CAZA Privacy Policy

WORKING DRAFT — DO NOT PUBLISH YET
This text is available for review only. It requires final legal review, completion of pending matters, and confirmation of its effective date before publication.

This Policy explains what information CAZA LLC (“CAZA”) collects, how it uses it, when it may share it, and the choices available to people who use cazahn.com, CAZA mobile applications, and related services (the “Services”).

CAZA is a real estate marketplace initially focused on properties in Honduras and initially available to people in Honduras and the United States. Anyone may browse public listings without creating an account or directly providing a name, email address, phone number, or age. Publishing, acting as a contact, verifying identity, or purchasing a plan requires an account and additional information.

1. Who controls the information

CAZA LLC decides how personal information is used within the Services. Privacy inquiries, requests, and complaints may be sent to info@cazahn.com or to the address listed above.

2. Information we collect

The information depends on the features used.

2.1. Account, access, and security

We may collect a name, email address, securely hashed password, verification status, adult-age declaration, verified phone number, temporary verification or recovery references, information shared through Google or Apple, sessions, IP address, browser, device, activity, and administrative security controls.

Publisher onboarding asks for a date of birth to determine whether a person is at least 18 and whether the additional confirmation for people aged 18 through 20 is required. The date entered is processed for that request and is not stored in CAZA's database. CAZA retains the eligibility result and, when applicable, the version, language, and date of the confirmation of capacity to act independently.

2.2. Public profile

We may collect a public name, declared profile type, description, photograph, moderation status, and related dates. Profile content and verification badges that CAZA chooses to display may be public. A declared category is not a business or professional certification by CAZA.

2.3. Phone verification

CAZA uses Google's Firebase Authentication to send and validate SMS codes. The number and technical data are sent to Google/Firebase to deliver the message and prevent fraud or abuse. CAZA retains the verified number and verification date.

2.4. Optional identity verification

Identity verification is optional and is performed through Didit. If used, Didit may process images and data from a supported identity document, a facial photograph or video, liveness testing, facial comparison, date of birth, and technical data.

CAZA is designed not to store copies of the document, facial photograph or video, biometric template, or full date of birth in its own database. It mainly retains the session identifier and status, document type and issuing country, minimum-age confirmation, any required additional confirmation, relevant dates, and the version of this Policy accepted.

The verified-identity badge only means that the configured checks were completed. It does not confirm ownership of a property, legal representation, authenticity of a listing, or safety of a transaction.

2.5. Real estate listings

We may collect a title, description, project, property type and features, price, currency, price history, photographs, address and coordinates, exact or approximate location choice, declared document references, amenities, construction status, listing status and dates, and moderation results.

Active listings are public. When approximate location is selected, CAZA changes the public coordinates and limits visible details, while retaining the original location to administer the listing. Document references support independent checks; CAZA does not guarantee title or that a reference belongs to the property.

When an owner voluntarily finalizes a listing, CAZA may collect the declared outcome, a reason where applicable, how the interested person found the property, the final amount and currency when provided, a rating, an optional comment, and the submission date. This feedback is private, is not added to the public price history, and may only be accessed by authorized administrative personnel to understand listing outcomes and improve the service.

2.6. Device location

With permission, the application may access approximate or precise location while in use to center the map. CAZA does not request background location or continuously track the device. The server receives the area viewed when the map is explored. Permission may be disabled and the map remains available for manual searching.

2.7. Designated contacts

CAZA records participating accounts and profiles, invitation or assignment status and dates, authorization version, revocations, and consent to display a phone number. A name and phone number are shown only while the assignment and required permissions are active. The contact may leave or revoke authorization, and the publisher may remove the assignment.

2.8. Activity, support, and moderation

We may record favorites, hidden listings, reports, reasons, evidence and outcomes, contact requests and revocations, listing progress, plan usage, and communications with support or privacy personnel.

2.9. Plans, subscriptions, and payments

Apple, Google Play, or Stripe processes payments depending on the channel. CAZA may receive the plan, product, provider, price, currency, term, purchase or subscription identifiers, payment, renewal, cancellation, refund or chargeback status, quota usage, and evidence of the terms displayed. CAZA does not store the full card number or security code.

2.10. Technical data

CAZA and its providers may collect IP address, browser, operating system, device, application version, request dates and results, session identifiers, authentication logs, errors, fraud signals, and administrative actions. CAZA currently does not integrate behavioral advertising or a separate marketing analytics tool.

A person should provide another person's information only when legally authorized to do so, such as when inviting a contact or filing a report.

3. How we obtain and use information

We obtain information directly from users, automatically during use, from authentication, identity, payment, and store providers, and from other users who submit invitations or reports.

We use it to create and protect accounts; verify email and phone numbers; display and manage profiles and properties; facilitate authorized contacts; perform optional verification; moderate content; resolve reports and prevent fraud; manage plans and quotas; understand declared listing outcomes and improve the service; send necessary communications; respond to privacy requests; operate and secure the Services; comply with valid obligations; and defend rights.

Any future promotional communications must have an appropriate basis and include an opt-out. Essential security, purchase, or account messages are not promotional.

4. Public information

Depending on user choices, public information may include the profile and badges, active listings and photographs, price and price history, exact or approximate location, declared references, and the name and phone number of an authorized contact.

Users should not publish unnecessary personal, financial, or confidential information. Public information may be viewed, copied, or shared by third parties outside CAZA's control.

Feedback submitted when a listing is finalized, including any declared final amount, rating, or comment, is not displayed publicly.

5. Providers and recipients

Microsoft states that Azure AI Content Safety does not retain content submitted for ordinary detection or use it to train its models. Didit states that it processes and stores verification data in the European Union by default, using AWS infrastructure in Ireland. CAZA has disabled the use of its verification data to improve Didit's models.

CAZA uses MapLibre and serves map data prepared with OpenMapTiles and OpenStreetMap contributor data from its own infrastructure. Ordinary map viewing does not disclose the viewed area to OpenMapTiles or OpenStreetMap.

CAZA may also disclose information to authorities, courts, or advisers under a valid obligation or order; during a business reorganization subject to confidentiality protections; or at the user's request or authorization. CAZA does not sell personal information or share it with behavioral advertising networks.

6. External services

CAZA may open WhatsApp, Google Maps, SINAP, app stores, subscription managers, or other services. Opening Google Maps shares the selected property's coordinates with that service. Each third party applies its own policies after the person leaves CAZA.

7. International processing

CAZA LLC is organized in the United States, and the Services will initially be offered in Honduras and the United States. Providers may process information in the United States, the European Union, and other countries. CAZA will apply required contractual, organizational, and security measures. The final location of primary hosting must be confirmed before this Policy is published.

8. Retention

Periods may be extended only while a legal obligation, audit, investigation, dispute, claim, or valid request continues. The information is then deleted or anonymized.

Backups are isolated from ordinary use and deleted after 30 days. If a backup is restored, CAZA must reapply later deletions. A valid account deletion disables access, removes public content, and is completed within 30 days, except for limited retention required by law, tax, accounting, security, fraud prevention, or a dispute.

9. Security and automated moderation

CAZA uses access controls, encrypted connections, credential protection, file separation, validation, moderation, and administrative logs. Cloudflare R2 files are encrypted in transit and at rest according to the provider. No system can guarantee absolute security.

Azure AI Content Safety classifies text and images into safety categories and may temporarily prevent publication. Automated rules may also prevent abuse, limit attempts, validate purchases, and order results. They do not determine title, creditworthiness, property value, or legal capacity. A person may correct content or request review at info@cazahn.com.

10. Choices and rights

Subject to applicable law, a person may request information, access, correction, deletion, withdrawal of optional consent, restriction or objection, a reasonable copy of certain data, and may submit a complaint. A person may also hide their phone number or revoke a contact authorization where the feature allows it.

Requests may be sent to info@cazahn.com. CAZA may request reasonable information to verify identity and will respond within the legally applicable period.

Account deletion may be initiated in the application and through a public web page. It removes profiles and listings, revokes sessions, and requests applicable provider deletions. It does not automatically cancel Apple or Google subscriptions, which must be canceled through the store. CAZA will cancel future renewals directly managed through Stripe when applicable.

11. Children

Listings may be browsed without an account or age declaration. People under 18 may view this public content under the supervision of a parent or legal guardian. Browsing may generate the essential technical data described in this Policy.

People under 18 may not create accounts. Account use, publishing, purchasing plans, and acting as a contact are limited to adults. People aged 18 through 20 must complete CAZA's additional confirmation before continuing as publishers. CAZA does not knowingly seek registration, document, biometric, or payment data from minors.

CAZA is not designed or promoted specifically for children under 13. If it receives a minor's information in an unauthorized manner, it will review and delete it when appropriate. A legal representative may request this at info@cazahn.com.

12. Changes to this Policy

CAZA may update this Policy for legal, operational, provider, or Service changes. Each version will state its effective date. Material changes will be communicated through an appropriate channel and new acceptance will be requested when required.

13. Contact

CAZA LLC
Email: info@cazahn.com
Address: 8220 106th St Ste 160, Indianapolis, IN 46256, United States