Privacy Policy
This Privacy Policy describes how Devbrew LLC (“Devbrew”, “we”, “us”) collects, uses, and shares information when you use Calidor — the AI platform for real estate developer sales teams — through calidor.ai, app.calidor.ai, and our APIs (collectively, the “Service”).
For business customers, your workspace owner determines what content is uploaded to Calidor and what team members have access. Where Devbrew acts as a processor on behalf of a workspace, the workspace owner is the controller of that data.
1. Information We Collect
Account information
When you create an account we collect your name, email address, and authentication credentials (password hash or OAuth identifier). Authentication is provided by Better Auth.
Payment information
Subscription payments are processed by Stripe. Calidor does not store full credit card numbers; Stripe provides us a tokenized customer reference plus invoice metadata (amount, subscription status, billing interval).
Workspace content
Content you submit to Calidor, including offer letters, contacts, deal records, documents uploaded to the Vault, and chat messages.
Buyer details recorded by a workspace
A workspace may record optional details about its buyers, including gender, occupation, nationality, date of birth, and marital status. Every one of these is optional, none is required to use Calidor, and a workspace decides for itself whether to collect them at all. They are used to produce that workspace’s own reports and are never used to train models, never shared between workspaces, and never sold.
Where a workspace records these details, the workspace is the data controller and is responsible for having a lawful basis to collect them and for telling the buyer. Devbrew acts only as a processor.
Usage and AI telemetry
We log AI usage to enforce plan allowances and operate the Service. Each AI call produces a credit ledger entry (model, input/output token counts, computed cost, operation type, request ID) and a trace in Langfuse containing the prompt content, model response, tool calls, and latency. Workspace ID and user ID are attached to traces so we can debug issues tied to a specific customer report.
Technical and log data
IP address, user agent, request timestamps, error logs, and similar information collected automatically when you use the Service.
2. How We Use Information
- To provide, maintain, and improve the Service.
- To generate AI outputs you request and to operate the AI features (including retrieval, embeddings, and chat).
- To enforce usage limits, prevent abuse, and protect the security and integrity of the Service.
- To bill you accurately and reconcile subscription state with Stripe.
- To respond to support requests and to debug issues you report.
- To send transactional emails (billing, security, service-related). We may send occasional product updates; you can opt out of non-transactional email at any time.
- To comply with legal obligations and enforce our Terms of Service.
3. Legal Bases (EU/UK/EEA Users)
If you are located in the EU, UK, or EEA, we process personal data on the following bases: (a) performance of the contract with you (to provide the Service), (b) our legitimate interests in operating, securing, and improving the Service, (c) compliance with legal obligations, and (d) your consent where required (e.g. non-essential cookies, if and when we add them).
4. AI Processing and Subprocessors
Calidor relies on the following subprocessors to deliver the Service. We may update this list when we change vendors or add new ones, with notice via this page and (for material changes) by email.
| Subprocessor | Purpose | Data processed |
|---|---|---|
| Anthropic (via Vercel AI Gateway) | LLM inference for AI features | Prompts, content excerpts, AI outputs |
| Vercel | Hosting, AI Gateway routing, edge network, file storage where applicable | Request data, logs, file blobs |
| Neon | Managed Postgres database | Account, workspace, and workspace content (offer letters, deals, documents) |
| Stripe | Billing and payment processing | Name, email, billing address, payment method, invoice metadata |
| Better Auth (incl. dash.better-auth.com) | Authentication and sign-up analytics | Email, account identifiers, session metadata, sign-up events, last-active timestamps |
| Langfuse Cloud (US) | AI observability and tracing | Prompts, model responses, tool calls, latency, token counts, workspace/user identifiers |
Our AI provider routing is configured for low retention where supported (e.g., zero data retention via the AI Gateway). Subprocessors do not use your data to train their underlying AI models.
5. Cookies and Tracking
Calidor uses a single essential session cookie for authentication. We do not currently set advertising or third-party analytics cookies. If we add non-essential cookies in the future, we will update this page and (where required) surface a consent banner before setting them.
6. Data Retention
We retain account and workspace content while your account is active. On verified deletion request, account and content are removed from active systems within 30 days and from backups within 90 days. AI traces in Langfuse are retained per our observability window (currently around 30 days). Billing records may be retained longer as required by tax and accounting laws.
7. Your Rights
Depending on where you live, you may have the right to access, correct, delete, export, restrict, or object to our processing of your personal data; to opt out of sale or sharing (we do not sell personal data); and to lodge a complaint with a supervisory authority. To exercise any right, email support@calidor.ai from the email associated with your account. We will respond within the timeframes required by applicable law.
8. Kenya Data Protection Act, 2019
Calidor is built for real estate developers operating in Kenya, and many workspaces process the personal data of buyers who are Kenyan data subjects. Where that is the case, the workspace is the data controller under the Data Protection Act, 2019 and Devbrew acts as a data processor on its instructions.
As controller, a workspace is responsible for:
- having a lawful basis for collecting buyer details, and informing the buyer what is collected and why;
- collecting only what it needs for the purpose it has identified, and not repurposing it later;
- responding to a buyer who asks to see, correct, or erase their details.
Calidor provides the means to honour those requests. Buyer details can be viewed and corrected on the contact record, and cleared in a single action from that same record. Exports that carry buyer details are recorded, so a workspace can establish who took that data out of the product and when.
Devbrew does not decide what a workspace records about its buyers, and does not access that data except as needed to operate and support the Service.
9. Children
Calidor is not intended for use by children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.
10. International Transfers
Calidor is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our subprocessors operate. For transfers from the EU, UK, or EEA, we rely on Standard Contractual Clauses or other lawful transfer mechanisms with each subprocessor where applicable.
11. Security
We use industry-standard safeguards including TLS in transit, encryption at rest with our infrastructure providers, role-based access controls, and audit logging. No system is completely secure; we encourage you to use a strong unique password and to report any suspected vulnerability to support@calidor.ai.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email and will take effect 30 days after notice. The “Last updated” date above reflects the most recent revision.
13. Contact
Questions about this Privacy Policy, our data practices, or your rights? Email support@calidor.ai.
Devbrew LLC, Wyoming, USA.