PayPal AI Hackathon · Development prototype
Every catering detail.
Every approval clear.
Bilingual AI intake connects a customer's event request to a caterer-reviewed quote, PayPal sandbox payment and a separate booking decision.
Built by Franklyn Rosario, MBA-ITM, Founder of AIZOYA. La Bandera Kitchen is the first internal pilot configuration. Synthetic details only. No real money moves.
The demonstration
A real workflow, explained
53-second narrated landscape explainer with captions and no avatar. This illustration uses a synthetic example; it is not a screen recording. Watch on YouTube ↗
Why we built it
A guest count is only the beginning
An operator also needs a date, venue, menu requests, service details and dietary questions. Those details must remain connected to the quote and its approvals.
This problem statement comes from founder operating experience. We have not yet measured customer time savings or commercial return.
What we built
A mobile-oriented English/Spanish form with detailed event fields, browser-supported dictation, optional food-photo inspiration and read-aloud controls. An AI drafting step that stays editable. Separate customer and caterer roles. A durable record connecting quotes, approvals and sandbox payment status.
Customers review AI suggestions. Caterers retain pricing and booking authority.
How it works
The event stays connected
Describe the event
A customer types or uses supported browser dictation in English or Spanish, and can optionally supply a food photo as inspiration. Photo suggestions require explicit acceptance; they cannot establish ingredients or allergy safety.
Review the AI suggestion
Sonnet 4.6 suggests structured facts and a focused follow-up question. Allergy notes require caterer review and never promise safety.
Accept, edit and submit
The form changes only after explicit acceptance. The customer can edit details before sending the inquiry.
Approve a quote
The caterer sets the quote. The customer approves that revision before checkout.
Verify payment, then confirm
PayPal sandbox handles checkout. The server verifies payment status against the approved quote. The caterer separately confirms the booking.
Verification · November 8
Evidence before claims
137
Local Python tests passed.
10
Browser-interface tests passed in a simulated DOM.
49
Security, estimate, payment recovery and sign-in checks passed against installed modules, using mocks and temporary data. These counts overlap the local suite.
One real synthetic image request reached Bedrock and returned a review-required structured draft. The original response was not retained after a test-harness assertion failed; food-recognition quality is not established. A separate value comparison verified existing users, inquiries, quotes and payment operations were unchanged.
Synthetic sandbox state
2 inquiries · 2 customer-approved quotes · 1 verified sandbox payment · 1 confirmed booking. These are record counts, not a measured conversion funnel, customer traction or revenue.
Still to verify: native iPhone microphone and camera behavior, full signed-in photo acceptance, real signed webhook delivery and provider-outage behavior. Local mocked tests do not establish production readiness.
Under the hood
A small, explicit stack
Python and SQLite run through WSGI/Gunicorn behind Nginx HTTPS on Amazon Lightsail. Amazon Bedrock Claude Sonnet 4.6 drafts intake suggestions. PayPal Orders v2 sandbox handles order creation and capture.
Read the MIT-licensed source and setup instructions ↗Deployed sandbox candidate: PR #1, commit 3a3f839b. The pull request remains draft and unmerged.
Payment holds are enforced on the server
A quote marked for operator review cannot begin a create/capture operation or replay a completed operation to recover checkout access.
Recovery validates provider status, merchant, currency and quote amount before restoring a verified payment. Uncertain outcomes stay held for review. Refund accounting remains open work.
Security acceptance · November 8
Protect the inquiry, preserve the customer’s work
Checked on the hosted sandbox
Turnstile is enabled for this exact sandbox hostname. Missing and invalid verification tokens returned HTTP 403. A synthetic browser request passed automatic verification and reached the normal sign-in check. A controlled burst returned HTTP 429.
Login, AI drafting and inquiry submission have dedicated proxy limits. Authenticated accounts also have durable AI/inquiry limits. Existing role, origin and CSRF checks remain, and PayPal webhooks are separate from human challenges.
Useful immediately; reviewed before commitment
The customer gets an editable event brief and a focused question. After they review and submit, the inquiry appears in the caterer workspace. Automatic email/SMS alerts are planned.
La Bandera Kitchen’s menu opens separately so the draft stays available. Photos are inspiration, not evidence of ingredients or availability. A deterministic estimate foundation is tested, but public prices, taxes and fees remain locked pending approved business rules.
These controls reduce abuse; they do not establish immunity to bots or DDoS. Native iPhone media and full authenticated customer acceptance remain open. The live LBK website and DNS were not changed.
From MVP to a service
Add what improves the customer journey
| Stage | Technology decision | Customer purpose |
|---|
| Working sandbox | Lightsail, Bedrock, PayPal sandbox, Python and SQLite | Capture detailed requests, review AI suggestions, approve quotes and verify payments. |
| Next validation | One analytics system and error monitoring; Turnstile and request limits are now deployed | Measure where inquiries stall and detect failures. Proposed events exclude photos, voice, contact details and dietary text. |
| Before multiple businesses | Tenant isolation, configurable branding and menus, staff roles; evaluate Postgres | Let each caterer configure its own service with separate customer records. |
| Only when justified | Stripe adapter, Meta model benchmark, MongoDB search, Crusoe inference infrastructure | Expand payment choice or solve demonstrated data and model needs. These are not connected features today. |
PostHog is the proposed analytics default; Mixpanel is an alternative. Replit can support bounded prototyping. Cloudflare Turnstile is active on the sandbox without moving hosting or DNS. Server validation rejects missing or invalid tokens; request and concurrency limits add another layer. No migration or additional subscription is represented as completed.
Next measurements: inquiry completion, draft acceptance and correction, quote approval, payment recovery, response time and AI cost. No measured commercial improvement is claimed yet.
Take the project with you
The one-page brief
A concise project overview, verified progress, competition and a clearly labeled subscription revenue model.
Product context · Commercial hypotheses
Where CaterFlow could go next
Customization and integrations
Planned: each business chooses its branding, menus, required fields and service rules. Isolated business accounts, staff roles and additional payment providers would follow. The current build is a single-business prototype. Stripe and self-service customization are not shipped.
Competition
| Product | Vendor-described scope | Published pricing context |
|---|
| Tripleseat | Event platform and catering portals | Custom pricing |
| Caterease | Event/menu operations, payments and AI access | Express $99/month, annual billing. $200 launch fee per user. |
| Total Party Planner | Catering operations and TPP Pay | Nibble $119/month. $200/month fee without TPP Pay. |
Tripleseat also advertises context-aware Intelligence/Cohost and Direct Book, while Caterease advertises an AI assistant and portals. CaterFlow's proposed focus is bilingual multimodal intake, explainable budget alternatives and manageable onboarding for smaller operators. We still need evidence that this focus earns a subscription. AI alone is not a moat, and this is not a feature-parity claim.
Primary sources checked November 7, 2026: Tripleseat, Caterease, Total Party Planner. Prices and package conditions differ. We have not independently tested competitor products. AI feature descriptions checked November 8: Tripleseat Cohost, Caterease, Total Party Planner. No exclusive-feature claim is made.
Illustrative ARR model
No paid CaterFlow subscriptions or current subscription ARR are verified. Proposed pricing is $99 Starter and $199 Team per business/month. An even mix gives $149 monthly subscription revenue per business.
Businesses × $149 × 12. A scenario, not a forecast or current revenue. Excludes catering sales, payment volume, setup fees and credits.
Next steps
Validate the business around the workflow
Complete judging access and reliability checks, recruit five design partners, then measure onboarding, paid conversion, quote turnaround and support effort. These are proposed milestones, not existing customers or commitments.