Sub-processors
Kahu Group Limited uses a small number of service providers to run the kahu.dog website and the Kahu app. These providers process personal information only on our instructions, only to provide their service to us, and under contract terms that require them to protect it. We do not sell personal information and none of these providers may use it for their own marketing.
Most providers are in the United States, so personal information is processed outside New Zealand. We rely on the provider's contractual commitments to protect it in a way that, overall, provides comparable safeguards to the Privacy Act 2020.
For people in the United Kingdom or the European Economic Area, the last column records the safeguard we rely on when a provider receives personal information in the United States: certification under the EU-US Data Privacy Framework (and its UK Extension), or the European Commission's Standard Contractual Clauses (SCCs) with the UK Addendum, written into the provider's data processing agreement (DPA).
Website (kahu.dog)
Providers involved when you visit the website, join the waitlist or send a feature suggestion.
| Provider | What they do for us | Information involved | Location | UK and EEA transfer safeguard |
|---|---|---|---|---|
| Vercel | Hosts and delivers the website. Holds your IP address for up to one hour to limit repeated form submissions. | Page requests, IP address, form submissions | United States and global edge network | EU-US Data Privacy Framework and UK Extension (certified); SCCs in Vercel's DPA as fallback |
| Resend | Stores waitlist contacts and sends the waitlist confirmation email. | Name, email address, waitlist preferences | United States | EU-US Data Privacy Framework and UK Extension (certified); SCCs in Resend's DPA as fallback |
| Google Analytics | Page analytics, only after you accept analytics cookies. Runs in a cookieless mode until you do. | Page and event data, analytics cookie identifiers | United States | EU-US Data Privacy Framework and UK Extension (Google LLC certified) |
Kahu app and API (backend.kahu.dog)
Providers involved when you use the Kahu app. The app's own privacy policy is being finalised and will link here when it is published.
| Provider | What they do for us | Information involved | Location | UK and EEA transfer safeguard |
|---|---|---|---|---|
| Vercel | Hosts the API, runs scheduled jobs, stores photos and data exports (Vercel Blob), and routes Advisor requests to model providers (AI Gateway). | All information the app sends to or stores with Kahu | United States and global edge network | EU-US Data Privacy Framework and UK Extension (certified); SCCs in Vercel's DPA as fallback |
| Prisma Postgres | Primary database for accounts, Families, Pets and care records. | All information stored in your account | European Union (Frankfurt) | No transfer: hosted in the EU. Prisma's DPA (SCCs) covers any support access from the United States |
| Better Auth | Sign-in, sessions, Family invitations, and the email verification, change-of-email and password reset flows. | Email address, hashed password, session and device details, invitation emails | United States | SCCs (Module 2) and UK Addendum in Better Auth's DPA |
| Apple | Sign in with Apple. Address suggestions when you type a home address (Apple Maps Server API, called through our servers). | Name and email or private relay address at sign-in; the address text you type | United States | Apple Developer Program License Agreement data protection terms; Apple acts as an independent controller for Sign in with Apple |
| Sign in with Google. Places data for the vet clinic and nearby places directories. Driving time from your location to a saved clinic (Routes API, called through our servers). Static map images. | Name and email at sign-in; search location and clinic location for nearby and driving time requests | United States | EU-US Data Privacy Framework and UK Extension (Google LLC certified) | |
| OpenStreetMap Foundation | Map tiles and address lookup for the clinic address preview. | Clinic address text, device IP address | United Kingdom | No restricted transfer: UK based, covered by the EU adequacy decision for the UK |
| Expo | Delivers push notifications you have turned on. | Push token, device type, notification content | United States | SCCs (Module 2) incorporated in Expo's terms of service |
| Resend | Sends account and care emails (verification, invitations, deletion notices, export links). Alerts our team when the app reports a serious error. | Name, email address, email content | United States | EU-US Data Privacy Framework and UK Extension (certified); SCCs in Resend's DPA as fallback |
| Sentry | Crash and app-hang diagnostics. Default collection of personal information is turned off. Not used for analytics. | Crash reports, device model, OS and app version | European Union (Frankfurt) | No transfer for stored data: hosted in the EU. Sentry is also certified under the EU-US Data Privacy Framework and UK Extension |
| Model providers via Vercel AI Gateway (Anthropic, Google, OpenAI) | Generate Advisor replies and turn typed notes into structured entries. Content is used only to produce the reply and is not used to train models. | Your Advisor messages, the limited care record context retrieved for the reply, your Pet's name and species | United States | Onward transfer under Vercel's DPA and Data Privacy Framework certification; Kahu has no direct contract with the model providers |
Changes to this list
Payment providers (Apple App Store, Google Play, RevenueCat and Stripe), veterinary practice management systems and other integrations are not listed because those features have not launched. They will be added here when they do.
Replacing a provider with another that performs the same function updates this page. Adding a new kind of processing updates the privacy policy as well.
Questions about any provider on this list: privacy@kahu.dog.
Last updated 8 October 2026. See the privacy policy for how we use personal information.