Data we collect, and why.

When Caboo sets up a Gateway, we collect the business name, website, category, location signals, approved services or products, public policy language, booking rules, contact details, install state, and public-site crawl results used to prefill setup.

We use this to draft the catalog, publish the agent-readable Gateway, keep it current, diagnose failures, and show audit evidence.

For signed-in users, we store account identity, workspace membership, notification preferences, billing state, audit events, and support-relevant settings.

Credentials and integration secrets are stored using the app's credential-encryption path and are not rendered back into the UI.

For Gateway profiles, we store customer-approved business facts, services or products, booking or checkout links, action-rail state, agent read events, booking or purchase intents, auth.md registration events, and evidence needed to attribute completed actions.

Write rails remain scoped per profile. Caboo does not claim an agent completed a booking or purchase unless a real backend rail and attribution evidence exist.

The Caboo connector reads public published business listings, services, policies, and open times. Connector tools do not accept buyer name, email, phone, payment credentials, or messaging consent.

When a buyer asks to hold a slot, Caboo stores an anonymous, short-lived booking hold, the selected service and slot, the generated confirmation URL, source attribution, and operational event data. Network identifiers may be hashed for rate limiting and abuse prevention. The buyer enters contact details only on Caboo's hosted confirmation page if they choose to confirm.

Public demo data, browser-observed answer captures, and operational logs follow bounded retention windows. Customer retention cleanup is controlled by production configuration and reviewed before broad customer rollout.

You can request deletion or export by contacting [email protected].

Caboo uses infrastructure and API providers to run the service, including hosting, database, email, billing, object storage, and AI provider APIs. Provider outputs may differ from consumer app experiences.

Billing is handled by Stripe. Transactional email is handled by Resend.

Questions, deletion requests, and privacy concerns go to [email protected].