Compliance and GDPR
Find the legal frame, the sub-processors and where they run, and how to exercise data rights.
Updated 23 September 2026
On this page
- Why
- You decide what goes into the platform, so you need to know who processes it and where.
- How
- Kabaido processes on your instructions only; the legal pages carry the binding text.
Controller and processor
Kabaido is a UK service under UK GDPR and the Data Protection Act 2018. For the business data you load you are the controller and Kabaido the processor. We do not mine your catalogue, train on your quotes or build a dataset from what passes through.
Sub-processors
Kabaido uses five sub-processors, named in the data processing agreement: Supabase, Vercel, Stripe, Resend and Anthropic.
| Provider | For | Where |
|---|---|---|
| Supabase | the database and storage | EU: AWS Frankfurt (eu-central-1) |
| Vercel | hosting | UK: London |
| Stripe | payments | The provider's security page |
| Resend | The provider's security page | |
| Anthropic | AI | The provider's security page |
Only when you use them: Google for Gmail inbox sync; Microsoft for Microsoft 365 inbox sync. Meetings run on Google Meet and Kabaido keeps no recording.
We do not sell data and run no advertising trackers. Cookies are essential only.
Your rights
Access, correction, erasure, restriction, portability and objection are honoured: email hello@kabaido.com. You can also raise a concern with the ICO. If one of your own customers asks what you hold, you answer, and the export tools exist so you can.
The legal pages
- Privacy policy
- Data processing agreement, with a countersignable copy on request
- Terms of service
- Acceptable use
- Cookies
The certifications on the security page are each provider's own, as its security page states them, linked so you can check.