Skip to content
Candoo

Privacy Policy

Last updated: October 4, 2026

1. Introduction

Candoo Solutions, Inc. (“Candoo,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services at candoo.co.

2. Information We Collect

We collect information you provide directly to us, including:

  • Contact Information: Name, email address, phone number, and zip code when you join our waitlist or create an account
  • Account Information: Email and password when you create an account
  • Payment Information: Credit card numbers, billing addresses, and payment history when you subscribe to our services or pay for home maintenance services. Payment processing is handled by third-party payment processors (e.g., Stripe) who maintain their own privacy policies.
  • Communication Data: Messages, emails, text messages, and other communications you send through our platform
  • Property Information: Details about your home, service history, and maintenance needs
  • How You Found Us: The page you first landed on and any campaign tags in the link you followed (for example, from an ad or an email). We keep this in your browser for up to 30 days and attach it to a form only when you submit one, so we can tell which campaigns bring people to us. We do not share it with anyone else, and it is not used to track you across other websites.

When you submit a form on our website, we and Cloudflare, our bot-protection provider, process your IP address and browser information to block automated spam. To limit repeat submissions, we keep a coded version of your IP address for about an hour, and delete it the next time our forms are used after that.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process your waitlist registration and notify you about service availability
  • Process payments and manage your subscription
  • Connect you with qualified service providers
  • Communicate with you about updates, promotions, and service-related matters via email, SMS, or in-app messaging
  • Coordinate with vendors and contractors on your behalf to resolve service issues
  • Respond to your inquiries and provide customer support
  • Analyze usage patterns to improve user experience
  • Use AI service providers to help Providers triage inbound communications, extract structured details, and draft suggested replies. Human-in-the-loop review is our default control for outbound responses today; some auxiliary steps (such as classification or routing) may run without per-message human review.

4. SMS/Text Message Communications

We may send text messages (SMS) to your mobile phone number for:

  • Phone number verification
  • Service updates and appointment reminders
  • Important notifications about your home services
  • Responses to your inquiries

Message and data rates may apply. Message frequency varies based on your service activity.

You can opt out of SMS messages at any time by:

  • Replying STOP to any message
  • Updating your notification preferences in your account settings
  • Contacting us at privacy@candoo.co

By providing your phone number and opting in to SMS notifications, you consent to receive text messages from Candoo.

5. Information Sharing

We may share your information with:

  • Service Providers: Third-party vendors who perform services on our behalf (e.g., email delivery, SMS messaging, analytics)
  • AI / LLM Service Providers: When you use Candoo as a Provider (home-services operator), inbound messages from your customers may be processed by AI service providers to help you triage messages, extract structured details, and draft suggested replies. Message content is processed solely to provide the AI Message Assist feature; it is not used by these providers to train their models, consistent with their enterprise data-processing terms. A current list of named AI sub-processors is available on our Sub-Processors page. You can disable AI message processing at any time in your Provider Settings.
  • Home Service Providers and Vendors: We share relevant information about your service requests, property details, and contact information with contractors and vendors to facilitate service delivery. This includes discussing your specific issues, preferences, and scheduling needs on your behalf to ensure quality service.
  • Payment Processors: We share payment information with third-party payment processors (such as Stripe) to process transactions securely. These processors have their own privacy policies governing their use of your data.
  • Legal Requirements: When required by law, court order, or governmental authority, or to protect our rights, property, or safety

We do not sell your personal information for money, and we do not give it to third parties for their own marketing. We never share your phone number for anyone else’s marketing.

We do share hashed identifiers — a scrambled version of your email address or phone number, not the address or number itself — with the advertising platforms listed in Section 6, so they can measure our campaigns and show you our ads. Under California law this counts as “sharing” even though no money changes hands. You can stop it at any time in Your Privacy Choices.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to provide essential website functionality and improve your experience. This section explains what cookies we use and how you can manage them.

Types of Cookies We Use

Essential Cookies:

  • Authentication cookies that keep you logged into your account
  • Session cookies that maintain your connection to our servers
  • Security cookies that help protect your account

These cookies are necessary for the website to function and cannot be disabled.

Functional Cookies:

  • Preference cookies that remember your settings and choices
  • Consent cookies that record your cookie preferences

Specific Cookies We Use

  • Supabase Authentication (sb-*): Session management cookies that keep you logged in. These expire when you log out or after an extended period of inactivity.
  • Cookie Consent Preference: Stored in your browser’s local storage to remember which of the two choices below you have turned on or off.
  • How You Found Us: Stored in your browser’s local storage for up to 30 days, and sent to us only when you submit a form. Most of what it holds comes from ad links, so it follows the Advertising choice: we skip storing it — and delete anything already stored — if you turn advertising off or use a Global Privacy Control (GPC) browser signal.
  • Google Analytics (_ga, ga*): Used to tell visits and visitors apart. Set when you first arrive, before you make a cookie choice. On the property candoo.co reports to, Google’s cross-site advertising features are turned off, so it measures our own site and does not build advertising audiences. Turn off How you use the site and we stop collecting with it here, delete these cookies, and delete them again on each candoo.co page you open afterwards. Both expire after 2 years.
  • Google Ads (gcl*): Set by Google Ads to attribute a visit to an ad click, so we can tell which campaigns bring people to Candoo. _gcl_au is set on any visit; the others are set when you arrive from one of our ads. They expire after 90 days. Google Ads also stores three values in your browser’s local storage — _gcl_ls, lastExternalReferrer and lastExternalReferrerTime — for the same purpose. Set unless you have turned off Advertising or use Global Privacy Control.
  • Meta Pixel (_fbp, _fbc): Set by the Meta Pixel to identify browsers for ad delivery and reporting, on our marketing pages. _fbp is set on any visit; _fbc records that you arrived from one of our Facebook or Instagram ads. Set unless you have turned off Advertising or your browser sends a Global Privacy Control signal. Expire after 3 months.
  • Nextdoor Pixel (ndp_session_id): Set by the Nextdoor Pixel for ad targeting and measurement, on our marketing pages. The pixel also stores a gpuInfo value in your browser’s local storage, describing your device’s graphics hardware, which it uses to tell real browsers from automated ones. Set unless you have turned off Advertising or use Global Privacy Control.
  • PostHog (ph_, _ph_opt_in_out): Product analytics, including session replays we use to see how people move through the site. What you type into a form is masked and never reaches a replay. Replays may include the page content you were shown, so we can tell which page and which wording someone was reading. Nothing is linked to a name on our marketing pages, because you are not signed in; on the pages you see when signed in, your activity is linked to your account email. ph_* is set unless you have turned off How you use the site or use Global Privacy Control; __ph_opt_in_out_* is stored in your browser either way, to record that choice for later visits.
  • Live chat (tidio_state_*): Stored in your browser’s local storage by our live-chat widget on our marketing pages, to keep your conversation and its history attached to you between page views. Set when the chat widget loads. Support functionality, not advertising — see Tidio under Customer Support in our Sub-Processors list.
  • Scheduling (Calendly): When you ask for a consultation, the “pick a time” step embeds a Calendly booking calendar. Calendly stores nothing in your browser for candoo.co — anything it sets belongs to calendly.com and is covered by Calendly’s own privacy policy, not this one. We pass it the name and email you just gave us so you do not type them twice. Scheduling functionality, not advertising — see Calendly under Scheduling in our Sub-Processors list.
  • Cloudflare Turnstile (cf.turnstile.u): tells people from automated traffic on our forms. Kept in your browser’s local storage under Cloudflare’s own address (challenges.cloudflare.com), not candoo.co’s, from when you first click into one of our forms.
  • Sidebar state (sidebar:state): Remembers whether you left the navigation sidebar open or collapsed. Preference only — no tracking.

Analytics Cookies

We use Google Analytics 4 (GA4) and PostHog to understand how visitors interact with our website. What PostHog records, including its session replays, is itemised in its entry above. Google Analytics may collect information such as:

  • Pages you visit and how long you spend on them
  • How you arrived at our website (referral source)
  • Your general geographic location (city/region level, not precise)
  • Your browser type and device category

Google Analytics does not collect your name, email address, or other personally identifying information through these cookies.

Both of these run by default, and you can turn either one off. We do not wait for you to opt in — they run from your first page view. There are two separate choices:

  • Advertising — Google Ads, Meta and Nextdoor. Turning this off stops us loading them on this visit and every later one, and tells the ones already running to stop collecting. Anything still running on the page you are on stops when you open another page.
  • How you use the site — Google Analytics and PostHog, which record which pages you open and where people get stuck, so we can fix what is confusing. Neither is used to advertise to you: we have turned off Google’s cross-site advertising features on our analytics property.
  • Turning a choice off also deletes the cookies in that group that are already on your device. We delete them again on each page you open afterwards, in case a script puts one back. Cookies from the group you left on stay.
  • Choosing “Necessary only,” or browsing with Global Privacy Control turned on, turns both off at once.
  • You can change either choice whenever you like in Your Privacy Choices below.

For more information about how Google handles data, visit Google’s Privacy Policy.

Advertising & Retargeting Pixels

We use the following third-party advertising pixels on our marketing pages to serve relevant ads and measure campaign performance. They load by default, including before you have made a cookie choice. They are not loaded for visitors who choose “Necessary only”, turn off Advertising in Your Privacy Choices, or use a Global Privacy Control (GPC) browser signal. They are also never loaded on the pages you see when signed in to your account.

  • Meta Pixel (Facebook/Instagram): Allows us to show retargeted ads on Facebook and Instagram to visitors who have interacted with our site. We use Meta’s Automatic Advanced Matching feature, which hashes identifiers such as email addresses and phone numbers before sending them to Meta for ad matching. For more information, see Meta’s Privacy Policy.
  • Google Ads (Remarketing): Enables conversion tracking and remarketing on Google Search and Display networks. If you decline, we signal Google to stop using advertising storage. See Google’s Privacy Policy.
  • Nextdoor Pixel: Used for neighborhood-targeted ad campaigns on the Nextdoor platform. The pixel script is not loaded at all if you have declined or use Global Privacy Control. See Nextdoor’s Privacy Policy.

One exception: if you browse with JavaScript turned off, our pages include a plain image tag for Meta and Nextdoor that records a page view. It cannot read your cookie choice, because the code that checks it does not run. Almost nobody browses this way, but we would rather say so than imply otherwise.

You can turn off advertising tracking at any time in Your Privacy Choices below.

You can manage cookies in the following ways:

  • Your Privacy Choices: The section below lets you change either choice at any time. You will also find a link to it in the footer of our main site pages.
  • Cookie Banner: On your first visit you can choose “Accept” or “Necessary only.” “Accept” turns both choices on. “Necessary only” turns both off, deletes the cookies they already set, and stops them loading on every page after this one. To turn on just one, use Your Privacy Choices below.
  • Global Privacy Control: If your browser or an extension sends a GPC signal, we treat it as a decline automatically and do not show the banner.
  • Browser Settings: Most web browsers allow you to control cookies through their settings. You can typically find these options in the “Privacy” or “Security” section of your browser preferences.
  • Clearing Cookies: You can delete existing cookies at any time through your browser settings.

Please note that disabling essential cookies may prevent you from using certain features of our website, such as staying logged in to your account.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure servers, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

You have the right to:

  • Access and receive a copy of your personal data
  • Request correction of inaccurate data
  • Request deletion of your personal data
  • Opt out of marketing communications and SMS messages
  • Withdraw consent where applicable

To exercise any of these rights, please contact us at privacy@candoo.co.

9. Data Deletion

To Request Complete Data Deletion:

If you wish to permanently delete your Candoo account and all associated data from our servers, please contact us at privacy@candoo.co. We will process your deletion request in accordance with our data retention policies and applicable law.

For more information about how we handle your data, please review the sections above on “Your Rights” and “Data Retention.”

10. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to Know: You can request information about what personal data we collect, use, and disclose
  • Right to Delete: You can request deletion of your personal data, subject to certain exceptions
  • Right to Opt-Out: You can opt out of the sharing of your personal information for cross-context behavioral advertising in Your Privacy Choices, or by browsing with Global Privacy Control turned on. We do not sell personal information for money, but we do share hashed identifiers with advertising platforms (Meta, Google, Nextdoor), which California law treats as sharing. That happens by default until you opt out.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To submit a request, please contact us at privacy@candoo.co.

11. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy, unless a longer retention period is required by law. When you close your account, we will delete or anonymize your personal data within a reasonable timeframe, except where we are required to retain it for legal or regulatory purposes. To limit repeat submissions, we keep a coded version of your IP address for about an hour, and delete it the next time our forms are used after that.

Our website may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

13. Children’s Privacy

Our services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that significantly affect how we use your personal information, we will notify you at least 30 days in advance via email or prominent notice on our website. We will post the updated policy on this page and update the “Last updated” date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Email: privacy@candoo.co

Mail: Candoo Solutions, Inc., Attn: Privacy Team