Portal privacy

Last updated: August 2026

This notice explains what information CALFAB collects and stores in connection with the Client Portal. It adds to, and should be read together with, our main website Privacy Policy, which governs information collected through www.cal-fab.com generally. Where this notice does not address something, the main Privacy Policy applies.

Information we collect and store

Account information. To give you access, we store a username and a securely hashed version of your password. We do not store your password in readable form and cannot see it.

Two-factor authentication. If you choose to enable optional two-factor authentication, we store a secret associated with your account that is used only to verify the one-time codes from your authenticator app when you sign in. It is not used to identify or track you, and it is not shared.

Project documents. We store the documents we make available to you for your project, such as proposals, estimates, agreements, drawings, and invoices.

Access records. When you sign in or download a file, our server records standard information such as the date and time, the file accessed, and your IP address, for security and recordkeeping.

How we use this information

We use it to give you secure access to your project documents, to operate and protect the Portal, and to keep records of access. We do not sell or rent your information.

How we share information

We share information only as needed to run the Portal and respond to you: with our website hosting provider, and, if you choose to pay an invoice online, with our payment processor (Intuit, through QuickBooks), which handles your payment under its own privacy practices. We may also disclose information where required by law. We do not sell your information.

Cookies, tracking, and your signals

The Portal uses only the cookies needed to keep you signed in. It does not track you across other websites, and we do not use it for advertising. We do not sell or share your personal information, including for cross-context behavioral advertising. Because we do not track you across sites, we do not change how the Portal behaves in response to browser "Do Not Track" or Global Privacy Control (GPC) signals; there is nothing for such a signal to opt you out of.

Security

We use reasonable measures to protect the Portal and its contents, including encryption in transit (HTTPS) and optional two-factor authentication for accounts that enable it. No website or method of storage is completely secure, however, and we cannot guarantee absolute security.

How long we keep information

We keep project documents and account information for the duration of your project and for a reasonable period afterward for our business and legal records, and we may remove documents once a project is complete. Account access is removed when it is no longer needed. If you would like a specific document or your account removed sooner, contact us and we will accommodate the request where we are able.

Your choices

You may ask us to access, review, update, correct, or delete the personal information associated with your Portal account by contacting us using the details below, or by the methods described in our main Privacy Policy. We will respond within a reasonable time. These choices also apply to the contact information you provided through the main website, as set out in that policy.

Changes to this notice

We may update this notice from time to time. Any material change will be posted on this page with a revised "last updated" date, and significant changes affecting how we handle your information will be communicated through the Portal or by email. Continued use of the Portal after a change is posted means you accept the updated notice.