Privacy Policy

Overview

CalStar Services, Inc. ("CalStar," "we," "us," or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at https://calstar.com or use our services, including dumpster rental, junk removal, recycling, shop purchases, job applications, hauler account registration, and commercial account applications.

By using our site or services, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our website.

Information We Collect

Information You Provide Directly

• Contact details: Name, email address, phone number
• Service address: Delivery or pickup address, city, state, ZIP code
• Quote & order information: Container size, service type, preferred dates, special instructions, estimated material type
• Account credentials: Email and password for member accounts (passwords stored as a one-way bcrypt hash - we never see your plaintext password). If you use "Remember Me," a secure token is stored in a browser cookie.
• Saved addresses: Delivery addresses you save to your member account for convenience
• Shop & cart data: Products added to cart, quantities, selected size and color options. Guest cart data is stored in your browser's localStorage only; it is never sent to our servers unless you check out.
• Purchase information: Billing name, shipping address, and order details for merchandise orders. Payment card data is handled entirely by Stripe - see the "Payment Processing" section.
• Contact form messages: Subject, message body, and whether you requested a callback
• Job applications: Resume, cover letter, work history, and the position you applied for
• Hauler account applications: Business name, business address, business license number, EIN/Tax ID, year established, primary contact name and title, and the types of vehicles in your fleet. You may also upload verification documents (business license, insurance certificate, DMV registration, W-9, etc.) which are stored securely on our servers.
• Commercial account applications: Company name, business address, business license number, EIN/Tax ID, year established, services requested, weekly waste volume, number of locations, billing preference, billing contact, primary contact details, and current hauler. You may also upload up to four business documents which are stored securely on our servers.
• Commercial account payment records: For approved commercial accounts, authorized CalStar staff may record payment method details - including credit card information (card type, number, expiry, CVV, cardholder name, billing address) or ACH/bank account information (bank name, account holder, account type, routing number, account number) - within our admin system solely for billing and invoicing purposes. This data is accessible only to authorized staff and is never sold, shared, or used for any purpose other than processing payments for services rendered.
• Live chat conversations: Messages exchanged through our Tawk.to live chat widget - see the "Live Chat" section

Information Collected Automatically

• IP address: Recorded when you submit any form (quote request, contact, job application, hauler application, shop checkout) for fraud prevention and security purposes
• Log data: Browser type, pages visited, referring URLs, timestamps
• Device data: Browser version, operating system, screen resolution
• Marketing attribution: If you arrive via a tracked link (UTM parameters), we record the source, medium, campaign, and referring URL to understand which marketing channels are effective. This data is linked to your form submission but is not sold or shared.
• Cookies and local storage: See the "Cookies & Tracking" section below

Information from Third Parties

• Stripe may share transaction status (success/failure) and limited fraud-signal data with us via webhook
• If you contact us via social media, we may receive your public profile information
• Google Analytics may pass aggregate, anonymized usage data to us

How We Use Your Information

We use the information we collect to:

• Schedule, process, and fulfill dumpster rental, junk removal, and waste service orders
• Respond to quotes, inquiries, and support requests
• Send order confirmations, invoices (PDF), delivery updates, and service notifications
• Process merchandise orders and handle returns or support issues
• Create and manage member accounts, including saved addresses and order history
• Review, approve, or reject hauler account applications and manage ongoing hauler relationships
• Review, approve, or reject commercial account applications and manage ongoing commercial account relationships, including recording payment methods for billing purposes
• Detect and prevent fraud, bot submissions, and abuse
• Understand which marketing channels drive traffic (via UTM attribution)
• Improve our website, services, and operations
• Comply with legal obligations and enforce our Terms of Service
• Send occasional marketing communications, which you may opt out of at any time via the unsubscribe link or by contacting us
• Review and process job applications

We do not use your data to train AI models, sell advertising, or engage in automated profiling that produces legal effects.

Sharing Your Information

CalStar does not sell, rent, or trade your personal information. We may share your data with:

• Payment processor (Stripe): When you make a purchase, your billing and card details are transmitted directly to Stripe, Inc. CalStar never receives or stores raw card numbers. See Stripe's privacy policy at stripe.com/privacy.
• Email delivery: We use SMTP-based email (configured in our admin settings) to send notifications. Message content and recipient addresses are transmitted to the configured mail server.
• Live chat (Tawk.to): Chat transcripts and visitor metadata are processed by Tawk.to. See the "Live Chat" section.
• Hosting & infrastructure: Our web host and database provider may have access to data stored on our servers in the course of providing hosting services. They are bound by data processing agreements.
• Legal authorities: When required by law, court order, subpoena, or to protect our rights and the safety of others
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred with appropriate prior notice

Cookies & Tracking

We use the following cookies and browser storage technologies:

• Session cookie: A server-side session identifier used to keep you logged in during your visit and to store temporary form data (e.g., CAPTCHA answers, flash messages). Deleted when you close your browser.
• Remember Me cookie: If you check "Remember Me" at login, a secure, randomly generated token is stored in a long-lived browser cookie (30 days) to keep you logged in across sessions. You can clear it by logging out.
• Guest cart (localStorage): If you browse our shop without logging in, your cart is saved in your browser's localStorage and is never transmitted to our servers until checkout.
• CSRF token: A session-based security token included in all forms to prevent cross-site request forgery. Not a tracking mechanism.
• Marketing attribution (session & cookie): UTM parameters and referrer data from your first and most recent visit are stored in your session and a short-lived cookie to help us understand traffic sources. This data is only used internally.
• Google Analytics: We may use Google Analytics to measure site traffic. Data is anonymized and aggregated. See Google's Privacy Policy. You can opt out via the Google Analytics Opt-out Browser Add-on.

You can control cookies through your browser settings. Disabling cookies will affect login persistence and some form functionality. We do not use advertising cookies or cross-site tracking cookies.

Payment Processing

Shop Purchases (Stripe)

All payment card transactions on our shop are processed by Stripe, Inc. When you enter card details on our checkout page, that information is submitted directly to Stripe's servers via Stripe.js - it never passes through or is stored on CalStar's servers.

CalStar receives only:

• A Stripe-generated payment intent or session ID
• Order status (paid / failed)
• The last four digits of the card and card brand (for display in order confirmation)
• Billing name and email as entered at checkout

Stripe is PCI DSS Level 1 certified. For details on how Stripe handles your payment data, see stripe.com/privacy.

Commercial Account Payment Records

For approved commercial accounts, authorized CalStar staff may record a customer's payment method details directly in our admin system for the purpose of processing recurring service invoices. This may include full credit card information or ACH/bank account details as provided and authorized by the commercial account holder. This information is:

• Accessible only to authorized CalStar staff with admin-level access
• Used exclusively for billing for services rendered under the commercial account
• Never sold, shared with third parties, or used for any other purpose
• Deleted upon account closure or upon a verified written request from an authorized account contact

If you are a commercial account holder and have questions about your stored payment information, contact us at .

Live Chat

Our website uses Tawk.to to provide live chat support. When you use the chat widget:

• Your messages and any name or email you provide in chat are stored on Tawk.to's servers
• Tawk.to may collect your IP address, browser type, and page URL for session context
• Chat transcripts may be reviewed by CalStar staff to improve support quality

Tawk.to's privacy policy is available at tawk.to/privacy-policy. If you prefer not to use the chat widget, you can contact us by phone or email instead.

Data Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• bcrypt password hashing - your password is never stored in plaintext
• Parameterized (prepared) SQL statements to prevent injection attacks
• CSRF tokens on all forms to prevent cross-site request forgery
• Honeypot fields and server-side rate limiting on all public forms to block automated submissions
• Math CAPTCHA challenges on public forms for non-authenticated users
• Uploaded documents stored outside the public web root where possible, with access restricted to authorized staff
• Regular security reviews and role-based access controls on the admin panel
• Restricted database access on a principle-of-least-privilege basis

No system is 100% secure. We will notify you as required by law if a breach affects your personal data.

Data Retention

We retain personal information for as long as necessary to provide services and comply with legal obligations:

• Order & payment records: 7 years (tax and legal compliance)
• Quote requests: 2 years
• Contact form submissions: 2 years
• Member accounts: Until deletion is requested by the account holder
• Saved addresses: Until removed by the member or the account is deleted
• Job applications: 1 year after the position is filled or closed
• Hauler account applications: Until the account is closed or deletion is requested; approved accounts may be retained for the duration of the business relationship plus 3 years
• Commercial account applications: Until the account is closed or deletion is requested; approved accounts may be retained for the duration of the business relationship plus 3 years
• Commercial account payment records: Retained with the commercial account; deleted upon account closure or upon a verified written request from an authorized account contact
• Uploaded verification documents: Same as the corresponding application retention period; deleted from our servers when the application is removed
• Live chat transcripts: Governed by Tawk.to's retention policy
• Marketing attribution data: Retained with the associated form submission record
• Web server logs: 90 days

Your Rights (CCPA / CPRA)

As a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we've collected about you, the sources, the purposes, and any third parties it was shared with
• Right to Delete: Request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention)
• Right to Correct: Request correction of inaccurate personal information we hold about you
• Right to Opt-Out of Sale: We do not sell personal data, so this right is not applicable, but you may still contact us with any concerns
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond providing the requested service
• Right to Non-Discrimination: We will not discriminate against you for exercising any of the above rights

To exercise your rights, email or call (888) 909-5556. We will respond within 45 days as required by law. We may need to verify your identity before processing a request.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it promptly.

Third-Party Services

Our website integrates the following third-party services, each with its own privacy practices:

• Stripe - Payment processing. Privacy Policy
• Tawk.to - Live chat support. Privacy Policy
• Google Maps - Embedded location maps. Privacy Policy
• Google Analytics - Anonymized site traffic measurement. Privacy Policy
• Docket / SurvCart - Online order processing for dumpster rental and waste services. When you place a service order, you may interact with an embedded order form provided by SurvCart. SurvCart collects the information you enter during the ordering process under their own privacy policy. SurvCart Privacy Policy

CalStar is not responsible for the privacy practices of third-party services. We encourage you to review their respective privacy policies before using those features.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we may also notify registered members by email. Continued use of our site after changes are posted constitutes your acceptance of the revised policy.

Contact Us

For privacy-related questions, access or deletion requests, or any other concerns:

• Email:
• Phone: (888) 909-5556
• Address: CalStar Services, 7550 Wheatland Ave., Sun Valley, CA 91352

We will respond to all verifiable privacy requests within 45 days. In complex cases we may extend this by an additional 45 days with prior notice.