Privacy Policy

Calau is operated by MAXIMUM CONSULT. For any question about this policy or about your data, write to privacidade@calau.app. When your data is uploaded by a Calau client organisation (for example, your CV, uploaded by the consulting firm you work for), that organisation is the main party responsible for the decision to process it; Calau acts as a processor, under the terms described in the Data Processing Agreement.

• Account data: name, e-mail address, password (stored encrypted, never in plain text), organisation and role within it.
• Organisation data: name, country, currency, tax and banking details used in financial proposals, and the budget and graphic appearance defaults you configure.
• Content uploaded or produced on the platform: terms of reference and other tender documents, proposals and budgets, consultant CVs (including education, professional experience and skills), messages exchanged through Calau's e-mail channel, and the version and approval history of each document.
• Technical data: access and usage logs (date, time, action taken, IP address) for security and troubleshooting.

Calau does not request or process special categories of data (health, ethnic origin, political opinion, etc.). If a CV uploaded by a client organisation contains such data, it is that organisation's responsibility to ensure it has a legal basis to process it; only CVs uploaded with the consent of the person they concern should ever be uploaded.

• Providing the service: generating, reviewing and exporting proposals and related documents.
• Finding, among the profiles uploaded by the organisation, the ones best suited to a tender, with an explanation of the recommendation.
• Authenticating access and keeping the account and the platform secure.
• Sending operational communications (deadline reminders, export status).
• Billing and subscription management.
• Complying with legal obligations and responding to requests from competent authorities.
• Improving the platform, using aggregated statistics that do not identify individuals.

Calau uses language models from external providers (currently Google, and depending on the organisation's configuration, also Anthropic or OpenAI) to analyse documents, draft proposal sections and extract structured data from CVs. Those providers receive only the text strictly necessary for the requested operation, over an encrypted connection, and Calau configures these integrations so that the content sent is not used to train those providers' models. No document is shared between client organisations: each request to the AI uses only sources previously approved by the organisation itself.

We share data only with providers that support the operation of the service:

• Infrastructure providers (hosting of the servers and the database).
• Artificial intelligence model providers, described in point 4.
• An e-mail delivery service, for the messages the platform sends.
• An off-site backup service, for recovery in the event of a serious incident.

We do not sell personal data, nor do we share it for third-party advertising purposes.

The servers hosting Calau are located in the European Union (Germany). The artificial intelligence providers referred to in point 4 may process individual requests outside the European Union, under the contractual safeguards those providers offer for international data transfers.

We keep data for as long as the organisation's account is active. After the account is closed, we keep the data for a reasonable period to allow its recovery at the client's request and to comply with legal and tax obligations, after which it is deleted or anonymised. Backups follow their own rotation cycle and are not kept indefinitely.

You may request access to your data, its correction, its deletion, restriction of processing, portability, and object to certain processing, by writing to privacidade@calau.app. When the data was uploaded by a client organisation (for example, your CV), the request should normally be directed to that organisation, which decides on the processing; Calau cooperates with it to fulfil the request.

Each organisation's data is isolated from every other's in two independent layers (application-level isolation and row-level security in the database), connections use encryption in transit, passwords are stored encrypted, and access can be reinforced with two-factor verification. We keep daily backups, verified and stored off the main machine.

We may update this policy to reflect changes to the service or to applicable law. We always publish the date of the last update at the top of this page; for significant changes, we also notify by e-mail.

For questions about this policy or about your data, write to privacidade@calau.app. See also the Terms of Service and the Data Processing Agreement.