Privacy Policy

Last updated: 22 September 2026

This Privacy Policy explains how KADAI by IZIRA ("KADAI", "we", "us" or "our") collects, uses, discloses and protects personal data when you use kadaiku.online, KADAI merchant tools, merchant storefronts, customer status pages and related services.

KADAI is operated for businesses and customers in Brunei Darussalam. We aim to handle personal data responsibly and in accordance with applicable law, including Brunei Darussalam's Personal Data Protection Order, 2025 where it applies.

1. Who this policy applies to

This policy applies to people who interact with KADAI, including:

• merchants, business owners and authorised staff who create or operate a KADAI account;
• customers who browse a storefront, place an order, upload payment proof or make a booking;
• transport, runner, driver, parent or guardian users of private transport and Parent Pass features;
• rental customers and merchants using KADAI SEWA, including people who submit rental requests or upload requested rental documents;
• people who contact KADAI support, submit a feature request or use an enabled support/assistant tool;
• people who opt in to transactional WhatsApp updates or otherwise interact with KADAI.

Merchants may also collect and use customer information for their own business purposes. When a merchant decides how customer information will be used outside KADAI or for additional business purposes, that merchant is responsible for its own legal and privacy obligations.

2. Personal data and business information we may collect

Depending on the features you use, KADAI may collect or process:

• Account data: email address, authentication records, account identifiers and security events.
• Merchant profile data: business name, store slug, business type, description, contact details, address, business hours, social links, logos, cover images and other storefront settings.
• Catalog and operations data: products, services, variants, options, stock levels, preorder campaigns, availability, capacity, fulfilment choices and operational notes.
• Customer and transaction data: name, phone number, optional email, delivery address where needed, order or booking details, notes, selected dates or slots, status history and customer records associated with a merchant.
• Payment-workflow data: merchant-provided bank-transfer or payment-QR instructions, customer receipt/payment-proof uploads, payment references and merchant review status. KADAI does not require customers to provide bank passwords, PINs or one-time codes.
• Appointment data: selected services, booking times, duration, buffers, deposits, rescheduling information, blocked-time information and related notes.
• Transport and runner data: pickup and destination details, optional map-pin coordinates, route-distance information, passenger count or passenger name where provided, school/destination name, recurring schedules, fare/quote information, journey status, ratings and fulfilment details.
• Driver and delivery data: assigned driver/contact details, vehicle information, timestamps, recipient details, notes and optional delivery-proof images.
• Rental / hire data: rental item, requested dates and times, quantity, fulfilment or check-in method, rental amount, security deposit, booking status, merchant rental terms, accepted-terms snapshot and acceptance time where applicable.
• Rental document data: documents a merchant specifically requests for a rental, such as identity, driving-licence or other supporting documents, together with file name, type and upload time. These documents are intended to be stored privately for the relevant merchant to review.
• Live transport location: when an eligible merchant enables live GPS and a driver explicitly starts sharing for a trip, KADAI may receive the driver device's latest latitude, longitude, reported accuracy and update time. The current design stores the latest trip location rather than a breadcrumb route history.
• Inventory and costing data: materials, ingredient names, quantities, supplier names, purchase references, costs, freight, duties/taxes, permit or agent fees, wastage, packaging, labour, overhead allocations, recipe/batch-yield settings and estimated cost or margin inputs.
• Feature-request data: feature title, description, selected product area, optional reference URL, optional image/PDF attachment, request status and KADAI Admin notes.
• WhatsApp data: phone number, transactional opt-in records, message events, delivery/read status and inbound message content where an eligible merchant connects the official WhatsApp Business Platform.
• Support and assistant data: questions, support messages and related technical information where you contact us or use a support/chat provider enabled on KADAI.
• Technical and security data: device/browser information, IP address, timestamps, logs, error information and similar data reasonably needed to operate, secure and troubleshoot KADAI.

3. Information stored on your device

KADAI may use browser storage and, where relevant, cookies or similar technologies that are necessary for authentication, session continuity, active-business selection, preferences and other product functions. Some conveniences, such as saved transport places, may be kept locally on the customer's own device until the customer uses them in a booking.

KADAI does not sell personal data to advertisers and does not use this policy to authorise unrelated targeted advertising.

4. How we use information

We use information as reasonably necessary to:

• create, authenticate and secure merchant accounts and workspaces;
• operate storefronts, orders, bookings, preorders, inventory, capacity controls and customer records;
• process merchant-configured manual payment workflows and receipt review;
• operate runner, transport, recurring school-run, private Parent Pass and trip-tracking features;
• operate KADAI SEWA rental / hire availability, booking, terms-acceptance, deposit and requested-document workflows;
• calculate merchant-configured fares, route distances, costs, landed costs, recipe costs and margin estimates;
• provide plan management, usage limits, renewals, founder-rate administration and feature entitlements;
• send or facilitate transactional communications, including WhatsApp where configured and permitted;
• review merchant feature requests, attachments and product feedback;
• provide support, detect abuse, investigate errors and protect KADAI, merchants and customers;
• maintain, analyse and improve the reliability, usability and security of KADAI;
• comply with applicable law and enforce our Terms of Use.

5. Shared price and costing features

If KADAI enables shared ingredient or supply-price features, a participating merchant may submit an item/ingredient name, brand, pack size, retailer/branch, observed price, observation date and availability. Shared price observations may be visible to other eligible merchants after applying the feature's access and verification rules.

KADAI may keep a private provenance record linking a merchant-submitted observation to the reporting business for moderation, quality control, abuse prevention and audit purposes. The design is intended not to expose the reporting merchant's identity to other merchants through the shared library. Availability of shared-price features is controlled by the current product rollout and plan entitlements.

6. Private links and customer status pages

KADAI may issue tokenised private links for order status, transport/runner status, Parent Pass schedules, delivery proof or live trip tracking. These links are intended for the relevant customer, parent, guardian or recipient and should not be posted publicly.

Anyone who receives a valid private link may be able to view the information presented on that page. Customers and merchants should therefore treat private links with care. Where delivery-proof images are available to a customer, KADAI may serve them through time-limited signed links.

7. When we disclose information

We may disclose information only as reasonably necessary to operate KADAI, including to:

• the relevant merchant, for the customer's order, booking, payment proof, fulfilment or support request;
• authorised merchant staff or drivers, where their role requires access to fulfil a service;
• the relevant rental merchant, for a rental request and any documents specifically requested for that booking;
• the holder of a valid private status/tracking link, for the specific information made available through that link;
• service providers and infrastructure partners, including providers supporting authentication, database, storage, hosting, routing, messaging, support/chat, email, monitoring or security;
• Meta/WhatsApp, when official WhatsApp Business messaging is connected and a message is sent or received through that service;
• authorities or other parties, where disclosure is required by law or reasonably necessary to protect rights, safety, security or service integrity.

8. Third-party services

KADAI currently relies on third-party services including Supabase for authentication/database/storage infrastructure and Lovable for hosting/preview infrastructure. Other features may use routing, messaging, support/chat or other service providers. For example, an optional BubblaV support widget may be enabled on KADAI, and eligible merchants may connect Meta's WhatsApp Business Platform.

Third-party services have their own terms, privacy practices and technical availability. We only send information to them where reasonably necessary for the relevant KADAI function.

9. Data storage and international processing

Cloud providers and connected services may process information outside Brunei Darussalam. Where personal data is transferred or processed outside Brunei, we take reasonable steps appropriate to the circumstances to protect it and to use service providers suitable for the relevant processing.

10. Retention

We keep personal and business information only for as long as reasonably necessary for the purposes described in this policy, including providing KADAI, maintaining transaction and subscription records, resolving disputes, preventing abuse, meeting legal/accounting requirements and supporting legitimate business records.

Retention periods vary by record type. Live GPS is designed to retain the latest location row for a trip rather than a full breadcrumb history. Feature requests, subscription history, moderation/audit records, rental booking records and transaction records may be retained for longer where reasonably needed for product, security, accounting or legal reasons. Rental documents may also be retained while reasonably needed for the rental, dispute handling, fraud prevention or legal obligations, subject to applicable law and merchant responsibilities.

11. Security

We use reasonable technical and organisational safeguards designed to protect information, including authenticated merchant access, tenant-scoped controls, restricted service credentials, access controls, private storage for sensitive uploads, including rental documents, and token-gated customer status pages where appropriate.

No online system can be guaranteed completely secure. Merchants should use strong passwords, protect account credentials and private links, and avoid collecting or uploading information that is not needed for the transaction or service.

12. Your choices and rights

Subject to applicable law and relevant exceptions, you may have rights relating to your personal data, including requesting access or correction and withdrawing consent where processing is based on consent. Withdrawal does not affect processing already carried out lawfully and may prevent use of a feature that depends on that information.

Customers should normally contact the relevant merchant first where a request concerns data held for that merchant's order, booking, rental or service relationship. For KADAI account-level or platform-level privacy requests, contact support@kadaiku.online.

13. WhatsApp and communications

Manual WhatsApp links may open a conversation between a customer and merchant outside KADAI. Eligible merchants may also use official WhatsApp Business automation. Merchants are responsible for using messaging tools appropriately and obtaining any consent or opt-in required for their communications.

KADAI service or security messages may be sent where reasonably necessary to operate or protect an account. Marketing messages, where used, should provide any choices required by applicable law.

14. Children and school transport

KADAI is a business and commerce platform and is not intended for children to create merchant accounts. A parent, guardian or transport merchant may provide a child's/passenger's name, school/destination and schedule where reasonably needed for a transport arrangement and where the person providing it has appropriate authority.

Parent Pass links should be kept private. Live GPS, when used, tracks the driver's shared device for a trip; it is not designed to continuously track a child or passenger. If you believe a child's personal data has been provided inappropriately, contact us so the situation can be reviewed.

15. Changes to this policy

We may update this Privacy Policy as KADAI changes or legal requirements evolve. We will update the date at the top of this page and, where appropriate, provide additional notice of material changes.

16. Contact

For privacy questions or requests, contact IZIRA at support@kadaiku.online. Please do not send passwords, PINs, one-time codes, full bank credentials or other unnecessary sensitive information in a support request.

See also our Terms of Use.