requests subject to its own Privacy Policy.

2.4 Portfolio Data

If you upload portfolio locations (paid tiers with portfolio access), we store addresses, coordinates, and property metadata you provide (insured value, construction type, year built, square footage). Portfolio data is processed exclusively to generate hazard scores and analytical outputs for your account. Portfolio data is never shared with other users, sold, or used for purposes other than providing the Platform services.

2.5 ILS Trigger Configurations

If you create ILS trigger monitors, we store the trigger parameters you define (peril, location, threshold type and value, alert thresholds). This data is used solely to evaluate triggers against live event data and send alerts.

2.6 Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not receive, process, or store credit card numbers, bank account details, or other payment credentials. Stripe transmits to us only your subscription status, tier, and billing period dates. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.

2.7 Technical and Usage Data

We use Sentry for error monitoring and application performance tracking. Sentry collects browser type, operating system, device type, and error stack traces. We do not use Google Analytics, Meta Pixel, or any third-party advertising or behavioral tracking service. We collect server-side request logs (IP address, endpoint, timestamp, response code) for security monitoring and rate limiting. IP addresses in logs are automatically purged after 30 days.

2.8 API Usage Logs (API Subscribers)

For API subscribers (Enterprise tier and any tier with API access), we log API request counts, endpoints accessed, response times, and response codes for rate limiting, billing, and debugging. We do not log request payloads or response bodies.

6.1 Service Providers (Sub-Processors)

6.2 We Do Not Share With

• Advertisers or ad networks
• Data brokers
• Social media platforms
• Marketing or analytics companies
• Insurance carriers (unless you are an Enterprise subscriber who directs integration via API)

6.3 Legal Disclosure

We may disclose personal information if required by law, subpoena, court order, or government request. We will notify you of such requests when legally permitted to do so.

6.4 Business Transfer

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred as part of the transaction. We will notify you via email and/or prominent notice on the Platform before your information is subject to a different privacy policy.

9.1 All Users

Regardless of your location, you have the right to:

• Access: View all data associated with your account through the Platform at any time
• Correction: Update your email, saved locations, and portfolio data at any time
• Deletion: Delete your account and all associated data by contacting privacy@calchis.com or through account settings
• Portability: Export your saved locations, portfolio data, and hazard scores in machine-readable format (JSON/CSV)
• Restrict processing: Request that we limit how we use your data

9.2 California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You may request the categories and specific pieces of personal information we've collected, the sources, the business purposes for collection, and categories of third parties with whom we share it
• Right to Delete: You may request deletion of personal information we've collected, subject to legal exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. This right is already satisfied by default
• Right to Limit Use of Sensitive PI: Your saved locations (precise geolocation) are sensitive personal information under CPRA. We process this data only for the purpose you direct — disaster proximity alerts. You may delete any saved location at any time to revoke processing
• Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right

To exercise your rights: email privacy@calchis.com or use the in-app account settings. We will verify your identity using your account email and respond within 45 days.

CCPA categories collected: Identifiers (email); Geolocation (saved locations); Commercial information (subscription tier); Internet activity (Sentry error reports). We do NOT collect: Protected classifications, biometric data, sensory data, professional information, education information, or inferences drawn for profiling.

9.3 Other US State Privacy Laws

We comply with applicable state privacy laws including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), Texas Data Privacy and Security Act (TDPSA), and Oregon Consumer Privacy Act (OCPA). Residents of these states have rights substantially similar to those described in Section 9.1, including the right to access, delete, correct, and opt out of data sales (which we do not conduct).

To exercise rights under any state privacy law, contact privacy@calchis.com. If we deny a request, you have the right to appeal. Appeals should be directed to legal@calchis.com and we will respond within 45 days.

9.4 EEA / UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you have the right to: access your data, rectify inaccurate data, erase your data, restrict processing, data portability, and object to processing. Our lawful bases are described in Section 5. You may lodge a complaint with your local supervisory authority. Contact: privacy@calchis.com.