Privacy Policy

Last updated: March 4, 2026

1. Introduction

Welcome to Kadû. This Privacy Policy explains how Kadû Inc. (“Kadû,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use our mobile applications (Kadû and Kadû Pro), our website at kadu.app, and any related services (collectively, the “Platform”).

By using the Platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2a. Information You Provide

• Account information: Phone number, email address, first name, and last name.
• Profile information: Profile photo, trade name or business name, and provider type (individual or business).
• Waitlist and onboarding data: Service category interests, skills, pain points, business type, hours of operation, and product categories — depending on your role (Customer, Contractor, or Partner).
• Location data: Address, city, country, and geographic coordinates that you provide when saving a location or posting a job.
• Referral information: Referral codes you share or use, and how you heard about Kadû (e.g., friend or family, social media, etc.).
• Consent preferences: Whether you have accepted our Terms of Service, and whether you have opted in to marketing communications.
• Payment information: When making or receiving payments through the Platform, transaction details are processed by our third-party payment providers (see Section 5). We do not store your full payment card details on our servers.

2b. Information Collected Automatically

• Device and session data: IP address, browser user agent, device type (mobile, tablet, or web), and which Kadû app you are using.
• Approximate location from IP: City and country derived from your IP address for security and fraud prevention purposes. This does not require device location permissions.
• Push notification tokens: Device tokens registered with Firebase Cloud Messaging (FCM) for delivering notifications. These are associated with your account, your device platform (iOS, Android, or web), and which app you are using.

2c. Information From Third-Party Services

If you choose to sign in using a social account, we receive limited information from the provider:

• Google Sign-In: Your Google account ID and email address.
• Apple Sign-In: Your Apple account ID and, if you choose to share it, your email address.
• Facebook Login: Your Facebook account ID and email address.

We use this information only to authenticate your identity. We do not access your contacts, posts, or other social media content.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing our services: Creating and managing your account, matching customers with contractors, facilitating job postings and offers, and enabling communication between users.
• Safety and security: Verifying your identity, preventing fraud, enforcing bans, managing session security, and detecting suspicious activity.
• Push notifications: Sending you job updates, offer alerts, and other service-related notifications through Firebase Cloud Messaging.
• Analytics and improvements: Understanding service demand by category and location, tracking signup trends, and identifying where to focus contractor recruitment — displayed in our internal admin dashboard. We do not sell this data or share it with advertisers.
• Marketing communications: If you opt in, we may send you tips, offers, and updates about Kadû via email or push notification. You can opt out at any time.
• Legal compliance: Responding to legal requests, enforcing our Terms of Service, and protecting the rights and safety of our users and the public.

4. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

• Between users on the Platform: When you are matched on a job, limited profile information (first name, last initial, profile photo, and ratings) is visible to the other party. Detailed location and contact information is shared only after a contractor is assigned to a job.
• With service providers: We use third-party services to operate the Platform (see Section 5). These providers process data on our behalf and are contractually required to protect it.
• For legal reasons: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the safety, rights, or property of Kadû, our users, or the public.

5. Third-Party Services

We rely on the following third-party services to operate the Platform:

Each of these providers has its own privacy policy. We encourage you to review them.

6. Data Storage and Security

• Server infrastructure: Our application servers are hosted on Railway in the United States.
• File storage: Uploaded files (such as profile photos and work submission attachments) are stored on Amazon Web Services (AWS) S3 in the EU (Europe) region.
• Security measures: We use HTTPS/TLS encryption for all data in transit, hashed tokens for sessions and email verification, rate limiting, security headers, and parameterized database queries to prevent injection attacks. Authentication is phone-based (OTP) or via social sign-in providers.
• Session management: Sessions are tracked with hashed tokens and can be revoked individually or in bulk. Security-sensitive actions (such as phone number changes) trigger session invalidation and are logged as immutable security events.

While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

• Active accounts: We retain your data for as long as your account is active and as needed to provide our services.
• Deleted accounts: If you request account deletion, we will remove your personal data within 30 days, except where we are required to retain it for legal, dispute resolution, or safety purposes.
• Security event logs: Immutable records of security-sensitive actions (phone changes, session wipes, ban events) are retained for audit and fraud prevention purposes, even after account deletion.

8. Children’s Privacy

The Platform is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal data.
• Withdraw consent for marketing communications at any time.
• Export your data in a portable format.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. International Data Transfers

Our servers are located in the United States and the European Union. If you are accessing the Platform from outside these regions (including from Liberia and other West African countries), your information will be transferred to these locations. By using the Platform, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If we make material changes, we will notify you through the Platform or by other means. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: