Sub-processors
Version 2026-08-17 · the complete list, and what each one receives
DRAFT — pending legal review. The list itself is not a draft: it is generated from what the running system is actually configured to call. What has not been reviewed is the legal wording around it.
This page is referenced by the Data Processing Agreement and by the customer Privacy Notice. It is the whole list. If a provider is not on it, Kai is not sending it anything.
In use today
| Provider | Role | Personal data it receives | Location of processing | Transfer basis |
|---|---|---|---|---|
| Supabase (Supabase Inc.) | Database, authentication, file storage. The system of record. | Everything Kai holds. | European Union — AWS eu-west-1, Ireland | Not applicable; data stays in the EU |
| Vercel (Vercel Inc.) | Serves the customer app and the merchant dashboard to browsers. | None at rest. Request metadata, including IP address, in transit and in short-lived logs. | Global edge network | Standard Contractual Clauses |
| SMSAPI (SMSAPI sp. z o.o.) | Delivers one-time codes and merchant broadcasts by SMS. | Recipient phone number and message content. | Poland | Not applicable; data stays in the EU |
| Resend (Resend Inc.) | Delivers e-mail — one-time codes and account mail. | Recipient e-mail address and message content. | United States | Standard Contractual Clauses |
| Cloudflare (Cloudflare Inc.) | Turnstile — the challenge on the sign-in form that stops automated sign-in attempts. | IP address and a challenge token. Not the phone number or e-mail address being signed in with. | United States and global edge | Standard Contractual Clauses |
Configured in the product but not switched on
These providers exist as integrations Kai can be pointed at. None of them is receiving anything today — no credential is installed, so no request is made. They are listed because "not configured" is a state that changes, and a list that only appears after the fact is not notice.
| Provider | What it would do | What it would receive |
|---|---|---|
| Anthropic (Claude) | Generate marketing copy for a merchant | The merchant's own text. No customer personal data — the design passes merchant text as data inside a fixed template and sends no customer record. |
| Stripe | Merchant billing | Merchant billing details. No customer data. |
| Meta, TikTok | Publishing a merchant's own posts | The merchant's own content. No customer data. |
Kai will publish an addition here, and notify merchants in the dashboard, at least 30 days before it starts processing anything.
Not used
There is no analytics provider, no advertising network, no data broker, no customer data platform, and no third-party tag of any kind on either app. The fonts are served from Kai's own origin rather than from a font CDN, specifically so that opening the app does not send a visitor's IP address to a third party before they have agreed to anything.
Questions
akaiyum@gmail.com