Legal

Privacy Policy

Calas Automations Inc. · Winnipeg, Manitoba, Canada · Effective 2026-10-15

This Privacy Policy explains what personal information Calas Automations Inc. (“Calas,” “we,” “us”) collects through our website, our assistant Cara, our phone line and our products (On File, Lead Me, Quote Me, Haul Me, Watchpost, Calas ScamCatch, ScamCatch Family, Dispatch Me, ReceiptSort, Permit Checker and Dropwatch, together the “Services”), why we collect it, who helps us handle it, and how long we keep it.

We are a Manitoba company. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to us. If you or your customers are in Québec, Alberta or British Columbia, those provinces’ privacy laws may also apply, and we will help you meet them. Quote Me also has its own, more detailed Privacy Policy inside the app; for Quote Me, that policy applies.

Our role: your information, and your customers’ information

• Your information: the names, emails and phone numbers of you and your staff, your billing and sign-in details, and what you tell us when you call, chat or fill in a form. We are responsible for it.
• Your customers’ information: the personal information about your clients, customers or subcontractors that you put into On File, Quote Me, Haul Me or another business Service. Your business is responsible for it: you collect it and you decide what it is for. We are your service provider. We store and use it only to run the Service for you, on your instructions. We never use it for our own purposes, and we never sell it.

If one of your customers contacts us about their information, we will pass the request to you and help you answer it.

1. Information we collect

Account and business information: name, email, business name, phone number, the sign-in details for your account (your password is stored scrambled, so not even we can read it), and the settings you enter.

Payment information: handled entirely by Stripe, our payment processor. We receive confirmation that a payment succeeded and a reference number. We never receive or store your full card number or bank account number.

Automatically collected: standard technical data (IP address, browser type, device type and times) needed to run and secure the Services.

What each Service handles is set out in Section 2.

2. Service by service

• Website and Cara chat. The website calasautomations.com is a static site hosted on GitHub Pages (GitHub, United States) and delivered through Cloudflare (our domain name service and content network). GitHub and Cloudflare may each keep standard request logs (IP address, browser, page, time) for security and traffic statistics. Fonts load from Google Fonts (United States), which receives your IP address. Our sign-in, sign-up and enquiry forms and the Cara chat send what you type to our Cloudflare Workers; the Cara chat text is sent to Cloudflare Workers AI to write a reply. We don’t store the conversation; we keep only a scrambled daily count per IP address to prevent abuse.
• Phone, 431-244-9026. Calls are answered by Cara, our AI assistant, which runs on ElevenLabs (United States) over Twilio (United States). Calls are recorded and transcribed so the team can follow up. We keep them for 12 months.
• Lead Me, Haul Me and On File are stored on our own server, hosted with DigitalOcean (we have not yet confirmed which region it is in, so please do not assume it is in Canada). Lead Me stores business contact details that businesses publish on their own websites (business name, role, work email, and where and when it was found). Haul Me sends the start and end of a route to openrouteservice (Germany) to plan a truck route. On File stores what your clients or subcontractors send, as your service provider. Its reminder emails are sent through Resend (United States) by way of Cloudflare, and replies arrive in a Google mailbox (Gmail / Google Workspace); these providers handle that email for us.
• Quote Me stores your quotes, voice notes, photos, price lists and your customers’ details with Cloudflare, and uses Cloudflare Workers AI and Groq (United States) to turn them into draft quotes. Its in-app Privacy Policy lists every provider, what each receives and how long each thing is kept.
• ScamCatch. Messages are checked on your device. To compare links and phone numbers with other users’ reports, ScamCatch sends a short scrambled fingerprint, never the message. If you tap Report, the link or number itself is sent and kept so other users can be warned. ScamCatch Family stores your name, email, phone number, family name and safe word. If you switch it on, the warning (and, if you tick the box, the first 140 characters of the message) goes to your family admin. Alerts go through ntfy and by email.
• Watchpost stores decoy logs (the address that touched a decoy, the time and what it sent) to write your report, for 13 months. We use them only for security and your report.
• Dispatch Me stores your name, company, phone, email, property addresses and, for crews, areas and equipment, for as long as we work together plus 2 years.
• Dropwatch, Permit Checker and ReceiptSort run in your browser. What you type or upload stays on your device.
• Email is sent through Resend (United States) by way of Cloudflare, and replies to On File arrive in a Google mailbox. Payments go through Stripe.

Each of these companies handles your information only to provide its service to us, under its contract with us. If we add a provider that will receive your information, we will update this policy first. We do not sell your personal information, or your customers’ personal information, to anyone.

3. How long we keep it

We keep your information while your account is open, plus a reasonable period afterward for legal, tax and dispute purposes, unless this policy or a Service’s own page says otherwise. Haul Me deletes your copy and everything in it 30 days after your plan ends. Quote Me’s retention periods are in its in-app Privacy Policy. Call recordings, Watchpost logs and Dispatch Me records are kept for the periods in Section 2. For On File we delete a customer’s data on request when the account is closed, usually within 30 days; we keep only the email address of anyone who asked us to stop emailing them, so that request keeps working. Deleted information can stay in backup copies until they expire. We keep our own billing records as tax law requires.

4. AI processing

Some features send what you submit to an AI model: Cara’s chat and phone replies, and Quote Me’s transcripts, draft quotes and Photo check. The providers are listed in Section 2. AI output is a draft, and a person decides what to do with it. We do not use your content or your customers’ information to train AI models.

5. Security

We take reasonable technical and organizational measures to protect your information, including private per-client folders, access controls, sending files only over HTTPS, and review of our own code. We have not yet verified whether our server disks and backups are encrypted, so we do not claim it. No system is perfectly secure, and we cannot guarantee absolute security; see our Terms of Service for the related limitation of liability.

If we learn of a breach of security safeguards involving personal information:

• Your customers’ information: we will tell you promptly, with what we know, so you can meet your own obligations.
• Information we are responsible for: where there is a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as PIPEDA requires.

We keep a record of every breach.

6. Your rights

Under Canadian privacy law, you generally have the right to:

• see the personal information we hold about you;
• correct information that is wrong;
• ask us to delete your account and data, subject to legal retention requirements;
• withdraw consent for optional uses, such as marketing emails, at any time.

To use any of these rights, contact our Privacy Officer (Section 10). It’s free. We will check your identity and reply within 30 days. In limited cases the law allows one extension of up to 30 more days; if we need it, we will tell you why.

If you are a customer of a business that uses one of our Services, that business is responsible for your information, so please contact it first. If you contact us, we will pass your request to the business and help it answer.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

7. Children

Our Services are not directed at children, and we do not knowingly collect personal information from children. Dropwatch, Permit Checker and ReceiptSort run in your browser and do not send us what you type.

8. Where your information is processed

Our own server is hosted with DigitalOcean; we have not yet confirmed its region. Some of our providers process or store information outside Canada: GitHub (website hosting), Cloudflare, Google Fonts, Groq, ElevenLabs, Twilio, Resend, Google and Stripe mainly in the United States, and openrouteservice in Germany. While it is there, the courts, police and national security authorities of that country may be able to get it under their laws. We protect it through our contracts with these providers.

9. Changes to this policy

We may update this policy. We will post changes here with a new effective date. For material changes, such as a new provider that will receive your customers’ information, we will also email the account owner before the change takes effect.

10. Contact: Privacy Officer

Calas Automations Inc. has a Privacy Officer who is accountable for how we handle personal information. Contact the Privacy Officer with questions about this policy, to use a privacy right, or to make a complaint.