This Privacy Policy explains how Cabo Hospitality LLC and Operadora Calamar S.A. de C.V. (“El Squid Roe,” “we,” “us”) collect, use, and protect your information when you visit this site and book a reservation. By using the site you agree to this policy.
Information we collect
- Booking details you provide: your name, email address, mobile phone number, party size, reservation date, package, and any notes for your host. Your mobile number is used to reach you about that reservation, and — only if you separately check the SMS consent box — to send you the text messages described under “SMS & Text Messaging” below.
- Payment information is processed directly by Stripe. We never see or store your full card number — Stripe handles card data under PCI-DSS standards.
- Usage data such as IP address, device/browser, and pages visited. Analytics cookies are stored only if you accept; your IP address and browser are also sent from our server to our advertising platforms alongside conversion events, whichever choice you make.
- Referral / campaign data — the link that brought you here, campaign tags, and the click id an ad platform adds to the address (Meta, Google or TikTok). We record this for every visitor, before and regardless of the cookie banner, because it is how a booking gets credited to the promoter or campaign that earned it.
Cookies
We use three categories of cookies:
- Strictly necessary — keep your booking session, your language, and your attribution working (the promoter or campaign that referred you, including any ad click id). These are always on; without them a booking cannot be credited to whoever earned it.
- Analytics (Google Analytics 4) — helps us understand traffic. The script loads for every visitor with all storage switched off, and starts storing analytics cookies only after you click “Accept.”
- Marketing (Meta Pixel) — measure ad performance. Loaded only after you click “Accept.”
- Cookieless measurement (Ahrefs Web Analytics) — counts page views without cookies and without identifying you. Because it stores nothing on your device, it runs for every visitor and is not part of the banner choice.
You can decline analytics and marketing cookies in our banner and still book normally. To change your choice later, clear this site's cookies in your browser and reload.
How we use your information
- To process and confirm your reservation and take your deposit.
- To contact you about your booking — confirmations, reminders and changes — by email, by phone, and by text message to the mobile number you gave us if you consented to texts.
- With your consent, to send offers and measure marketing — you can opt out of marketing messages anytime.
- To prevent fraud and chargebacks, and to keep the site secure.
Who we share it with
We share data only with service providers that help us operate:
- Stripe — payment processing.
- GoHighLevel — our CRM, to manage your booking and communications.
- Google Analytics and Meta — measurement and ad attribution. Their cookies load in your browser only if you accept. Separately, when you complete a booking our server sends them the conversion — the amount, your email and phone in hashed (irreversible) form, your IP and browser, and the ad click id — whichever choice you made in the banner.
We do not sell your personal information for money. We do share booking conversions with Meta and Google for advertising measurement, as described above, which some laws — including CCPA/CPRA — treat as “sharing” for cross-context behavioral advertising. To opt out of that sharing, email info@elsquidroe.com and we will exclude you.
Your rights
Depending on where you live (including under CCPA/CPRA in California and GDPR in the EU/UK), you may request to access, correct, or delete your personal data, and to opt out of marketing or the “sale/share” of data. Since we don't sell data, there's nothing to opt out of on that front — but you can still exercise any of these rights by emailing us.
Data retention & security
We keep booking records as long as needed to provide the service, meet tax and legal obligations, and resolve disputes. In practice: contact details on completed reservations are removed 5 years after your visit (amounts and dates stay for our books); quote requests, wait-list signups and checkouts that were never completed are deleted after 12 months. You can ask us to delete your data at any time using the contact address below.
Measures we use to protect your information:
- Everything travels over encrypted HTTPS connections, and every page is served under a Content Security Policy that blocks unauthorized scripts from running on the site.
- Card numbers never reach our servers. Payment is completed on Stripe's own hosted checkout, and Stripe handles card data under PCI-DSS standards.
- Guest records live in a managed database that no browser can query directly: row-level security is switched on for all of its tables, and the privileged key our servers use to read them is never sent to your device.
- Our staff, admin and promoter dashboards sit behind an access code and fail closed: if that code is missing, the dashboard refuses to load rather than opening up.
- Public forms are rate-limited and screened for automated abuse, so a bot cannot harvest or flood them.
- Payment notifications are cryptographically signature-verified before we act on them, so a forged message cannot create or alter a booking.
Age
El Squid Roe is an 18+ venue. This site is not directed to children and we do not knowingly collect data from anyone under 18.
SMS & Text Messaging
You opt in to text messages by providing your mobile number and checking the consent box during booking checkout on elsquidroe.com. Consent is optional and is never a condition of purchase.
We send texts tied to your own booking and visit: a reservation confirmation, a reminder the night before your date, a request for feedback after your visit, an alert if a table opens on a date you asked to be waitlisted for, and a reminder if you started a booking without finishing it. A typical reservation receives about three messages in total; frequency varies with your own booking activity, and we do not send recurring broadcasts.
Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. We never sell mobile numbers or SMS consent data, and we never hand them to anyone to use for their own marketing — the only parties that see them are the providers that deliver our messages and support our guests, acting on our instructions.
Contact
Questions or privacy requests: info@cabohospitality.com. See also our Terms of Service and FAQ.