Privacy Policy

Last updated: September 7, 2026

This Privacy Policy explains how Hey Cabas LLC ("Cabas," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our mobile application and website at heycabas.com (collectively, the "Platform").

Hey Cabas LLC is a Wyoming limited liability company. By using the Platform, you agree to the practices described in this policy.

1. INFORMATION WE COLLECT

Information You Provide

• Account information: Name, email address, phone number, and password when you create an account.

• Profile information: Avatar photo, specialty tags, and Instagram handle (optional).

• License information: State-issued professional license image and extracted data (name, license number, state, expiration date) for verification purposes. We extract text using optical character recognition and run automated checks. In states that publish official license rosters (currently Texas and Florida), we also check your license directly against official state records, and we store copies of those records on Cabas systems. Documents that cannot be read automatically are reviewed by a person. Braiders in states that do not license braiding are exempt from license upload. License verification is available state by state as Cabas launches. In some cases we grant provisional verification with a 14-day review window, during which you can book while we complete review.

• Government-issued ID and verification selfie: Photo of your driver's license, state-issued ID card, or passport, plus a live selfie, collected during identity verification. We extract your name, date of birth, ID expiration date, and ID type using optical character recognition. Your selfie is compared to the photo on your ID using an automated face comparison service to confirm you are the person on the ID (see Section 8). Your ID number is stored in hashed (encrypted, non-reversible) form for duplicate account detection. The ID image and selfie are stored encrypted in our secure storage system.

• Listing information: Suite photos, address, description, amenity tags, equipment tags, content tags, pricing, operating hours, access method details, and any exterior camera disclosures (Owners). Owners may disclose exterior security cameras on their listings; in-suite recording is prohibited on the Platform.

• Payment information: Processed and stored by Stripe. Cabas does not directly store your credit card numbers, bank account numbers, or other financial account details. When you book as a Pro, your payment card is saved to a Stripe customer profile so it can be charged for booking payments and for the merchant-initiated charges described in Section 2. Membership subscriptions are billed through the Apple App Store or Google Play via RevenueCat, not through Stripe.

• Communications: Messages sent through the in-app messaging system. Messages are scanned automatically for policy violations, including attempts to share contact details; flagged content is stored for human review (see Section 3).

• Reviews: Ratings, comments, and preset tags you submit about other users.

• Claims: Damage claim descriptions, categories, and supporting photos.

• Support requests: Content of any communications you send to support@heycabas.com, legal@heycabas.com, privacy@heycabas.com, or accessibility@heycabas.com.

• In-app feedback: Feedback you submit through the app, including the feedback type (idea, bug, love, or frustration) and your message.

• Reports: In-app reports you submit about listings, users, or bookings, including the reason and description you provide.

• Waitlist information: If Cabas is not yet live in your state, you can join the waitlist. We collect your email address, your city or state, and your role so we can notify you when Cabas launches in your area.

• Third-party sign-in information: If you create or access your account using a third-party sign-in service such as Google or Apple, we receive basic account information from that provider, including your name, email address, and an account identifier, which we use to create and maintain your Cabas account. The provider also knows that you sign in to Cabas. The provider's handling of your data on its side is governed by the provider's own privacy policy.

• Menu content: If you are a Pro who builds a Menu, we collect the style photos you upload, the style names you select, your "starting at" prices, and approximate durations. Menu photos may depict other people, such as your clients; see Section 1A for how content depicting other people is handled.

• Inner Circle information: Invite code used, acceptance timestamp, and device information at the time of joining (Inner Circle Owners).

• Portfolio and gallery: Photos of your work that you upload to your profile (Pros).

• Terms consent: Timestamp of when you agreed to the Terms of Service and Privacy Policy during account creation.

• Safety reports: Content of any safety reports you submit about suites on the Platform, including descriptions, photos, and supporting evidence.

• Insurance certificate (optional): Certificate of insurance (COI) uploaded by Pros and Owners who choose to verify their insurance status. We extract insurer name, policy number, coverage type, coverage limits, and expiration date using optical character recognition. Uploading insurance documentation is optional and results in a visible 'Insured' badge on your profile.

• State acknowledgment records: When you review and acknowledge state-specific legal disclosures during account setup, we record your user ID, role, state, the version of the acknowledgment you reviewed, the timestamp of your acknowledgment, and your IP address at the time of acknowledgment. This data is retained as a legal compliance record.

• Named space information: Studio or salon name, cover photo, and description created by Owners as part of listing setup. The named space aggregates all suites listed by an Owner at the same address.

• Referral and attribution data: Your unique referral code (system-generated or customized by you), the date you last customized your code, referral relationships (who referred whom), the source URL of each referral, and the date of each referral. When you share a listing, shop, or Pro profile using the share feature, your referral code is automatically embedded in the shared URL.

• Deferred deep link data: If you visit a listing, shop, or Pro profile on the Cabas website and then download the mobile app, a temporary link token may be stored in your browser's local storage to direct you to the correct content when you first open the app. This token contains: the destination URL, a referral code (if applicable), and an expiration timestamp. The token is deleted after use or upon expiration (24 hours). Cabas does not retain deferred deep link tokens on its servers beyond the expiration window.

• Demand and trend indicator data: Cabas computes demand indicators (such as 'Hot,' 'Best Value,' 'New,' 'Pro Favorite,' and 'Trending') for listings and Pro indicators for professional profiles using aggregated booking data, review data, and listing characteristics. These indicators are stored on the listing and profile records and are visible to all users.

• Fair market pricing data: Cabas collects and analyzes booking rates across the Platform by state to establish fair market pricing guidance ranges. This analysis uses aggregated, anonymized booking data and does not involve individual user profiles or personally identifiable information. Pricing ranges are computed at the state level and may include metro-area overrides where sufficient transaction data exists.

• Amenity scoring data: When an Owner creates or edits a listing, the amenities they select are scored using a point-based system that assigns values based on the listing's primary service type. We store the earned points, maximum possible points, normalized score (0 to 100), and resulting tier (Tier 1, Tier 2, or Tier 3) on the listing record. This data is used to provide pricing guidance and is visible to the Owner. The normalized score and tier are also visible to Pros browsing listings.

• Space type classification: Each listing is classified by the Owner as either a Chair/Booth or a Private Suite. This classification is stored on the listing record and is visible to all users browsing the Platform.

• Account status records: If your account is paused or deactivated as a result of a verification discrepancy, license expiration, or policy violation, we store the reason for the status change, the date it was initiated, the cure deadline (if applicable), the date it was resolved, and any related correspondence.

• Client account and appointment information: If you book appointments as a Client, we collect your name, phone number, email address, the appointments you book (Pro, style, add-ons, time, price, deposit, and the cancellation policy shown to you), your payment method token and the last four digits of your card (the card itself is held by Stripe), any late-arrival notice you send, and any review you leave. Cabas does not collect answers to consultation questions; anything you tell a Pro in a thread is a message under Communications above.

• Pro workspace information: If you are a Pro who takes Clients at your own workspace, we collect that address and any access note you add. The city and neighborhood are shown to Clients; the exact address and access note are shown only to a Client with a confirmed appointment, on the day of the appointment.

• Private notes about Clients: A Pro may write private notes about a Client. These notes are the Pro's, are never shown to the Client, are not used by Cabas for any purpose other than storing them for the Pro, and are deleted when the Pro's account is deleted.

Information We Collect Automatically

• Device information: Device type, operating system, app version, unique device identifiers, and browser type.

• Usage data: Pages viewed, features used, actions taken, timestamps, session duration, and interaction patterns.

• Location data: Approximate location based on IP address. Precise GPS location only when you explicitly use the "Near me" search feature, and only while the feature is active. We do not track your location in the background.

• Check-in and check-out data: Timestamps, photos, and geolocation metadata (EXIF data) captured with your device camera during the booking check-in and check-out process. Check-in and check-out photos are required for bookings, are stored privately, are visible to the Owner of the suite, and are used for booking verification and as evidence in damage claims.

• Access code data: Records of when door codes were generated, delivered, used, and expired. Smart lock access logs may include location data associated with lock events.

• Performance data: Crash reports, error logs, and diagnostic information to improve app stability.

• Notification interaction data: Whether notifications (including booking reminders and Inner Circle good standing notices) were delivered, opened, or dismissed.

• Unauthenticated browsing data: If you browse the Platform without creating an account, you can view public listing information and public Pro and Owner profiles (see Section 4 for what those profiles include, such as display names, avatar photos, verification status, and computed integrity and reliability scores). We collect standard device and usage information from unauthenticated visitors (device type, browser type, pages viewed, session duration, and general geographic location derived from IP address) through standard server logs. No user account is created as a result of unauthenticated browsing.

Information from Third Parties

• Stripe: Payment confirmation, payout status, account verification status, and chargeback notifications.

• Seam: Smart lock connection status, access code usage logs, lock health data, battery levels, and connectivity status.

• AWS Textract: License images, government-issued ID images, and insurance certificates are processed by AWS Textract for optical character recognition. Textract extracts text from the documents and returns the extracted text to Cabas.

• AWS face comparison service: During identity verification, your government ID photo and live selfie are processed by an automated AWS face comparison service, which returns a result indicating whether the selfie matches the photo on the ID. See Section 8 for details.

• Official state license records: In states that publish professional license rosters (currently Texas, through the Texas Department of Licensing and Regulation, and Florida, through the Florida Department of Business and Professional Regulation), Cabas checks your license directly against those official records and stores copies of the relevant records on Cabas systems for verification and re-verification.

• Twilio: SMS delivery status and phone number validation.

• RevenueCat: Subscription status, purchase receipts, trial eligibility, and customer identifiers for managing membership subscriptions billed through the app stores.

1A. MENU PHOTOS AND PERSONS WHO ARE NOT CABAS USERS

Photos that depict other people. The Menu feature lets a Pro publish photos of their real work, and those photos frequently depict their clients, who may not be Cabas users. This content is uploaded by the Pro, who is required to confirm, for every photo set, that they have the informed consent of every identifiable person depicted, covering display on the Platform and the licensed uses described in the Terms of Service, including share cards and Cabas marketing materials. Cabas hosts and displays this content on the Pro's public Menu, renders it into share cards designed to be shared off-Platform, and may feature it in marketing, all under the license granted by the Pro.

If you appear in a photo on Cabas. Whether or not you have a Cabas account, if you appear in a Menu photo you may report it through the report option on the photo or by contacting privacy@heycabas.com. Reported photo sets are unpublished immediately pending review when the report includes a way for Cabas to reach you; reports submitted without contact information are reviewed promptly but are not automatically unpublished. If review confirms the report, the content is removed. Removed content is deleted from public display promptly and from our systems in the ordinary course of our retention practices described in Section 5.

Other information about non-users. Cabas holds limited information about people who do not have accounts: waitlist entries (email address, state or city, and role, provided by the person joining the waitlist) and content uploaded by users that may depict or reference other people. If you are not a Cabas user and want information we hold about you deleted, contact privacy@heycabas.com and we will honor your request consistent with applicable law and the retention practices in Section 5.

2. HOW WE USE YOUR INFORMATION

We collect and process your information only as reasonably necessary and proportionate for providing and maintaining the services you requested through the Platform. Specifically, we use your information to:

• Create and manage your account

• Verify the identity of Pros before booking through government ID analysis and automated face comparison of your live selfie to your ID photo, including name matching, age verification (18 or older), and duplicate account detection using hashed ID numbers (see Section 8)

• Verify your professional license using optical character recognition, automated checks, and, in states that publish official license rosters (currently Texas and Florida), direct checks against official state records stored on Cabas systems; documents that cannot be verified automatically are reviewed by a person

• Monitor professional license expiration dates, send automated renewal notices, and mark licenses as expired when they lapse, which affects booking eligibility until the license is renewed

• Facilitate bookings between Pros and Owners

• Process booking payments and Owner payouts through Stripe

• Operate Client appointments: process deposits and balances, apply the cancellation policy you were shown, deliver reminders and day-of details, run the no-show and contest process, and settle the Pro's payout

• Operate Chair Money for Pros who use it: identify held Client funds that cover a suite booking, settle the booking the day before it starts, and charge the card of record for any shortfall, as described in the Terms of Service

• Show Pros aggregate Menu activity: count views of a Pro's Menu and contacts made through it, and show the Pro totals for a period, without identifying any viewer

• Plan supply: when a Pro searches for a suite and none is available for the time needed, record that a search went unmet (the time window and the area) so Cabas can recruit Owners where they are needed; the record contains no personal information

• Saved card and merchant-initiated charges: When you book as a Pro, your payment card is saved to a Stripe customer profile. By saving your card and booking a suite, you authorize Cabas, through Stripe, to charge your saved card without you being present in the app at the time of the charge for: (1) booking extensions you request, (2) overtime billed under the published overtime schedule, and (3) approved damage claim amounts captured against the incidentals hold.

• Overtime billing: If you stay past your booking end time, a 15-minute grace period applies. After the grace period, overtime is billed at 25% of the suite's hourly rate for each 15-minute block. Overtime is charged automatically only up to 2 hours or $60, whichever comes first. Amounts beyond those caps are reviewed by our team rather than charged automatically.

• Booking extensions: Extensions are requested by the Pro and charged to the saved card off-session. Each extension carries its own service fee.

• Incidentals hold: A $50 hold is authorized on your card at booking. The Owner has 24 hours after checkout to file a damage claim, capped at the hold amount. The hold releases automatically 24 hours after checkout if no claim is pending. If a claim is pending, the hold remains in place until the claim is resolved. Card networks may also expire authorizations on their own schedule.

• Memberships: Membership subscriptions are billed through the Apple App Store or Google Play via RevenueCat, not through Stripe. The applicable app store's billing terms govern those charges.

• Cancellations and refunds: We process refunds based on who cancels and when. If an Owner cancels a booking, the Pro receives a 100% refund in all cases. If a Pro cancels a booking that is still pending, the refund is 100%. If a Pro cancels a confirmed booking 24 hours or more before the start time, the refund is 100%. If a Pro cancels a confirmed booking less than 24 hours before the start time, 50% of the booking payment is refunded and the remaining 50% is retained.

• Taxes: Cabas does not collect or remit taxes on your behalf. You are responsible for determining, reporting, and paying any taxes that apply to your earnings or spending on the Platform.

• Generate and deliver temporary access codes for smart locks, and deliver Owner-provided keypad codes for suites that use them

• Display your public profile to other users and to visitors browsing without an account

• Calculate and display integrity scores (Pros), reliability scores (Owners), and reputation milestones using automated systems

• Process damage claims and dispute resolution, using check-in and check-out photos and claim evidence

• Scan messages automatically for policy violations, including attempts to share contact details, and store flagged content for human review

• Process no-show flags on bookings and review flagged no-shows, which may affect account standing

• Send booking confirmations, reminders, access codes, and platform notifications

• Administer the Myre Caroline Ambassador Program (referral tracking and rewards)

• Detect, prevent, and address fraud, abuse, and violations of our Terms of Service

• Enforce our Terms of Service and protect the safety and security of our users and the Platform

• Improve the Platform through aggregated, anonymized usage analysis, including de-identified and aggregated analysis of Menu pricing and duration information to produce market intelligence such as typical prices and durations for styles by area, as described in the Terms of Service

• Communicate with you about your account, bookings, and platform updates

• Review in-app feedback and reports you submit and take action where appropriate

• Operate the launch waitlist for states where Cabas is not yet live, using the email, location, and role you provide

• Comply with legal obligations, respond to legal process, and cooperate with law enforcement

• Monitor Inner Circle Owner account activity and send automated good standing notices at 60 days, 90 days, and 120 days of inactivity as required by the Inner Circle Program terms

• Administer the Inner Circle Program, including tracking eligibility, good standing status, and commission rate adjustments

• Review user safety reports and take voluntary action on reported hazards

• Provide automated notices for Terms of Service changes, fee structure changes, Ambassador Program changes, and Inner Circle Program changes as required by the applicable notice periods

• Display an 'Insured' badge on the profiles of users who upload valid insurance documentation

• Record and store state-specific legal acknowledgments as compliance records

• Re-verification: We may use your previously submitted license information (license number, licensee name, state of issuance, license type) to periodically re-check your license status against official state records in states that publish them. This processing is necessary to maintain the integrity and safety of the marketplace.

• Referral tracking: We use referral codes and attribution data to track the success of user referrals for the Myre Caroline Ambassador Program. Referral data is used to calculate ambassador tier status, referral credits, and program eligibility. Referral tracking does not involve monitoring your browsing activity or sharing your personal information with the referred user beyond your first name (displayed in the warm intro banner when a referred user arrives via your link).

• Demand indicator computation: We use aggregated booking volume, booking frequency, review ratings, listing age, repeat booking rates, and pricing competitiveness to compute demand and trend indicators for listings and Pro profiles. This computation uses anonymized data and does not involve manual review of individual user activity.

• Fair market pricing computation: We analyze booking rates by state to establish pricing guidance ranges. This computation uses aggregated, anonymized rate data from completed bookings and does not involve individual user profiles.

• Milestones and recognitions: We compute milestones, badges, and similar recognitions from your activity on the Platform (such as completed bookings and reviews). Recognitions are informational, have no monetary value, and may be recalculated or removed as described in the Terms of Service.

We do not use your personal information for purposes beyond those listed above without providing additional notice and obtaining your consent where required by applicable law.

Data Minimization: Cabas collects only the personal information reasonably necessary to provide the services described in this policy. We do not collect data for purposes unrelated to Platform operations. We periodically review the data we retain and delete information that is no longer necessary for the purposes for which it was collected. When possible, we use anonymized or aggregated data rather than personally identifiable information for analytics and platform improvement.

Third-Party Analytics: Cabas may use analytics services to understand how users interact with the Platform and to improve Platform performance and user experience. If analytics services are implemented, they may collect anonymized or pseudonymized usage data including pages viewed, features used, session duration, device type, and general location. Cabas will update this section to identify any analytics providers before they are activated. Cabas will not implement any analytics service that shares personally identifiable information with third parties for advertising or cross-context behavioral tracking purposes. Any analytics data collected is used solely for Platform improvement, performance monitoring, and aggregate reporting.

3. AUTOMATED DECISION-MAKING

Cabas uses automated systems to support certain platform functions:

• Identity verification face comparison: During identity verification, an automated AWS service compares your live selfie to the photo on your government ID and returns a match result. Automated checks also confirm that the name on your ID matches your account and that you are at least 18. If the automated checks cannot verify you, you may be asked to retry or your case is reviewed by a person. See Section 8.

• Integrity score calculation: Pro integrity scores are computed algorithmically based on booking completion rate, review ratings, claim history, cancellation rate, and overall platform behavior. This score affects your profile visibility, tier status, and access to certain features such as premium listings.

• Reliability score calculation: Owner reliability scores are computed algorithmically from booking and platform behavior and are displayed on the Owner's public profile.

• Listing quality scoring: New listings receive an automated quality score that affects search visibility. A complete listing goes live without a Cabas review before publication; reported listings are reviewed after the fact.

• Overtime auto-billing: Overtime after the 15-minute grace period is detected and charged automatically to your saved card under the published schedule (25% of the hourly rate per 15-minute block), up to 2 hours or $60. Amounts beyond those caps are reviewed by our team instead of being charged automatically.

• Message moderation: Messages are scanned automatically for policy violations, including attempts to share contact details. Flagged content is stored and reviewed by a person before enforcement action is taken.

• No-show flagging: A booking may be flagged as a no-show. Flags are recorded on the account and reviewed, and repeated no-shows may trigger account review or suspension.

• Fraud detection: We use automated tools to detect suspicious patterns in bookings, referrals, claims, and account creation.

• Inner Circle good standing monitoring: An automated system monitors Inner Circle Owner booking activity. Automated notices are sent at 60 days and 90 days of inactivity. If inactivity reaches 120 days (including the 30-day cure period), the system automatically adjusts the Owner's commission rate from 8% to 12%. All automated notices are timestamped and stored as part of your account record.

• Algorithmic ranking: Cabas uses automated systems to rank, sort, filter, and display listings and Pros. Ranking considers factors including location, pricing, availability, ratings, reviews, and platform activity. Ranking does not constitute an endorsement or certification.

• Safety report processing: Safety reports submitted by users may be prioritized and routed using automated systems based on the severity and content of the report.

• Client appointment automations: A no-show mark becomes final if it is not contested within 24 hours; a balance is charged to the card on file when a Pro marks an appointment done; a suite booking that is never checked in is closed after its window ends; a Chair Money booking is settled the day before it starts. Each has a human path: the contest process for no-shows, a payment link and support for a failed balance, the dispute process for closures, and support for any settlement question. None of these actions is a decision about your eligibility for anything outside the Platform.

• Consent before capture: Your consent to the face comparison is recorded before your ID and selfie are captured, and the comparison result is used only as described in Section 8. No automated system on the Platform uses a characteristic protected by law, and none is designed to discriminate against or manipulate any user.

You may request information about how automated decisions affect your account by contacting support@heycabas.com. If you believe an automated decision has adversely affected you, you may request a human review by contacting the same address.

For Inner Circle commission rate changes, no-show determinations, overtime charges, and algorithmic ranking decisions that you believe have adversely affected your account, you may request a human review by contacting support@heycabas.com within 14 days of the automated action.

Artificial Intelligence and Automated Processing Technologies: Cabas uses automated processing and artificial intelligence technologies in the following areas: optical character recognition for license, ID, and insurance document text extraction; automated face comparison for identity verification; algorithmic calculation of integrity scores, reliability scores, and listing quality scores; automated message scanning for policy violations; automated overtime detection and billing under the published overtime schedule; automated processing of no-show flags; automated Inner Circle good standing monitoring; algorithmic ranking of listings and search results; automated fraud and review manipulation detection; automated safety report routing and prioritization; state-level fair market pricing range computation based on aggregated booking data; amenity point scoring and tier computation based on service-type weighted amenity values; demand and trend indicator computation for listings and Pro profiles; license expiration monitoring and automated license status updates; license checks against official state records in states that publish them; deferred deep link resolution for cross-platform continuity; referral code attribution tracking; and automated notification scheduling and delivery. These systems process personal data to make or support decisions that affect your account, visibility, and access to Platform features. No automated system used by Cabas makes final decisions about account termination without the option of human review. You have the right to request information about how these automated systems affect your account and to request human review of automated decisions as described earlier in this section.

4. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We have never sold personal information and we will never sell personal information. Cabas does not sell personal information as defined by the California Consumer Privacy Act, the California Privacy Rights Act, the Texas Data Privacy and Security Act, the Florida Digital Bill of Rights, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, or any other applicable state privacy law. Cabas does not share personal information with data brokers, data aggregators, or data resellers. Cabas does not share personal information for cross-context behavioral advertising, targeted advertising, or profiling for advertising purposes. We do not share personal information for any purpose other than those expressly described in this policy.

We share your information only in these circumstances:

With Other Users

• Public profiles (visible to anyone, including visitors without an account): Pro public profiles show display name, avatar photo, specialties, license verification status, and integrity score. Owner public profiles show display name, avatar photo, verification badges, reliability score, member-since date, and locations with suite counts. Integrity and reliability scores are computed from your platform behavior, as described in Section 3.

• Pros can see: Owner public profile details, listing details, listing photos, and Owner reviews. The full suite address, including suite number, is visible only after a booking is confirmed. Publicly displayed map locations are intentionally imprecise (offset by about half a kilometer) to protect exact addresses.

• Owners can see: Pro public profile details, Pro member status, Pro reviews, and the check-in and check-out photos taken during bookings at their suites. Check-in and check-out photos are otherwise private and are used as evidence in damage claims.

• Reviews: Reviews are submitted blind. A review becomes visible when both sides have submitted their reviews or 48 hours after the review window opens, whichever comes first. Once visible, preset tags and written review text are public.

• Neither side sees: Email addresses, phone numbers, financial information, or license and ID images.

• Between a Client and a Pro: A Pro can see a Client's first name, the appointment details, the Client's late-arrival notices, thread messages, any review the Client leaves, and, on the day of the appointment, the phone number the Client used for it. A Client can see the Pro's public Menu, display name, city, and neighborhood, and, on the day of an appointment at the Pro's own workspace, the exact address and access note. Neither side sees the other's card or bank information, and a Client never sees a Pro's private notes.

• Aggregate counts: Pros see totals of Menu views and contacts over a period. Individual viewers are not identified in those totals.

• Blocking: You can block another user at any time. Blocking silently stops message delivery between you; the blocked user is not notified.

With Service Providers

We share information with third-party service providers who perform services on our behalf:

Each provider is contractually required to protect your data, use it only for the purpose of providing their service to Cabas, and comply with applicable data protection laws. In states that publish official license rosters (currently Texas and Florida), Cabas checks licenses directly against the official state records rather than through a third-party verification vendor, and stores copies of the relevant records on Cabas systems.

For Legal Reasons

We may disclose your information if required by law, valid subpoena, court order, or legal process, or if we reasonably believe disclosure is necessary to:

• Comply with applicable law or respond to valid legal process

• Protect the rights, safety, or property of Cabas, our users, or the public

• Detect, prevent, or address fraud, security issues, or technical problems

• Enforce our Terms of Service

When compelled by valid legal process (including subpoenas, court orders, search warrants, or national security letters), Cabas may provide the following categories of data to law enforcement or government agencies:

• Account registration information (name, email address, phone number, role, account creation date)

• Booking history with dates, times, and locations

• Transaction records and payment amounts (Cabas does not hold full payment card numbers or bank account numbers, which are held by Stripe)

• Access code activation and usage logs with timestamps

• IP addresses and device identifiers associated with account activity and login sessions

• Messages sent through the Platform messaging system, including content flagged by automated moderation

• Check-in and check-out photos and associated timestamps and geolocation metadata

• Location data associated with bookings and the "Near me" search feature

• Integrity and reliability score history and platform behavior records

• Safety reports submitted or received

Cabas does not voluntarily provide user data to law enforcement absent valid legal process, except in cases involving an imminent threat to life or physical safety where immediate disclosure is necessary to prevent serious harm.

When legally permitted, Cabas will notify the affected user before disclosing their data to law enforcement and will provide a copy of the legal process requiring disclosure. Cabas will not provide such notification if prohibited by law, court order, or if notification would jeopardize an ongoing investigation as determined by the requesting authority.

In a Business Transfer

If Cabas is acquired, merged, reorganized, or sells substantially all of its assets, your information may be transferred to the acquiring entity. We will notify you via email or prominent notice on the Platform before your information is transferred and becomes subject to a different privacy policy. You will have the opportunity to delete your account before any such transfer.

Third-Party Provider Data Breaches

Cabas relies on third-party service providers to process and store certain categories of user data as described in this section. In the event of a data breach at a third-party provider, Cabas will cooperate with the affected provider to notify impacted users as required by applicable law.

Cabas is not responsible for the security practices, data breaches, or data handling failures of its third-party service providers. Each provider's own privacy policy and security commitments govern the data they process. Cabas does not guarantee the security of data held by third-party providers.

If Cabas becomes aware of a third-party provider breach that may have affected your data, we will notify you within the timeframe required by applicable state data breach notification laws and will provide information about which provider was affected and what categories of data may have been compromised.

5. DATA RETENTION

We retain your personal information for as long as your account is active or as needed to provide services, comply with legal obligations, resolve disputes, and enforce our agreements.

When you delete your account:

• Your profile and personal information are permanently deleted within 30 days.

• Your booking history is anonymized (your name and identifying details are removed, but anonymized booking records are retained for platform analytics and financial reporting as required by law).

• Your license image is permanently deleted.

• Your government ID image and identity verification selfie are permanently deleted.

• Your check-in and check-out photos are permanently deleted.

• Your messages are deleted from your account but may remain visible to the other party in their conversation history for up to 90 days before automatic deletion. Messages flagged by automated moderation may be retained longer as enforcement and legal compliance records.

• Your reviews remain on the Platform but are attributed to "Former User."

• Any pending claims or disputes are resolved before deletion is processed.

• Payment records are retained for the period required by applicable tax and financial reporting laws (typically 7 years), after which they are permanently deleted.

• Your portfolio photos are permanently deleted.

• Your Inner Circle membership status and commission rate history are retained for financial audit purposes for 7 years, then permanently deleted.

• Automated notice records (Inner Circle good standing notices, Terms change notices, fee change notices) are retained for 7 years as legal compliance records.

• Safety reports you submitted are retained in anonymized form for platform safety analysis.

• Account status records: Records of account pauses, deactivations, cure period outcomes, and related correspondence are retained for 7 years as legal compliance records.

• Deferred deep link tokens: Tokens are stored in browser local storage for a maximum of 24 hours and are deleted after use or upon expiration. No server-side retention beyond the expiration window.

• Referral relationship records: Referral attribution data (referrer code, referred user ID, referral date, source URL) is retained for the life of both accounts for ambassador program calculations. If either account is deleted, the referral record is anonymized (referrer code retained, user ID removed).

• Demand indicator history: Historical demand indicator values are not retained. Only the current indicator values are stored on the listing record. Previous values are overwritten when indicators are recomputed.

• Check-in and checkout evidence: Check-in and checkout photos and other presence evidence for a suite booking are deleted 180 days after the booking ends, unless a claim or dispute that relies on them is still open.

• Client appointment records and threads: Appointment records are retained while your account is open and for the period needed for tax, dispute, and legal purposes after an appointment. A thread survives the deletion of its appointment and is deleted with your account.

• Notification delivery records: Records of individual notification deliveries are kept 30 days for suppressed or undeliverable attempts and 90 days for delivered ones, then deleted.

Legal Retention Requirements: Certain data must be retained after account deletion to comply with legal obligations regardless of your deletion request. Tax-related payment records are retained for 7 years as required by federal tax law (26 U.S.C. 6501). Records related to active or anticipated fraud investigations are retained for 3 years after the investigation concludes. Data subject to a legal hold in connection with pending or anticipated litigation is retained until the hold is released by legal counsel. Safety reports are retained in anonymized form indefinitely for platform safety analysis. Automated notice records (Inner Circle good standing notices, Terms of Service change notices, fee change notices) are retained for 7 years as legal compliance records. Data that has been aggregated and anonymized such that it can no longer reasonably identify you is not considered personal data under applicable law and may be retained indefinitely for analytics, research, and platform improvement.

Government ID images and identity verification selfies are not stored when automated verification passes or fails; they are processed in memory and discarded. When a submission needs a human review, the ID front and selfie are held in a private, access-restricted store solely for that review and are deleted the moment the review is decided or your account is deleted, whichever comes first. ID number hashes are retained for the life of the account for duplicate detection purposes and are deleted when the account is deleted. Copies of official state license records used for verification are retained as part of your verification record while your account is active. Insurance COI data is retained until the policy expiration date passes or until the user removes it from their profile, whichever comes first. Expired insurance records are deleted 90 days after expiration. State acknowledgment records (user ID, role, state, version, timestamp, IP address) are retained for 7 years as legal compliance records, consistent with other compliance data retention.

6. DATA SECURITY

We implement industry-standard technical and organizational security measures to protect your information, including:

• Encryption in transit (TLS 1.2+) for all data transmitted between your device and our servers

• Encryption at rest for sensitive data stored in our database

• Row-Level Security (RLS) policies on every database table, ensuring users can only access data they are authorized to view

• Secure authentication tokens that expire and refresh automatically

• Access controls limiting which team members can access production data

• Regular security assessments of our infrastructure and third-party providers

• Secure deletion procedures for data that is no longer needed

• Safety Report Data: Safety reports are stored with restricted access. Only authorized Cabas personnel involved in safety review may access safety report content. Safety reports are not shared with the reported Owner unless Cabas determines, at its sole discretion, that sharing is necessary for remediation.

Personnel Access Controls: Cabas is operated by a small team. Access to user personal data is restricted to authorized personnel who require access to perform their job functions related to Platform operations, user support, safety review, or legal compliance. All personnel with access to user data are bound by written confidentiality obligations. As the Cabas team grows, we plan to expand these controls to include role-based access restrictions under the principle of least privilege, segregation of duties for sensitive operations such as financial data and account termination, access event logging with periodic audits, mandatory security training for all personnel with data access, and regular access reviews with revocation of unnecessary permissions.

No method of electronic storage or transmission is 100% secure. While we implement and maintain reasonable security measures consistent with industry standards, we cannot guarantee absolute security against all threats.

Data breach notification: In the event of a data breach that affects your personal information, we will notify you in accordance with applicable state and federal law. Where required, notification will be provided within the timeframe specified by the applicable state's breach notification statute (typically 30 to 72 days of discovery). Notification will include a description of the breach, the types of information affected, and steps you can take to protect yourself.

Limitation of Liability for Data Breaches: To the maximum extent permitted by applicable law, Cabas's liability for any data breach is limited to the notification obligations described in this policy, any credit monitoring or identity protection services we elect to provide, and any remediation required by applicable state and federal data breach laws. Cabas is not liable for consequential, incidental, or indirect damages arising from a data breach, including but not limited to identity theft, financial fraud, emotional distress, credit score impact, or reputational harm, except where such limitation is prohibited by applicable law. This limitation applies to breaches of Cabas's own systems and does not apply to breaches at third-party providers, which are governed by those providers' own terms and liability frameworks.

Compliance Commitment: If Cabas is notified of a potential privacy compliance deficiency by a regulatory authority, affected user, or through internal review, Cabas will make good faith efforts to investigate and cure the identified deficiency within 30 days of notification. This commitment applies to all applicable state and federal privacy laws and does not limit Cabas's obligations under any specific statute that requires a different cure period.

7. YOUR RIGHTS AND CHOICES

All Users

• Access: You can view your personal information through your profile settings at any time.

• Data export: You can request a copy of your personal information by emailing support@heycabas.com. We will provide it in a commonly used format within a reasonable time.

• Correction: You can update your profile information, name, and contact details through the app.

• Deletion: You can delete your account through the Profile settings. See Section 5 for what happens when you delete your account.

• Notification preferences: You can control which notifications you receive (push, email, SMS) through the Notification Settings page.

• Location: You can revoke location permissions through your device settings at any time. The "Near me" feature will not function without location permission.

• Automated decisions: You can request information about how automated systems affect your account, and request human review of automated decisions that adversely affect you, by contacting support@heycabas.com.

• Blocking: You can block another user at any time through the app. Blocking stops message delivery between you; the blocked user is not notified.

• Reviews: You can view reviews you have submitted and reviews you have received. You cannot edit a submitted review, but you can contact support@heycabas.com to request removal of a review that violates the review standards described in the Terms of Service.

• Portfolio: Pros can upload, reorder, and delete portfolio photos at any time through the app.

• Inner Circle status: Inner Circle Owners can view their current good standing status, commission rate, and activity history through the app.

• Safety reports: You can view safety reports you have submitted. You cannot retract a safety report after submission, but you can submit a follow-up clarification.

Response timeframe: We respond to all privacy rights requests within 30 days of receipt. If we need additional time (up to 30 additional days), we will notify you of the extension and the reason.

Universal Opt-Out Signals

Cabas does not sell personal information and does not share personal information for targeted advertising, so there is no sale or sharing for a universal opt-out signal to stop. The Platform does not currently detect or respond to Global Privacy Control (GPC) or Do Not Track (DNT) browser signals. If our practices change, or if applicable law requires us to process universal opt-out signals for our activities, we will implement the required handling and update this section.

State-Specific Rights

For all state privacy requests: We will verify your identity before processing your request. We do not charge a fee for processing privacy requests. If we deny your request, we will provide the reason and information about how to appeal.

8. IDENTITY VERIFICATION AND BIOMETRIC DATA

Pros are required to complete identity verification before booking. During verification, we collect a photo of your government-issued ID and a live selfie. An automated face comparison service operated by AWS compares your selfie to the photo on your ID to confirm that the person opening the account is the person on the ID. We also run automated checks that the name on your ID matches your account name and that you are at least 18 years old, and we store your ID number in hashed (non-reversible) form to detect duplicate accounts. Text on your ID is extracted using optical character recognition (AWS Textract).

Because the face comparison processes images of your face, it may be considered biometric processing under some state laws, including the Illinois Biometric Information Privacy Act (BIPA) and the Texas Capture or Use of Biometric Identifier Act (CUBI). We use the comparison result only to verify your identity and to protect the Platform against fraud and duplicate accounts. We do not use your face data for tracking, advertising, or any other purpose. We do not sell it, and we share the images only with the service provider that performs the comparison on our behalf.

By submitting your ID photo and selfie, you consent to this processing. When automated verification passes or fails, your ID image and selfie are processed in memory and are not stored; only the result, the extracted fields listed in Section 1, and the hashed ID number are kept. If your submission needs a human look, the ID front and the selfie are held in a private, access-restricted store solely for that review, are viewed by the reviewer through a short-lived link, and are deleted the moment the review is decided or your account is deleted, whichever comes first. If you do not want to submit these images, do not complete identity verification; you will not be able to book a suite without it.

9. CHILDREN'S PRIVACY

Cabas is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete that information promptly. If you believe a child under 18 has created an account, contact privacy@heycabas.com immediately.

10. COOKIES AND TRACKING

The Cabas mobile app does not use cookies. The heycabas.com website uses essential cookies and browser local storage for functionality such as session management, security, and the deferred deep link feature described in Section 1. These are necessary for the site to work and cannot be disabled.

We do not use marketing or advertising cookies, retargeting pixels, or third-party tracking technologies for advertising purposes. We do not participate in cross-site tracking or behavioral advertising networks. If we add analytics cookies in the future, we will update this section before they are activated.

11. PUSH NOTIFICATIONS AND SMS

We send push notifications for booking updates, payment activity, access codes, reviews, milestones, and ambassador program updates. You can manage your notification preferences in the app settings and in your device settings.

How push works: To deliver push notifications, we collect a push token issued by your device's operating system and share notification payloads with Firebase Cloud Messaging (Google), which delivers them to your device. Push tokens identify your device for notification delivery and are deleted or rotated when you sign out, disable notifications, or your operating system rotates them. Some notifications include action buttons that let you respond without opening the app; actions you confirm through a notification are recorded against your account the same way as actions taken inside the app.

Door access codes are delivered in the app and by SMS to your registered phone number. Some suites use a keypad code provided by the Owner rather than a code generated by Cabas; where that is the case, the Owner's code is delivered to you the same way. Access code delivery is a critical security notification that cannot be disabled. The code is required to enter the suite. Standard carrier messaging rates may apply.

We use Twilio to deliver SMS messages. Your phone number is shared with Twilio solely for the purpose of delivering these messages and is subject to Twilio's privacy policy.

Clients: For each appointment you book, Cabas may send you two text messages: a one-time code to confirm your phone when you book, and a reminder the day before. Everything else about your appointment arrives in the app, by push if you enable it, and by email. Cabas never sends marketing by text message. Reply STOP to any text to opt out; if you opt out, reminders reach you in the app and by email instead.

Pros: Text messages to Pros are limited to money and door events: a door code, a payment or payout event, and a Chair Money settlement notice. Everything else arrives in the app.

Session Mode and quiet hours: If you turn on Session Mode, non-critical notifications are held while you are in an active booking and delivered as one summary at checkout; the summary is itself a notification and is recorded as one. Quiet hours (10 PM to 8 AM by default, adjustable) hold non-critical notifications; door codes and money notifications are delivered regardless. Notifications about bookings, money, and identity cannot be turned off.

Cabas news: "Cabas news" is our growth channel: new suites near you, feature updates, and tips. It is off by default and is sent only if you turn it on. You may turn it off at any time. It is never sent by text message.

Realtime delivery: In-app notifications are delivered over a live connection while the app is open. This collects nothing beyond the notification itself.

Inner Circle Notifications: Inner Circle Owners receive email and in-app notifications related to their good standing status at 60 days and 90 days of inactivity, and a final notice at 120 days if the cure period is not fulfilled. These notifications cannot be disabled as they are required contractual notices under the Inner Circle Program terms.

Safety Report Notifications: If you submit a safety report, you may receive notifications regarding the status of your report. If a safety report is filed about your listing, you may receive a notification requesting information or action.

12. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites or services (such as Stripe's dashboard for payout management or Instagram for profile linking). We are not responsible for the privacy practices, security, or content of third-party sites. We encourage you to read the privacy policies of any third-party service you access through or in connection with the Platform.

13. INTERNATIONAL DATA

Cabas operates in the United States. All data is stored and processed in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Platform, you consent to this transfer and processing.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top

• Notify you through the app or via email at least 30 days before the changes take effect

• Provide a summary of the material changes

Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy. If you do not agree with the updated policy, you must stop using the Platform and may delete your account. Previous versions of this Privacy Policy are available upon request by contacting privacy@heycabas.com.

15. CONTACT US

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how we handle your data, contact us at:

Hey Cabas LLC
Privacy inquiries: privacy@heycabas.com
General support: support@heycabas.com
Legal inquiries: legal@heycabas.com
Accessibility: accessibility@heycabas.com
Entity: Wyoming Limited Liability Company

For privacy requests, please include your full name, the email address associated with your Cabas account, your state of residence, and a description of your request. We will respond within 30 days.

© 2026 Hey Cabas LLC. All rights reserved.