Privacy policy

This Policy explains what data the Kakadu AI service processes, why, who it is shared with, and what rights the User has. It applies to every version of the Service: the apps for iOS, Android, Windows and macOS, the web version at web.kakadu.ai, the Kakadu AI browser extension for Google Chrome and other Chromium-based browsers, and the feedback forms and support chat (together, the "Service").

By using the Service, the User confirms that they have read and agree to this Policy. If the User does not agree, they must stop using the Service.

1. Data Controller

This Policy takes into account applicable data protection laws, including the GDPR (EU), and the requirements of the Apple App Store, Google Play, Chrome Web Store and Microsoft Store.

2. What Data We Process

Below is the complete list of the categories of data the Service processes.

What we do not collect:

• the precise (GPS) location of the device;
• the device's contact list;
• browsing history (beyond the current request in page assistance mode);
• the content of other SMS messages — SMS is used only to deliver the sign-in code;
• files on the device that the User has not opened or uploaded to the Service;
• biometric data: we do not create or store biometric face templates and do not identify people in photos by their faces. Names of people in photo captions appear only on the basis of information the User has given to the assistant.

The User decides which documents and information they upload to the Service and share with the assistant, and is responsible for the lawfulness of their use, including information about third parties.

3. Device and System Permissions

The Service requests permissions only for a specific feature and only when the User uses it. Any permission can be revoked in the device settings; the corresponding feature will then stop working.

4. Purposes of Processing

Creating and maintaining the account and the family subscription; providing the Service's features; fulfilling requests to the AI assistant; storing, syncing, processing and exporting documents; text and speech recognition; automatic file names and search across files and their contents; personalizing responses using the assistant's memory; access to files via link; assisting with the open web page on request (extension); handling support requests and refunds; confirming payment and keeping subscription records; security, fraud and abuse prevention; diagnostics, analytics and improvement of the Service; compliance with legal requirements.

We do not use the content of documents, photos, requests, memory or voice recordings for advertising, do not sell data, and do not show third-party advertising in the Service.

5. Legal Bases

The User's consent; performance of the agreement with the User (providing the Service); compliance with legal obligations; the Controller's legitimate interest in the security, stability and development of the Service, to the extent this does not override the User's rights.

6. How Documents, Photos, Requests, Voice and Memory Are Processed

6.1. User content is stored in the User's account and is accessible only to them, except for files the User has chosen to share via link. We do not read Users' documents for our own purposes and do not use them for our own commercial gain.

6.2. AI data processing. Kakadu AI is multi-model: each request is handled by one of the leading AI models available on the market, selected according to the type of task, model currency and independent benchmark results. The set of providers may change; the current list is available from support on request.

Providers receive only:

• the content the User has submitted for processing (text, documents, images, voice messages and their transcriptions, and, in page assistance mode, the content of the open page);
• files uploaded by the User — for text recognition, generating names and the search index (Section 6.3);
• information from the assistant's memory that is relevant to the current request (Section 6.4).

All of this is shared only to perform the relevant task. Account data — name, email, phone number, contacts, device location, identifiers, authentication data — is never shared with providers.

Content is transmitted only after the User has explicitly granted permission; permission may be withdrawn at any time in the application settings. Providers are required to protect User data to a standard no lower than described in this Policy and may not use the content for any other purpose.

6.3. Automatic names and search. When a file is uploaded, the Service recognizes its text (OCR), generates a short name and description for the file and adds it to the search index of the User's account. To do this it uses the file's content, its metadata (including the name of the place where a photo was taken, determined from the coordinates in the file) and information from the assistant's memory. The User may change a file's name; a changed name is not overwritten automatically, and the User's naming style is taken into account for subsequent files. Names, descriptions and the index are accessible only to the User and are deleted together with the file.

6.4. Assistant memory. The assistant may remember information the User has told it or asked it to remember, and use it in later chats and for file captions. The User may view, edit and delete the contents of memory in the app settings or by asking the assistant, and may turn memory off. Memory is not used for advertising and is not shared with third parties, except with AI model providers to the extent needed for the current request.

6.5. Access via link. If the User creates a link to a file, the file becomes accessible to anyone who has the link, without signing in. The User may revoke the link at any time; access to the file through it then ends.

6.6. We do not use User content or memory contents to train our own models without separate explicit consent.

6.7. Limited technical access to data is possible only to fix errors, restore functionality, review a support request or ensure security — by staff with the appropriate authorization.

6.8. AI responses, automatic names and descriptions may contain errors; the User evaluates them independently and is responsible for their use.

7. Analytics and Diagnostics

To collect usage statistics and crash reports we use Sentry and Firebase Crashlytics. These services receive technical and aggregated data (installation ID, feature usage events, crash data) and do not receive the content of files, chats or memory. We do not use advertising SDKs or trackers for ad targeting. On iOS we do not request App Tracking Transparency permission because we do not track Users across other companies' apps and websites.

8. Disclosure to Third Parties

We do not sell or disclose Users' data to third parties except in the cases below:

9. Payments

Subscriptions are paid through the Apple App Store, Google Play or Microsoft Store. Payment data is processed by these platforms under their own rules; we receive only the payment confirmation, transaction ID and subscription status. Refunds are governed by the Kakadu AI Refund Policy.

10. Browser Extension

10.1. The Kakadu AI extension runs in the browser side panel and provides access to the User's account, chats and files. The extension communicates only with the Service's own servers and does not read website content until the User enables page assistance mode.

10.2. Page assistance mode. At the User's explicit request, the assistant may work with the open page: read its text and structure, take a screenshot of the visible area and perform actions the User asked for (navigating, clicking, scrolling, entering text). The mode is activated only by the User's command, shows a visible activity indicator and can be stopped at any time. The extension does not read, collect or transmit page content in the background or without the User's command.

10.3. Page content is transmitted to our servers and to the AI model provider solely to fulfil the current request, is stored only as part of the corresponding chat (which the User may delete), is not used for advertising or to build a browsing profile, and is not shared with third parties for any other purpose.

10.4. The User is responsible for the sites they ask the assistant to work with and for the actions they instruct it to perform, including entering data on third-party sites.

10.5. Our use of information received from the browser and Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

11. Storage and Security

Data is stored on secure servers located in Russia. Access is limited to authorized staff and systems. Data is transmitted over HTTPS/TLS and stored using modern encryption standards. On the User's device the app and the extension store a session token, settings and interface cache; these are removed on sign-out or when the app/extension is uninstalled.

If the User is located outside the country where the servers are hosted, their data is transferred across borders; we ensure such transfers receive the protection required by applicable law.

No method of transmission or storage over the internet can guarantee absolute security; the User acknowledges this.

12. Retention and Deletion

12.1. Data is retained while the User uses the Service and for as long as necessary for the purposes of processing, unless the law requires a longer period.

12.2. The User may delete individual chats, files and documents in the app at any time. A file's recognized text, name, description, search index entry and links are deleted together with it.

12.3. The User may at any time view, edit and delete the contents of the assistant's memory, or turn memory off, in the app settings.

12.4. The User may delete their account themselves: Settings → Account → Delete account — or via support. After account deletion, data, including files, chats, memory and links, is deleted or anonymized within 30 days, except for data we are required to keep by law (e.g. payment records) or to protect legitimate interests.

12.5. Support correspondence is kept for the period needed to resolve the request, settle disputes and comply with legal requirements.

12.6. Crash reports and analytics data are kept for no more than 12 months in aggregated or anonymized form.

13. User Rights

The User has the right to: obtain information about what data of theirs is processed; receive a copy of their data (document export is available in the app); view, correct and delete the contents of the assistant's memory; rectify, restrict or delete data; revoke file links; withdraw consent; delete the account; object to processing based on legitimate interest; lodge a complaint with the data protection authority in their country.

Requests: KakaduAi@yandex.ru or the support chat. We respond within the period set by applicable law (as a rule, no more than 30 days).

14. Age Restrictions

The Service has an age rating of 16+ and is not directed at children under 16. We do not knowingly collect data from children under 16 without the consent of a parent or legal guardian; if we learn of such collection, we will delete the data. Users aged 16 to 18 may use the free features of the Service; a paid subscription may be taken out by a minor only with the consent of their legal representatives (Section 4 of the Terms of Use).

15. Changes to This Policy

We may amend this Policy. A new version takes effect upon publication at https://kakadu-app.com/en/legal/privacy-policy/ unless stated otherwise. We notify Users of material changes in the app or via available communication channels. Continued use of the Service constitutes acceptance of the new version.

16. Contacts