Privacy Policy

Information and purposes

Multiservicios Elites LLC, Florida, United States, operates Caxper. We determine how account, subscription, security and support information is used to run Caxper. For customer project information entered by a contractor, we generally process it on that business’s instructions. The contractor is responsible for its own privacy notices and lawful use of that information.

• Account and business details: email, authentication information, name, phone, business address, trades, hours, timezone, logo and signature image. Used for account access and business documents.
• Customer and project details: contact information, service address, answers, measurements, descriptions, photos, messages and appointments. Used to prepare and coordinate the requested work.
• Commercial records: estimates, acceptance records, invoices, payment and refund records, and subscription identifiers/status. Used for documents, billing and payment history.
• Operational information: policy version and acceptance time, timestamps, delivery results, security events and usage counts. Service providers also process network/device information to deliver and protect their services.

Information comes from you, the business or customer you work with, your interactions with Caxper and the providers supporting those features. Avoid entering sensitive information that the work does not require.

Service providers and AI

Current providers include Supabase for accounts, database and private files; Cloudflare for hosting and account protection; OpenAI for estimate drafting; Resend for transactional email; Purelymail for support and privacy correspondence; and Stripe for subscriptions and connected payments, including transactions explicitly labeled as tests.

AI inputs include service answers, work descriptions, measurements and materials. Dedicated customer name, email, phone and address fields, and project photos, are excluded from the current drafting input. Free-text descriptions can still contain personal information if entered there. We do not promise zero retention by AI providers.

Card and connected-account onboarding details are entered on Stripe-hosted pages. Caxper receives the identifiers and payment status needed to operate those features. SMS and WhatsApp sharing use the sender’s chosen messaging service.

Customer records are also available to the contractor managing the work and to the customer through private links. Information may be disclosed as necessary for lawful requests, security or a protected business transfer. We do not sell or rent personal information, or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer personal characteristics. Information is shared with the providers needed for the purposes described here, not with advertisers. We do not use AI estimates to decide eligibility for employment, housing, credit or insurance.

Provider policies and processing locations

Caxper operates from the United States. Providers may process data in the United States and other countries where they operate. Protections and government-access rules may differ by country. We use provider agreements and applicable transfer safeguards when required; we do not promise that every copy remains in a particular US state.

Provider privacy information: Supabase, Cloudflare, OpenAI, Resend, Purelymail and Stripe. Providers can have independent obligations, particularly for payment compliance, fraud and security. Our deletion process does not erase records they must independently retain.

Browser storage and tracking

Caxper uses browser storage for sign-in, unsent form answers and preferences. Clearing it may sign you out or remove an unfinished form. Account protection also uses Cloudflare Turnstile.

Caxper does not use advertising pixels or targeted-advertising cookies. Essential storage and anti-abuse checks support the features you request. Email delivery services process delivery, bounce and complaint information; message opening or link use can also produce provider logs and document-view events. You may block remote email images or manage browser storage, although doing so can affect features.

Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising-sharing activity to opt out of today. A Global Privacy Control signal does not prevent essential service processing. We do not change essential processing in response to Do Not Track. We will update this notice and provide any required choice before introducing a materially different use.

Account deletion and retention

Delete account deactivates your workspace and allows recovery for 30 days. Sign in and choose Recover account before the deadline to stop deletion. Recovery cancels only that account-deletion request; it does not cancel a separate privacy request or restart subscription charges.

• Operational data and files: after the 30-day recovery window, a daily process removes the account profile, business details, account-policy acceptance records, contacts, project records, ordinary messages, appointments, uploads and original PDFs, then removes the sign-in identity.
• Minimum financial evidence: a restricted archive retains issued invoice numbers, issuer/customer names, line items, amounts, dates, credits and payment references for 7 years from the last related financial event, for accounting and dispute evidence. Subscription references/status and paid-through dates follow the same 7-year policy. It excludes dedicated contact/address fields, photos, logos, signatures, ordinary messages and original PDFs. Item descriptions can contain personal information entered by the contractor. Stripe holds the underlying billing documents.
• Privacy-request evidence: minimum receipt, type, acknowledgement and outcome records are retained for 24 months after resolution.
• Routine technical records: application audit, rate-limit, completed AI usage, export and sent operations-email logs are removed after 90 days. Account-notice delivery addresses/content are cleared after acceptance by the email provider, or within 30 days if unsuccessful; delivery evidence is kept for 90 days.

These are Caxper retention rules, not a statement that US law requires seven years for every record. Unresolved privacy requests, payment disputes and documented legal holds require review. An unpaid invoice alone is not a reason to retain an entire workspace. Independent privacy requests keep their own applicable deadlines.

We email you when account deletion is requested, canceled or completed. A completed notice confirms removal from the active Caxper account and operational stores; it does not claim that restricted evidence or every provider copy has been erased. Provider records and backups are handled separately under their applicable retention and deletion processes. Deleting Caxper does not delete a contractor-owned Stripe account.

Backup copies, where held, are restricted from ordinary use and removed through their backup lifecycle or applicable deletion procedure. If a backup is restored, applicable deletions must be reapplied before those records return to active use. We do not represent a deletion from the active account as immediate erasure from an independent provider or backup. Requests predating this schedule receive individual review.

Access, correction and privacy requests

In Settings → Your data, signed-in users can download structured records and submit access, correction, deletion, appeal or other privacy requests. This remains available after account deactivation. The download contains file references; request copies of uploaded files when needed.

A request receipt means the request was received, not that erasure has completed. Identity and authority must be checked before private records are released or changed.

You can also email [email protected] for privacy requests, appeals or authorized-agent requests, including if you cannot sign in or do not have an account. Briefly describe your request and relationship to Caxper; do not send passwords or identity documents in your initial email.

If you are a contractor’s customer, contact that business using the details on your document for requests about records it controls. You can still contact Caxper about our handling of your information.

California and other US states

Depending on applicable law, residents may have rights to access, correct, delete or obtain their information, and to opt out of specified uses or appeal a decision. Applicable rights include protections against unlawful discrimination for exercising them.

For California residents, where applicable, these rights include knowing the categories and specific pieces collected, sources, purposes and categories of recipients; correcting inaccuracies; requesting deletion; obtaining a portable copy; and opting out of sale or advertising sharing. The categories and uses described above also describe our practices during the preceding 12 months, or since the service began if shorter. We have not sold personal information or shared it for cross-context behavioral advertising, including information about people under 16. We offer no financial incentive for providing personal information.

How we handle rights requests

Submit requests through Your data or [email protected]. These routes also accept opt-out, sensitive-information and authorized-agent requests if relevant. You do not need an account. Include your state, relationship to the business and the request, but do not include passwords or full payment details.

We verify identity or an agent's authority proportionately for access, correction or deletion, using information already held when possible. An agent may need written authorization and direct confirmation from you, subject to applicable exceptions. We do not require verified identity for an opt-out that does not require it by law. We use verification information only to handle the request and prevent unauthorized disclosure.

For covered California access, correction or deletion requests we acknowledge receipt within 10 business days and normally respond within 45 calendar days. If a permitted extension is needed, we explain the reason and revised deadline within the initial period. Other jurisdictions may have different deadlines; the applicable deadline governs. The 30-day account recovery period does not delay an independent privacy request.

If we cannot fulfill all or part of a request, we explain the reason and any permitted exception. You may appeal by emailing support with “Privacy appeal” and the request reference. We review the appeal and respond within the period required by your state, ordinarily no later than 60 days, or sooner where required. You may also contact your state attorney general or privacy regulator. We do not unlawfully discriminate against you for exercising privacy rights.

Security, children and updates

Caxper uses access controls, private file storage, encrypted transport and usage limits. No service can guarantee absolute security. Keep document links private and retain your own copies of important records.

Caxper accounts are for adults aged 18 or older. The service is not directed to children under 13 and we do not knowingly collect their information. If you believe a child provided personal information, contact support so we can investigate and remove it as appropriate. Report suspected security incidents to [email protected]; do not send passwords, private customer links or exploitable details in a public post. We provide legally required incident notices when applicable.

This policy is effective September 30, 2026. Material changes will be identified here and communicated through the app or account email as appropriate before they take effect; any required consent will be obtained separately. Help & support lists the options currently available.