Last updated: July 6, 2026 Effective date: July 6, 2026
This Privacy Policy explains how Maine Provisions Inc., a Maine corporation doing business as Cabro ("Maine Provisions," "we," "us," or "our"), collects, uses, shares, and protects information in connection with Cabro, our vendor-ordering, inventory, and order-guide application (the "Service").
Cabro is a business-to-business service. We collect only what we need to operate the Service for you. We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not run advertising trackers.
If you have questions, email hello@cabroapp.com.
Maine Provisions Inc. (DBA Cabro), 363 Main Street, Kingfield, Maine 04947, United States, is the operator of Cabro. For business account data you and your users put into the Service ("Customer Data"), your business is the data controller and we act as a service provider / processor on its behalf, as described in our Terms of Service.
Account information. When you register, we collect your name, business name, email address, password (stored only in hashed/encrypted form), and optionally a phone number. We collect the names and email addresses of additional users you authorize.
Business and operational data (Customer Data). To provide the Service, we store and process the data you and your users enter or generate, including: vendor and supplier information; product, SKU, and pricing data; inventory counts and par levels; order data and order history; short voice recordings and their transcriptions when you use voice input for counting or ordering; the messages you send our in-app assistant; and documents and invoices you upload. This includes invoices and related emails that you or your vendors send, forward, or copy to your Cabro invoice address (for example, yourname.invoices@cabroapp.com) If you connect a point-of-sale system, we also process the POS data needed for food-cost features: menu items, sales totals, order/check records with timestamps, product mappings, and the POS admin contact you provide. (which may contain vendor pricing, line items, and similar business information).
Billing information. When you subscribe, we and our payment processor Stripe collect your billing name, billing address, email, and a record of your subscription, charges, and payment history. Payment card details are collected and processed entirely by Stripe — we never see or store your full card number.
Usage and device data. When you use the Service, we automatically collect standard technical information such as IP address, browser or device type, operating system, app version, pages or screens viewed, actions taken, timestamps, and diagnostic/log and crash data. We use this to operate, secure, troubleshoot, and improve the Service.
Communications. If you email or contact us, we collect the contents of your message, any attachments, and standard metadata.
Children's data. Cabro is a business service and is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a child has provided information, email us and we will delete it.
We use the information above to:
Aggregated / de-identified data. We may create aggregated and de-identified data from use of the Service — for example, anonymized benchmark or price-comparison insights across similar operators — that does not identify you, your business, or any individual. This is not used to expose one customer's data to another.
We share information only as needed to run the Service, and only with the categories below. We do not sell personal information and do not share it for cross-context behavioral advertising.
Service providers (subprocessors). We use a small number of established providers, each of which only processes information necessary for its role and is bound to protect it:
| Provider | Role | What it processes |
|---|---|---|
| Supabase | Application database, authentication, and file/document storage | Account data, Customer Data, uploaded documents/invoices |
| Vercel | Application hosting and delivery | Web/app requests and standard server/access logs (e.g., IP address) |
| Stripe | Payment processing and subscription billing | Billing details, payment card data, payment history |
| Resend | Sending transactional and service emails | Recipient email addresses and email content; delivery logs |
| Anthropic, PBC (Claude AI) | Powers the in-app Cabro assistant and support answers | The questions you send the assistant and related business context (e.g., product/vendor/price data) |
| Google LLC (Gemini AI, paid tier) | Powers voice transcription and assistant responses | Short voice recordings and their transcriptions, and related business context |
Each provider maintains its own privacy and security practices. We use them because they are industry-standard and well-maintained.
AI features (the Cabro assistant and voice ordering). To power our in-app assistant ("Ask Cabro") and voice-enabled counting and ordering, we send limited operational data — your typed questions, short voice recordings and their transcriptions, and related business data such as product names, vendor names, and prices — to the AI providers listed above (Anthropic and Google). These providers act as our subprocessors and are contractually bound to process the data only to provide the feature to us. On the paid API tiers we use, neither Anthropic nor Google uses this data to train or improve their models, neither sells it, and each retains it only briefly (or not at all) for security and abuse-prevention. We do not build voiceprints or use voice to identify individual speakers; audio is used only to understand what was said. You should not submit information through these features that you are legally or contractually barred from sharing with a service provider.
Legal and protection. We may disclose information if required by law, subpoena, or legal process, or where we reasonably believe disclosure is necessary to protect our rights, your safety or that of others, or the security and integrity of the Service.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
At your direction. We share data with third parties (such as your own vendors or distributors) when you use a feature that does so or when you instruct us to.
We use industry-standard safeguards, including HTTPS/TLS encryption in transit, encryption at rest through our infrastructure providers, hashed password storage, access controls limiting who can reach Customer Data, and reliance on SOC-compliant providers for hosting, database, and payments. We do not store full payment card numbers. No system is perfectly secure, however, and we cannot guarantee absolute security; you are responsible for safeguarding your login credentials.
Cabro is operated from the United States, and our service providers maintain their primary infrastructure in the United States. If you access the Service from outside the U.S., you understand your information will be processed in the United States, which may have different data-protection laws than your country.
We retain Customer Data and account information for as long as your account is active and as needed to provide the Service. After your account is terminated, we will delete or de-identify Customer Data in the ordinary course following any export window described in our Terms, except for records we are legally required to keep (such as billing and tax records) and routine backups, which expire on their normal cycle. Voice recordings are used to produce a transcription and are not retained by us as raw audio beyond what is needed to process your request.
Depending on where you are, you may have rights to:
California residents (CCPA/CPRA): We do not sell or share personal information as those terms are defined. You have the rights to know, access, correct, delete, and to non-discrimination, and you may use an authorized agent. Residents of Colorado, Connecticut, Virginia, and other states with privacy laws have comparable rights — email us and we will honor the rights your jurisdiction grants.
To request deletion of your information — or to make any access, correction, or other privacy request — email hello@cabroapp.com with the subject line "Privacy Request" and tell us what you'd like. We will verify your request (typically by confirming control of the account email) and respond within 30 days (or the period your law requires). We will delete the requested information except for records we are legally required to retain. If you are an authorized user rather than the account owner, we may need to coordinate with the business that owns the account.
Cabro uses cookies and similar technologies that are strictly necessary to operate the Service — for example, to keep you logged in, maintain your session, and keep the Service secure. We do not use advertising cookies or third-party cross-site tracking. Because we use only essential cookies, there is nothing to opt out of for advertising; you can control cookies through your browser settings, though disabling essential cookies may break the Service.
We may update this Policy from time to time. The "Last updated" date will reflect changes, and for material changes we will provide notice (for example, by email or in-app notice). Continued use of the Service after a change takes effect means you accept the updated Policy.
Maine Provisions Inc. (DBA Cabro) 363 Main Street, Kingfield, ME 04947, United States Email: hello@cabroapp.com
---