Privacy Policy
Effective: July 2026. Last updated: July 2026.
This document is written in plain language, not legalese. It is not a substitute for legal advice. We try to be honest about what we collect and why. If something is unclear, email us.
Who we are
Kadi is a link in bio tool for Indian creators, operated by Abhishek Naik (India). Kadi is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). Contact: hello@kadi.bio.
Age requirement
Kadi is intended for users who are 18 years or older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us at hello@kadi.bio and we will deactivate it promptly. We do not engage in behavioural tracking, targeted advertising, or profiling of any user, including minors.
What we collect and why
Email address
Collected when you sign in via one time code (OTP). Used only to send the sign-in code and to identify your account. Not used for marketing. Not shared with anyone. Stored in Supabase Auth.
Profile content
Username, display name, bio, avatar, links, and social icons — everything you add to your Kadi page. This content is stored so we can display your public page. It is entirely under your control. You can edit or delete it at any time.
Consent record
When you sign in, we record the version of the terms and privacy policy you agreed to, and the timestamp. This is a legal requirement under the DPDP Act. Stored against your profile. Retained as long as your account exists.
Aggregated analytics
When someone visits your public profile, we increment a daily page view count for your profile. When someone taps a link, we increment a daily click count for that link. These are aggregate counts — we do not record who visited, their IP address, device, location, or anything that could identify a visitor. Analytics counts are retained for 90 days in full detail, then summarised as monthly totals and kept indefinitely.
OTP request log
When you request a sign-in code, we log your email, the outcome (sent or rate-limited), and a one-way SHA-256 hash of your IP address. This log is used only to enforce rate limits and investigate abuse. It is automatically deleted after 90 days. The hashed IP cannot be reversed to identify you — it is a security measure, not a tracking tool.
Billing data (Pro subscribers only)
If you subscribe to Kadi Pro, Razorpay processes your payment. We store a Razorpay customer ID and subscription ID so we can manage your subscription. We also store a log of billing events (activated, renewed, cancelled) for support and audit. We never see your card number, UPI ID used for payment, or bank details — those remain with Razorpay.
Email subscribers (if you use the email capture block)
If you add an email capture block to your page, visitors may subscribe by sharing their email. These email addresses are stored and associated with your profile. We do not contact subscribers. We do not share them with anyone. You can export and delete your subscriber list from the dashboard. Subscribers who want to be removed can contact you directly or email us.
How long we keep your data
| Data | Retention |
|---|---|
| Email address | Until you delete your account, then permanently deleted within 30 days |
| Profile content and links | Until you delete them or your account |
| Consent record | For the lifetime of the account (required by law) |
| Analytics counts | 90 days in full, then rolled up to monthly totals kept indefinitely |
| OTP request log | 90 days, then automatically deleted by a scheduled job |
| Billing event log | Until your account is deleted; GST records retained per applicable law |
| Email subscribers | Until you delete them or your account |
Third-party processors and cross-border transfers
We use the following processors to operate Kadi. Your data may be processed or stored in their infrastructure, which is outside India. We disclose this as required by the DPDP Act. Each processor has their own privacy and security programs.
| Processor | Location | What they process |
|---|---|---|
| Supabase | South Korea | Database (all profile and link data), authentication (email + sessions), storage (uploaded images) |
| Vercel | United States | Hosting and serverless functions. Processes request logs transiently; does not store personal data beyond standard web logs |
| Resend | United States | Transactional email delivery (OTP codes, support replies, grievance acknowledgments). Email addresses processed for delivery only |
| Razorpay | India | Payment processing for Pro subscriptions. Razorpay holds your payment method details; we do not. Razorpay's privacy policy applies to payment data |
We do not sell your data to any third party. We do not share it with advertisers or data brokers. Processors receive only the minimum data needed to perform their function. For the complete and current list, see our subprocessor list.
What we do not collect
- Visitor IP addresses, device fingerprints, or browser information on public profile pages
- Cookies or tracking pixels on public profile pages
- Location data
- Payment card numbers, UPI IDs used for payment, or bank details of any kind
- Browsing history or cross-site tracking data
- Any data about visitors to public profile pages beyond aggregate view and click counts
Cookies
We use a session cookie on authenticated pages (your dashboard) to keep you signed in. This cookie is first party, used only for authentication, and contains no advertising identifiers. Public profile pages set no cookies at all. There is no cookie consent banner on public pages because there is nothing to consent to.
Your rights
Access your data
Sign in and go to the “Your data” tab in your dashboard. You can see a summary of everything we hold and download it as a JSON file.
Correct your data
Edit your profile, links, and social icons at any time from the dashboard. If you need to correct your email address, contact us.
Delete your data
Go to the “Your data” tab in your dashboard and choose “Delete my account.” Your public page goes offline immediately. After a 30-day recovery window, all your data is permanently and irreversibly deleted. You can also request deletion by email.
Withdraw consent
You can withdraw consent by deleting your account. Withdrawal does not affect processing that occurred before the withdrawal.
Nominate another person
Under the DPDP Act, you have the right to nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. Contact us at hello@kadi.bio to set this up. Note: we do not yet have a formal nomination mechanism in the product — see our Compliance Notes for details.
File a grievance
Use the form below or email hello@kadi.bio. We acknowledge all requests within 48 hours and aim to resolve them within 30 days.
Grievance Officer
As required by the DPDP Act, Kadi has designated a Grievance Officer to handle data-related requests and complaints.
Name: Abhishek C
Email: hello@kadi.bio
Response time: Acknowledgment within 48 hours, resolution within 30 days
You can submit a request using the form below. We will send an acknowledgment to your email address automatically.
Submit a data request or grievance
Changes to this policy
If we make changes that reduce your rights or materially change how we handle your data, we will update the effective date at the top of this page and notify you by email where required. We will not make such changes without a new consent prompt at sign-in.
Contact
Questions about this policy: hello@kadi.bio.