CalliCalli

Privacy Notice

Last updated: September 15, 2026

This Privacy Notice describes how Calli collects, uses, stores, shares and protects the personal data of people who use our iOS and Android mobile application, our website and related services. It is issued under Mexican law on the protection of personal data held by private parties. By creating an account, downloading the app or using the Platform, you acknowledge that you have read this document.

1. Data controller

The controller of your personal data is Calli, with address at [·· TO COMPLETE: street, number, neighborhood, postal code, city and state ··], United Mexican States.

Our digital operations are aimed primarily at users in Mexico. To exercise your rights or ask any question about this Notice, write to soporte@calli.website.

When your residential community contracts security modules operated by a private security company, shared responsibilities apply. These are explained in section 8.

3. Scope, definitions and roles

This Notice applies to all services offered through the Calli mobile app and the calli.website site (or official domains replacing it), including without limitation:

  • Home services marketplace (customers and workers or providers).
  • Residential and community management (gated communities, condominiums or private developments).
  • Online payments, maintenance fees and community treasury.
  • Access control, visitors, credentials and integrated video surveillance, where enabled in your community.
  • Remote operation of access points, cameras and intercom by private security companies contracted by your community.
  • Web console for the platform, for community administrators and for security companies.

3.1 User roles

Depending on how you use the Platform, you may act as:

  • Customer or resident: requests services, pays fees or uses home features.
  • Worker or provider: offers services, shares real-time location and receives payments.
  • Community administrator or treasurer: manages members, finances, access and announcements for their community.
  • Security company staff: manages or operates, on behalf of a company contracted by your community, the access points, cameras and intercom of one or more communities.
  • Platform administrator: internal Calli operations, with restricted access.

3.2 Definitions

Controller: the party deciding on the processing of personal data. Processor: the party processing personal data on behalf of the controller. Transfer: communication of data to a party other than the controller or processor. Remittance: communication of data between the controller and a processor. Sensitive personal data: data affecting the most intimate sphere of the data subject or whose misuse may lead to discrimination or entail serious risk.

4. Personal data we collect

We collect only the data needed to provide the services you request or authorize. Categories include:

4.1 Identification and account data

When you register or sign in:

  • Full name or profile name.
  • Email address and password (stored encrypted on our servers).
  • Phone number (optional).
  • Profile photo (URL or image uploaded to cloud storage).
  • Google or Apple account identifier, if you choose to sign in with those services.
  • Platform role and app preferences.

4.2 Location and addresses

With your explicit device permission:

  • GPS coordinates to show nearby services, request jobs, track providers or record a worker’s last location.
  • Text address, city, state and saved favorite places.
  • Place search data processed through our server using Google map services.

4.3 Services, payments and billing

  • Service request details: type, notes, prices, status, ratings and comments.
  • Stripe payment method identifiers (last four digits, brand and expiry). We do not store the full card number: Stripe captures it directly.
  • Connected Stripe accounts for workers and communities, transfers, refunds and payment receipts.
  • Residential billing data: unit, amounts, SPEI bank references, provider tax IDs, CFDI UUIDs and tax receipts where applicable.
  • Community bank details (CLABE, account holder) when an administrator configures them for collections.

4.4 Community and residential

  • Community membership, invitation codes and role within the development.
  • Linked properties: address, resident data, unit and the dial number assigned on the intercom.
  • Announcements, events, regulations, reports with images and community chat.
  • Expenses, income, budgets and receipt evidence (images analyzed with artificial intelligence for categorization).

4.5 Security and access control

When your community has the security modules enabled:

  • Visitor and guest data: name, phone, email, license plate and visit schedule.
  • Access credentials: proximity cards, temporary QR codes and numeric codes (PIN) written to the physical panels.
  • Door opening records, access attempts, the identity of whoever opened, and whether they did so on site or remotely.
  • Organization, access point and device identifiers (name, IP address, serial number, configuration).
  • Live audio and video streams from cameras and intercom, and a record of intercom calls, including those routed to the security company’s central desk.

4.6 Sensitive personal data (biometrics)

Where the community enables it and you expressly authorize it, physical access readers may enroll biometric data — face or fingerprint — stored as templates in the equipment manufacturer’s access control system.

Mexican law classifies biometric data as sensitive personal data. Its processing requires your express written consent, obtained separately and independently from this Notice and from acceptance of the Terms and Conditions. You may refuse without losing access to the rest of the Platform: alternative access methods such as card, QR code or PIN will always be available.

You may withdraw this consent at any time under section 11; the biometric template is then deleted from the access control system.

4.7 Communications and generated content

  • Messages in service chats and, in some communities, messages stored in Firebase Firestore.
  • Images sent in chat or as receipts.
  • Push notification tokens (Firebase Cloud Messaging and Expo Push).
  • In-app notifications: title, body and event metadata.
  • Ratings, comments and claims.

4.8 Technical data

  • Session token and authentication data stored locally on the device.
  • Theme preferences, start mode and Android quick door access configuration.
  • Server technical logs: IP address, request time and paths accessed.
  • Audit trail of actions performed by security companies on your community.

5. Device permissions

The app requests operating system permissions only when needed for the corresponding function. You may revoke them from your phone settings; some features will stop working.

  • Location (precise and approximate): nearby services, requests and worker tracking.
  • Camera and gallery: profile photo, treasury receipts, chat images and QR code scanning.
  • Notifications: alerts for services, payments, access, intercom calls and messages.
  • Microphone: intercom communication in video surveillance modules, when active.
  • Internet and storage: general operation and media cache.

6. Processing purposes

The law distinguishes primary purposes, necessary for your relationship with us, from secondary purposes, which you may object to without affecting the service.

6.1 Primary purposes

Necessary to provide the service:

  • Create and manage your account and authenticate you.
  • Connect customers with workers and manage the service lifecycle.
  • Process payments, settlements, refunds and maintenance fees.
  • Operate residential features: memberships, treasury, reports and communication.
  • Manage physical access, visitors and perimeter security when your community contracts it.
  • Send operational notifications about relevant events: payments, access, calls and messages.
  • Prevent fraud, protect Platform security and comply with legal obligations.
  • Handle support requests and the exercise of privacy rights.

6.2 Secondary purposes

Not necessary for the service. You may object by writing to soporte@calli.website without affecting your account or the services you contracted:

  • Classify service requests and extract receipt data using artificial intelligence, for operational improvement.
  • Produce aggregate statistics and usage metrics to improve the product.
  • Send you communications about Platform news or new features.

7. Legal basis for processing

We process your personal data on the following bases:

  • Performance of the contractual relationship: providing the services you request.
  • Consent: location, camera, microphone, notifications and image processing.
  • Express written consent: sensitive biometric personal data, under section 4.6.
  • Compliance with legal obligations: retention of tax, accounting or payment records where required by law.
  • Protection of a legitimate interest, always balanced against your rights: Platform security and abuse prevention.

8. Who is responsible for what

Several parties take part in the residential and security modules. So you know whom to approach, we distinguish the following roles:

  • Your community (condominium, gated community or private development), through its administration, decides what access and resident data is processed, who is granted access and under what rules. For that data, the community acts as controller.
  • Calli provides the technology platform and processes that data on behalf of the community, as a processor, following its instructions and keeping the audit trail.
  • The private security company contracted by your community operates the access points, cameras and intercom. It processes resident and visitor data to fulfill that engagement, and is accountable for how its staff uses it.
  • For your user account, identification data, payments and use of the services marketplace, Calli acts as controller.

8.1 Security company access

When your community contracts a security company, its authorized staff may, for the communities assigned to it: consult the resident roster and their units, open doors remotely, view cameras, receive and answer intercom calls, and manage access credentials.

All such actions are recorded in an audit trail tied to the person who performed them.

Security company staff may also be enrolled as a person in your community’s access control system, with their own physical credential, so they can enter the premises for installation, maintenance or surveillance work. When their relationship with the company ends, that credential is removed from every community where it existed.

9. Remittances and transfers

We do not sell your personal data. We share it only with the recipients listed below, under contract or subject to their own privacy policies.

9.1 Remittances to processors

Providers processing data on our behalf and under our instructions. These do not require your consent:

  • Stripe, Inc.: payment processing, connected accounts and PCI-DSS compliance.
  • Google LLC: sign-in, Firebase (notifications, storage and chat database), Google Maps and Places, and Google Gemini for receipt classification and reading.
  • Cloud infrastructure providers: API hosting and PostgreSQL database.
  • Hikvision and its HikCentral platform: the building’s access control and video surveillance system, where your community uses it.

9.2 Transfers

Communications to third parties that decide on the data. Where required by law, these are made with your consent:

  • Your community’s administration: data needed for collections, access and internal communication.
  • The private security company contracted by your community, under section 8.
  • Other Platform users: information visible in context, such as a worker’s public profile, service status or chat messages.
  • Competent authorities, upon a valid and duly founded legal request.

9.3 International transfers

Some providers (Google, Stripe, Firebase and our infrastructure providers) may process data on servers located outside Mexico, including the United States. In those cases we apply reasonable contractual and technical measures to protect your information in line with industry standards.

10. Retention period

We retain your data while you keep an active account or while needed for the purposes described. After account deactivation:

  • We mark your account inactive. Some data may be retained for legal obligations, dispute resolution, payment records or security.
  • Temporary access credentials, such as QR codes, are deleted automatically on scheduled cycles.
  • Physical credentials and, where applicable, biometric templates are deleted from the access control system when you leave the community.
  • Invalid notification tokens are removed from the system.
  • Audit trail records are kept as long as needed to evidence who performed each access operation.

11. Your ARCO and other rights

You have the right to Access your data, Rectify it when inaccurate, Cancel it when you believe it is not required, and Object to its processing for specific purposes. You may also withdraw your consent and limit the use or disclosure of your data.

To exercise them, send a request to soporte@calli.website stating your name, your registered email, a clear description of the right you wish to exercise, and a copy of official identification proving your identity or representation.

We will answer within a maximum of twenty business days and, where the request is well founded, make it effective within the following fifteen business days. These periods may be extended once for an equal term where circumstances justify it.

If your data is processed by your community or by the security company it contracted, we will point you to whoever must handle your request and give you the relevant contact details.

If you believe your right was not properly addressed, you may approach the supervisory authority for personal data protection identified in section 2.

12. Security breaches

If a security breach occurs that significantly affects your economic or moral rights — for example, loss, destruction, theft, copying, unauthorized use, access or disclosure of your personal data — we will notify you without delay, by email to the address registered on your account and through an in-app notice.

The notice will include, to the extent the information is available: the nature of the incident, the personal data compromised, recommendations you can follow to protect your interests, the corrective actions we have implemented, and how to obtain further information.

Where the incident occurs in the systems of your community or of the security company operating it, we will cooperate with them so that notice reaches you and to determine the scope of what happened.

If you detect a possible security incident, please report it immediately to soporte@calli.website.

13. Minors

The Platform is not directed at people under eighteen and we do not knowingly collect their data. If we detect an account belonging to a minor without verifiable consent from a parent or guardian, we will deactivate it and delete the information as far as possible.

Where a minor resides in a community using access control, processing of their data corresponds to the community and must have the consent of whoever holds parental authority or guardianship.

14. Security measures

We implement reasonable administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction, or unauthorized use, access or processing. These include password encryption, encrypted HTTPS communication, token authentication, role- and capability-based access control, encryption at rest of device credentials, and audit trails of sensitive operations.

The session token is stored in the device’s local storage. For the Android quick door access feature, a system component may temporarily store credentials; you can disable it if you do not use it.

No system is completely secure. We recommend using strong passwords, not sharing your session, and periodically reviewing who has access to your community.

15. Website and cookies

The calli.website site uses cookies and similar technologies under our Cookie Policy, available at /cookies. We encourage you to read it to learn the types, purposes and how to manage them.

16. Changes to this Notice

We may update this Privacy Notice to reflect legal changes, changes in our services or in our privacy practices. We will publish the version in force at this same address, stating the last updated date.

Where the change is material — for example, if we add different purposes or new recipients of your data — we will notify you by email or through a prominent in-app notice before it takes effect, and will obtain your consent again where the law requires it.

17. App store disclosures

The “Data safety” disclosures on Google Play and the privacy labels on the App Store reflect the categories described in this Notice. We keep what is declared in each console consistent with the app’s actual use, and update both when the product changes.

18. Contact

For privacy questions, exercising ARCO rights, withdrawing consent or reporting security incidents: