Caretta procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| Data retention | All applicable tiers | unknown | “ Google Calendar uses the access_type=offline OAuth parameter so Caretta can receive a refresh token and maintain the calendar connection. The Drive token is short-lived and is not retained. The calendar.events.owned scope is used only in our development verification flow. Calendar write access remains disabled in production while verification is pending. Production will request it incrementally only after Google approves the scope and you enable follow-up invites.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Caretta does not keep the Zoom name or email returned by the current-user endpoint and does not read existing meetings, recordings, transcripts, participants, or chats.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ user:read:user read the current Zoom user once after authorisation and retain only the Zoom user ID and account ID needed for precise deauthorisation cleanup.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Caretta connects through HubSpot OAuth. Contact read access is required; the remaining scopes are requested as optional permissions and are used only by the CRM features you enable.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Surface visitor identification loads only after marketing consent to support business-visitor identification and lead-profile enrichment.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ PostHog event collection gather anonymised usage data (feature usage, device/browser type, session duration) to improve product performance and user experience. Before measurement consent PostHog runs cookieless: no cookies or browser storage, and visitors are counted with a daily-rotating hash computed on PostHog's servers. After consent it stores an identifier in your browser.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Visitors and Vercel Web Analytics load only after measurement consent to collect the website pageview and related technical data described above.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 5.1 This Agreement is effective as of the date Customer first subscribes to the Services. The initial subscription term shall be the period selected by Customer at checkout (monthly or annual). The subscription shall automatically renew for successive terms of the same duration unless either party provides notice of non-renewal at least thirty (30) days prior to the end of the then-current term. For monthly subscriptions, Customer may cancel at any time with effect at the end of the current monthly billing period. For annual subscriptions, Customer may cancel with at least thirty (30) days' notice prior to the end of the then-current annual term. 5.2 In addition to any other remedies it may have, either party may also terminate this Agreement upon thirty (30) days' notice (or without notice in the case of nonpayment), if the other party materially breaches any of the terms or conditions of this Agreement. Customer will pay in full for the Services up to and including the last day on which the Services are provided. 5.3 Upon any termination, Company will make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days, but thereafter Company may, but is not obligated to, delete stored Customer Data. All sections of this Agreement which by their nature should survive termination will survive termination, including, without limitation, accrued rights to payment, confidentiality obligations, warranty disclaimers, and limitations of liability.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ 4.1 Customer will pay Company the applicable fees for the Services as set forth at the time of purchase on the Company's website or checkout page (the "Fees"). Subscriptions are available on a monthly or annual basis as selected by Customer at checkout. Fees are payable in advance for each billing period. If Customer's use of the Services exceeds the service capacity included in Customer's subscription or otherwise requires the payment of additional fees (per the terms of this Agreement), Customer shall be billed for such usage and Customer agrees to pay the additional fees in the manner provided herein. Company reserves the right to change the Fees or applicable charges and to institute new charges and Fees at the end of the then-current subscription term, upon thirty (30) days' prior notice to Customer (which may be sent by email). If Customer believes that Company has billed Customer incorrectly, Customer must contact Company no later than sixty (60) days after the closing date on the first billing statement in which the error or problem appeared, in order to receive an adjustment or credit. Inquiries should be directed to founders@caretta.so. 4.2 Payment is processed through our third-party payment provider. Unpaid amounts are subject to a finance charge of 1.5% per month on any outstanding balance, or the maximum permitted by law, whichever is lower, plus all expenses of collection and may result in immediate termination of Service. Customer shall be responsible for all taxes associated with Services other than U.S. taxes based on Company's net income.” | Captured 2026-09-24Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.