Privacy Policy

Version 3.0 - last updated 1 October 2026

1. Who we are

CayBook Ltd. ("CayBook", "we", "us") runs the CayBook marketplace at caybook.com and in the CayBook apps. For the personal data described in this policy we are the data controller under the Cayman Islands Data Protection Act (2021 Revision) (the "DPA"). You can contact us about privacy at bookings@caybook.com.

Businesses and hosts that list on CayBook ("Providers") are separate companies. When a Provider receives your booking details, it uses them to provide your service and is responsible for how it handles them.

2. Who this policy covers

Customers and guests, people booked for as part of a party, business owners and their team members, cleaners and staff added by businesses, advertisers, and anyone who visits caybook.com or uses our apps.

3. What we collect

Information you give us

• Account: name, email, phone number, password (stored only as a secure hash), account type and role, and sign-in details from Google if you use Google sign-in.
• Bookings: what you booked, the dates and times, party size, prices, special requests and dietary notes, guest names for stays, and your booking history.
• Stays: guest details and residency declarations, and residency documents when you upload them to claim the resident exemption from Tourist Accommodation Tax.
• Payments: we receive the card brand, the last 4 digits, the payment status and transaction references from our payment processor. We never see or store your full card number or security code.
• Messages and support: messages between you and Providers, attachments, and support requests.
• Reviews: your ratings, review text, and reports you make about reviews.
• Gift cards: purchaser and recipient names, recipient email, your message, and gift card balances.
• Businesses: business name, address, contact details, services, prices, hours, photos, licence documents, payout details, and team members' names, roles and contact details.
• Staff and cleaners: names, contact details, schedules, time off, assigned jobs, job photos and checklists, entered by the business they work for.
• Advertisers: contact and billing details and ad content.

Information we collect automatically

• Security and technical data: IP address, browser and device type, timestamps, and sign-in and audit records.
• Usage data: pages viewed, searches and booking steps, collected only with your analytics consent (see the Cookies Policy).
• Attribution: which featured listing, ad or campaign link led to a booking, stored only with your marketing consent.
• App notifications: a device token, if you turn on notifications.

Location

We turn business and property addresses into map positions. We don't track your device's location.

Information from others

Providers may add booking details for you, for example a phone booking or an imported reservation. Someone booking for a party may give us your name. Google provides your name and email if you use Google sign-in.

4. How we use it and our legal basis

The DPA lets us process personal data only where a condition in Schedule 2 applies. Here is what we do and the basis for each:

We don't make decisions about you that are based solely on automated processing and have legal or similarly significant effects. We use automated checks to flag possible fraud or misuse, and a person reviews them before we take action on an account.

5. Who we share it with

We never sell your personal data.

• Providers you book with: your name, contact details, booking details, special requests and messages. For stays, the host may also see your residency declaration and documents.
• Service providers working for us, under contracts that require them to protect your data and use it only on our instructions:
  • Supabase: database, sign-in and file storage
  • Lovable: application hosting and error reporting
  • Resend: email delivery
  • PostHog: analytics (only with consent)
  • our payment processor: card payments and refunds
  • Apple and Google: app notifications and Google sign-in
  • OpenStreetMap (Nominatim): converting business addresses to map positions (business addresses only)
• Authorities: where the law requires it, for example tax, Tourist Accommodation Tax or law enforcement requests.
• Professional advisers and insurers, where needed.
• A buyer or successor if CayBook's business is sold or reorganised, under the same protections.

6. Public information

Your reviews appear publicly with the name given on the booking you reviewed. Business listings, business replies to reviews and ratings are public.

7. International transfers

Some of our service providers store or process data outside the Cayman Islands, including in the United States and the European Union. Where the destination doesn't have adequate protection, we put safeguards in place as the DPA requires, such as contractual clauses, and we choose providers with strong security. You can ask us for details of these safeguards.

8. How long we keep it

• Account: while your account is open. After you ask us to delete it, we wait 30 days in case you change your mind, then delete or anonymise it.
• Bookings and payment records: 7 years, for accounting and tax. After your account is deleted they no longer identify you.
• Messages: 2 years after the booking.
• Residency documents: deleted 90 days after your stay ends, unless needed for an open tax review.
• Business licence documents: while the listing is active, plus 2 years.
• Reviews: while the listing exists. They are anonymised when your account is deleted.
• Analytics events: 13 months.
• Security and audit logs: 2 years.
• Gift cards: until 7 years after the card expires or is used up.

9. Your rights under the DPA

You can:

• ask for a copy of your personal data and information about how we use it
• ask us to correct inaccurate data
• ask us to stop, or not start, processing your data where it causes, or is likely to cause, unwarranted substantial damage or distress
• ask us to stop using your data for direct marketing, at any time
• ask us to delete your data, where we no longer have a lawful reason to keep it
• object to decisions based solely on automated processing
• withdraw consent at any time, without affecting earlier processing
• complain to the Ombudsman.

Signed-in users can download their data and delete their account from My data & privacy. Anyone can make a request on Your privacy choices or by emailing bookings@caybook.com. We may ask you to confirm your identity. We reply within 30 days and don't charge for reasonable requests.

10. Security

We use encryption in transit (HTTPS) and at rest, row-level access controls so each person sees only their own data, least-privilege staff access, multi-factor authentication for staff, audit logging and ongoing monitoring. Card details are handled only by our payment processor. No system is completely secure, so keep your password private and tell us straight away if you think your account has been compromised.

11. Personal data breaches

If a personal data breach happens, we notify the Ombudsman and anyone affected without undue delay, and within the time the DPA requires (no later than 5 days after we become aware of it).

12. Children

You must be 18 or older to have an account. Children can be included in a booking made by a parent or guardian, who is responsible for the details they give us. We don't knowingly collect data directly from children.

13. Providers' own obligations

Providers must use customer data only to deliver and manage the booking, keep it secure, and not use it for unrelated marketing (see Terms for Providers).

14. Changes

We'll update the version and date above when this policy changes. If a change is significant, we'll email you before it takes effect.

15. Complaints and contact

Please contact us first at bookings@caybook.com. You also have the right to complain to the Cayman Islands Ombudsman: ombudsman.ky, info@ombudsman.ky, +1 (345) 946-6283.