My company is based in Florida, but I work in California. My company policy is that I only get overtime after 40 hours in a week because that is the law in Florida, is this legal?

No. It does not matter where the company is based. It does not matter where the company headquarters are. It does not matter what State the company is incorporated in. It does not matter if it is a foreign company. The only thing that matters is that if you work in California you are covered by the California Labor Code. All of it -- minimum wage, overtime, vacation pay, meal breaks. As such, you are entitled to overtime if you work more than 8 hours in a day, even if you do not work more than 40 hours in the week.

My company policy is that vacation pay must be used by the end of the year or it is lost. The company stays this is legal because it is based in Alabama. Which laws apply, California's or the State where my company is based out of?

If you work in California, you are covered by the California Labor Code. It does not matter where your company is "based" out of. As such, under California law, a "use it of lose it" policy is illegal. This is true even if you are the only employee in California and there are thousands elsewhere.