Data Processing Addendum

Kadi is operated by Abhishek C, an individual operating in India.

When you use Kadi to publish a profile, you are the data controller for personal data belonging to your visitors — the people who view your page, click your links, or pay you through a UPI block. You decide what to collect and why.

Kadi is the data processor for that data. We process it only to provide the service, following your instructions as expressed through your use of the product.

For data about you — your account email, your consent record, your billing details — Kadi is the controller, and that relationship is governed by our Privacy Policy rather than this document.

This addendum forms part of the Kadi Terms of Service. It applies automatically to every account from the date you accept those terms. There is no separate document to sign and no need to contact us to request one.

If we have separately signed an agreement with you, that agreement governs and nothing here changes it.

On behalf of creators, Kadi processes:

• Profile visitor analytics — page views and link clicks, recorded without cookies and without cross-site tracking
• Content you publish — links, text, images, product entries
• Payment references generated when a visitor uses a UPI block

Kadi does not hold or route creator earnings. UPI payments settle directly between the payer and the creator's own UPI handle. Kadi is not a payment aggregator and does not act as one.

We will:

• Process personal data only to provide and maintain the service
• Not sell personal data, and not use it to train machine learning models
• Keep access limited to those who need it, currently a single operator
• Encrypt data in transit and at rest
• Notify you without undue delay after becoming aware of a personal data breach affecting your data
• Delete or return your data on termination, subject to any legal retention requirement
• Make available the information reasonably needed to show compliance with this addendum

We use third-party providers to run the service. The current list is published at go.kadi.bio/legal/subprocessors.

We will publish changes to that list before a new subprocessor begins processing. You can subscribe to be notified of changes.

Kadi's infrastructure is hosted outside India. As of 8 August 2026:

• Database, authentication and file storage are hosted in Seoul, South Korea
• Application hosting and delivery are in Virginia, United States
• Transactional email is processed in Tokyo, Japan

Personal data processed through Kadi is therefore stored and processed outside India. We rely on each provider's own contractual transfer safeguards, which are noted in the subprocessor list.

Under the Digital Personal Data Protection Act 2023, transfers outside India are permitted except to territories specifically restricted by the Central Government. We will review this position if any such restriction is notified.

You are responsible for:

• Having a lawful basis for whatever you collect from your visitors
• Disclosing affiliate or paid relationships where required
• Not using Kadi to process sensitive categories of personal data
• Keeping your own account credentials secure