Privacy Policy

This policy explains what Cauliflower ("we", "us") collects when you use https://www.usecauliflower.com and the Cauliflower service (the "Service"), how we use it, who we share it with and the choices you have. If you have a question, email us at [email protected].

Who this applies to

• Customers and their teammates: people who create an account, join a workspace or connect a calendar or other tool.
• Invitees and leads: people who book a meeting or fill in a form that a customer routes through Cauliflower. For this information, the customer whose form or booking page you used decides what is collected and why; we process it on their behalf. Contact that company first about their use of your information; we'll help them respond.
• Visitors to our website, documentation and blog.

Information we collect

Account information. Your name, email address, password (stored only as a salted hash), profile photo, time zone and the workspace you belong to. If you sign in with Google, we receive your name, email address and profile picture from Google.

Workspace content. What you and your teammates set up and do in the Service: booking links, availability, routers and routing rules, teams, meetings, leads, notes and settings.

Invitee and lead information. What people enter on booking pages and routed forms (such as name, email, company, phone and answers to questions), the meetings they book, and, when a workspace turns on enrichment, company and role details from the enrichment provider it connects.

Google user data. Only when you choose to connect Google Calendar or sign in with Google. See the next section.

Information from other tools you connect. When a workspace connects a CRM (HubSpot, Salesforce or Attio), Slack or an enrichment provider, we exchange the records needed for the features it turns on, such as looking up who owns an account or posting a new lead to a channel.

Usage and device information. Pages viewed, actions taken, browser type, IP address and approximate location derived from it, and error logs. We use this to run, secure and improve the Service.

Cookies. We use cookies that keep you signed in and remember preferences. If product analytics are turned on, we also use analytics cookies to understand how the Service is used. We don't use advertising cookies.

Google user data

If you connect Google Calendar or sign in with Google, Cauliflower asks Google for these permissions and uses them only as described here:

Permission	What we use it for
Basic profile and email (openid, email, profile)	Signing you in, matching the Google account to your Cauliflower account and, if you choose, using your Google photo as your profile picture.
See your calendars (calendar.readonly)	Listing your calendars so you can pick which ones block time, and reading free/busy times so booking pages only offer times when you're free. We read whether a time is busy, not the details of your other events.
Create and edit events (calendar.events)	Adding meetings booked through Cauliflower to the calendar you choose, with a video link if you ask for one; updating or removing them when they're rescheduled or cancelled; and noticing when you move or delete one of those events in Google Calendar so the booking stays in sync.

How we store and protect it. We store the OAuth tokens Google gives us, encrypted (AES-256-GCM), plus the names and IDs of your calendars and the IDs of events we create. We don't keep copies of your other calendar events.

Who sees it. Google user data is shown only to you and, for meetings booked through Cauliflower, to the people in your workspace who manage those meetings and to the invitee. We don't sell Google user data, use it for advertising, or share it with anyone except as needed to provide the features above, to comply with the law, or as part of a merger or acquisition with notice to you.

People. Our staff don't read your Google user data unless you ask us to (for example, for support), it's needed for security (such as investigating abuse), it's required by law, or it has been aggregated and anonymized for internal operations.

AI and machine learning. We don't use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

Limited Use. Cauliflower's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect Google Calendar at any time on the Availability page in Cauliflower, which deletes the stored tokens. You can also remove Cauliflower's access from your Google Account permissions.

How we use information

• To provide the Service: show availability, book and route meetings, send confirmations and reminders, sync with the tools you connect and run the features your workspace turns on.
• To keep it secure: authenticate people, prevent fraud and abuse, and investigate problems.
• To support you and to send service messages, such as security notices and changes to these terms.
• To understand and improve the Service, using usage information (not Google user data).
• To meet legal obligations and enforce our terms.

We don't sell personal information, and we don't use it for third-party advertising.

Who we share information with

• Your workspace. Admins of a workspace can see the workspace's content, including meetings and leads, and who has connected which tools.
• Service providers who host the Service, store data, deliver email, provide analytics or support, and, when a workspace uses the in-app AI assistant, process the questions and the workspace data needed to answer them. They act on our instructions and may use the data only to provide their services to us.
• Tools you connect. When you or your workspace connect a CRM, Slack, webhooks or an enrichment provider, we send them the information those features need.
• Legal and safety. When required by law, or to protect the rights, property or safety of Cauliflower, our users or others.
• Business transfers. If Cauliflower is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, with notice to you.

Security

We encrypt data in transit (TLS) and encrypt third-party credentials and OAuth tokens at rest. API keys are stored as hashes, access to production systems is limited to people who need it, and administrative actions are logged. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify you of a breach as the law requires.

How long we keep information

We keep account and workspace information while the account is active. When you delete your account, your profile, sign-ins, connected calendars and conversations are deleted right away; meetings you hosted in a workspace you shared keep a "Deleted user" as their host so your teammates' records stay complete. Remaining copies, such as backups, are deleted or anonymized within 30 days, except where we must keep it longer for legal, security or billing reasons. Backups roll off on a regular schedule. Disconnecting an integration deletes its stored credentials.

Your choices and rights

• Update your profile at any time in Settings.
• Disconnect Google Calendar and other tools whenever you like.
• Delete your account under Settings → Profile → Delete account. Workspace owners can delete a workspace, with everything in it, under Settings → Workspace.
• Ask us for a copy of your information, or to correct or delete it, by emailing [email protected].
• Depending on where you live (for example, in the European Economic Area, the United Kingdom or California), you may have further rights, such as to object to or restrict processing, or to data portability. We won't treat you differently for using them.

If you are an invitee or lead of one of our customers, please contact that customer; we'll support them in answering your request.

International transfers

We and our service providers may process information in countries other than yours. Where the law requires it, we use appropriate safeguards, such as standard contractual clauses, for these transfers.

Children

The Service is for businesses and isn't directed to children under 16. We don't knowingly collect information from them.

Changes to this policy

We'll post any changes on this page and update the date at the top. If a change is significant, we'll tell you by email or in the Service before it takes effect.

Contact

Questions or requests about privacy: [email protected].