Privacy Policy

Last updated: November 2, 2026

1. Introduction

Welcome to Kadû. This Privacy Policy explains how Kadû Inc. (“Kadû,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use our mobile applications (Kadû and Kadû Pro), our website at kadu.app, and any related services (collectively, the “Platform”).

By using the Platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2a. Information You Provide

• Account information: Phone number, email address, first name, and last name.
• Profile information: Profile photo, trade name or business name, and provider type (individual or business).
• Waitlist and onboarding data: Service category interests, skills, pain points, business type, hours of operation, and product categories — depending on your role (Customer, Contractor, or Partner).
• Location data: Address, city, country, and geographic coordinates that you provide when saving a location or posting a job.
• Referral information: Referral codes you share or use, and how you heard about Kadû (e.g., friend or family, social media, etc.).
• Consent preferences: Whether you have accepted our Terms of Service, your communication preferences, and your separate choices regarding operational SMS, promotional SMS, email marketing, and push notifications. For SMS, we may retain your phone number, consent purpose, date and time, collection source, the version of the disclosure you accepted, and later opt-out or re-enrollment activity.
• Payment information: When making or receiving payments through the Platform, transaction details are processed by our third-party payment providers (see Section 5). We do not store your full payment card details on our servers.

2b. Information Collected Automatically

• Device and session data: IP address, browser user agent, device type (mobile, tablet, or web), and which Kadû app you are using.
• Approximate location from IP: City and country derived from your IP address for security and fraud prevention purposes. This does not require device location permissions.
• Push notification tokens: Device tokens registered with Firebase Cloud Messaging (FCM) for delivering notifications. These are associated with your account, your device platform (iOS, Android, or web), and which app you are using.

2c. Information From Third-Party Services

If you choose to sign in using a social account, we receive limited information from the provider:

• Google Sign-In: Your Google account ID and email address.
• Apple Sign-In: Your Apple account ID and, if you choose to share it, your email address.
• Facebook Login: Your Facebook account ID and email address.

We use this information only to authenticate your identity. We do not access your contacts, posts, or other social media content.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing our services: Creating and managing your account, matching customers with contractors, facilitating job postings and offers, and enabling communication between users.
• Safety and security: Verifying your identity, preventing fraud, enforcing bans, managing session security, and detecting suspicious activity.
• Push notifications: Sending you job updates, offer alerts, and other service-related notifications through Firebase Cloud Messaging.
• Analytics and improvements: Understanding service demand by category and location, tracking signup trends, and identifying where to focus contractor recruitment — displayed in our internal admin dashboard. We do not sell this data or share it with advertisers.
• SMS communications: When you voluntarily opt in, Kadû Inc. may text you important service and account information, such as booking confirmations, service request updates, contractor assignments, appointment reminders, and customer support updates. Promotional SMS, such as marketplace news and special offers, requires separate affirmative consent. Consent to receive SMS is optional, not a condition of signing up or purchasing services, and is not inferred from supplying a phone number, verifying a login code, or accepting the Terms of Service. Message frequency varies; message and data rates may apply. You can withdraw consent for a category through your available account settings, a supported reply STOP, an unsubscribe link, or by contacting [email protected]. We retain records of opt-ins, withdrawals, and delivery or suppression status as needed to honor your preferences and manage the SMS program.
• Marketing communications: Where offered, we may send Kadû news, offers, and announcements by communication channels you have separately authorized. Promotional SMS requires its own affirmative opt-in, independent of operational SMS, email, and push notification settings. You may withdraw promotional SMS consent without withdrawing consent for operational SMS.
• Legal compliance: Responding to legal requests, enforcing our Terms of Service, and protecting the rights and safety of our users and the public.

4. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

• Between users on the Platform: When you are matched on a job, limited profile information (first name, last initial, profile photo, and ratings) is visible to the other party. Detailed location and contact information is shared only after a contractor is assigned to a job.
• With service providers: We use third-party services to operate the Platform (see Section 5). These providers process data on our behalf and are contractually required to protect it.
• For legal reasons: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the safety, rights, or property of Kadû, our users, or the public.

Mobile and SMS Consent Privacy

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

Mobile phone numbers, text messaging opt-in records, and consent information are not sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. We may disclose only the information necessary to contracted messaging service providers for delivering messages, processing delivery confirmations and opt-outs, maintaining security, and complying with the law. Those providers may not use SMS opt-in data for unrelated marketing. These safeguards apply whether you consent to operational or promotional SMS.

5. Third-Party Services

We rely on the following third-party services to operate the Platform:

Each of these providers has its own privacy policy. We encourage you to review them.

6. Data Storage and Security

• Server infrastructure: Our application servers are hosted on Railway in the United States.
• File storage: Uploaded files (such as profile photos and work submission attachments) are stored on Amazon Web Services (AWS) S3 in the EU (Europe) region.
• Security measures: We use HTTPS/TLS encryption for all data in transit, hashed tokens for sessions and email verification, rate limiting, security headers, and parameterized database queries to prevent injection attacks. Authentication is phone-based (OTP) or via social sign-in providers.
• Session management: Sessions are tracked with hashed tokens and can be revoked individually or in bulk. Security-sensitive actions (such as phone number changes) trigger session invalidation and are logged as immutable security events.

While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

• Active accounts: We retain your data for as long as your account is active and as needed to provide our services.
• Deleted accounts: If you request account deletion, we will remove your personal data within 30 days, except where we are required to retain it for legal, dispute resolution, or safety purposes.
• Security event logs: Immutable records of security-sensitive actions (phone changes, session wipes, ban events) are retained for audit and fraud prevention purposes, even after account deletion.

8. Children’s Privacy

The Platform is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us at [email protected].

9. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal data.
• Withdraw consent for marketing communications at any time.
• Export your data in a portable format.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. International Data Transfers

Our servers are located in the United States and the European Union. If you are accessing the Platform from outside these regions (including from Liberia and other West African countries), your information will be transferred to these locations. By using the Platform, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If we make material changes, we will notify you through the Platform or by other means. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: