Privacy Policy

Last updated: 5 November 2026

This policy explains how Cadu handles personal data. It applies to you, the Cadu customer — the person who signs up to build a website using Cadu.

For information about how Cadu handles personal data submitted to a Customer's website by website visitors, see Section 8 below and the Data Processing Agreement.

1. Who we are

Cadu ("we", "us", "our") is a WhatsApp-based website builder. For the purposes of this policy, Cadu is the data controller of personal data relating to its customers and the operation of cadu.app.

Contact: [email protected]

2. What data we collect

When you use Cadu as a customer, we collect:

• Your WhatsApp phone number, used to identify your account and deliver responses.
• WhatsApp messages you send to Cadu, including text and media attachments. These are used to understand and carry out your website edits, and form part of your account history.
• Website content you create through Cadu, including HTML, images, and other assets published to your site.
• Account and usage data, including subscription status, message budget, language preferences, and operational logs needed to run the service.
• Payment information if you subscribe or purchase credits. Card details are processed directly by our payment processor (currently Dodo Payments, which is the merchant of record for all Cadu subscriptions); we never receive or store card details. From the payment processor we retain a customer ID, the email address you provided at checkout (so we can match billing support enquiries to your account), subscription status, billing period, and other basic billing metadata.
• Referral data, if you join via a referral link or refer others.
• Your Google Business Profile, if you connect it (Business plan). You add Cadu as a Manager on your listing through Google's own settings. We then read your listing's details (name, address, category, hours, phone, website, description) and its reviews, including each reviewer's name as Google shows it. We keep a copy of your listing's name, address and categories from when it was connected, a record of your messages confirming the connection and each change, and a history of every edit and review reply we send to Google for you. Google's notice for businesses that work with a third party explains your side of this: Working with a third party on your Business Profile.

3. Lawful bases for processing

We process your personal data on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract — to provide the Cadu service to you under our Terms of Service.
• Legitimate interests — to operate, secure, debug, and improve the service, to prevent abuse, to communicate operational updates, and to feature published Customer websites in our own marketing (see Section 4). Where we rely on legitimate interests, you have the right to object (see Section 6).
• Legal obligation — to comply with applicable law, including tax and accounting requirements for paid plans.
• Consent — where applicable for any non-essential processing that requires it. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How we use your data

• To build, edit, and host your website as you instruct via WhatsApp.
• To maintain version history so you can undo changes.
• To process payments and manage your subscription.
• To send you operational messages about your account and service.
• To detect and prevent abuse, fraud, and security incidents.
• To improve and debug the Cadu service.
• To manage your Google Business Profile as you instruct: change it only after you confirm each change, show you its reviews, post your replies, put reviews on your site when you ask, and let you know about new reviews. You can disconnect it at any time by asking Cadu, or by removing Cadu as a Manager in your Google settings. When it's disconnected, we stop accessing your listing. We keep the record of confirmations and changes as evidence of what you authorised, and delete it with the rest of your account.
• To feature your published website — images of it, its name, and any logos on it — in Cadu's own marketing, for example on our website, in social media posts, and in advertising. This covers only sites that are already publicly accessible, and we do not use photographs of identifiable people taken from your site unless you have separately agreed to it. The full terms of this are in Section 4 of our Terms of Service. You can tell us to stop at any time — by WhatsApp, or by emailing [email protected] — and we will stop featuring your site in new materials.

5. Sub-processors and third parties

We use a small number of trusted sub-processors to deliver the service. The current list is published at cadu.app/sub-processors and includes Cloudflare, Anthropic, Dodo Payments, Meta (WhatsApp), and GitHub.

If you connect your Google Business Profile, we exchange data with Google to manage it on your behalf; Google processes it under its own terms.

Some of these sub-processors are located outside the European Economic Area and the United Kingdom. Where personal data is transferred to such countries, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where applicable, the UK International Data Transfer Addendum, as the legal mechanism for the transfer.

6. Your rights

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with comparable data protection law, you have the following rights with respect to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to legal retention obligations.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — ask us to provide your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdrawal of consent — withdraw any consent you have given.
• Complaint — lodge a complaint with your local data protection supervisory authority. Cadu's lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). You can also complain to the supervisory authority in your country of residence.

To exercise any of these rights, email [email protected]. We will respond within one month.

7. Data retention

We retain your website content and message history for as long as your account exists. We do not set a fixed expiry on it, because we need it to keep your site running and to carry on the conversation where you left off.

Cancelling a paid subscription does not delete anything and does not take your site offline. Your site moves back to the free plan and stays live.

If you ask us to delete your account, we keep it recoverable for 14 days in case you change your mind. After that it is permanently deleted: your site, its repository, your message history and any form submissions your site collected. If you start setting up a site but never finish it, and we hear nothing from you for 45 days, we delete it in the same way.

We keep billing and payment records after deletion where the law requires it, for example for tax purposes.

8. Data on Customer websites

When visitors interact with a website built using Cadu — for example by submitting a contact form — Cadu processes that information on behalf of the Customer. In that role, Cadu acts as a data processor, and the Customer is the data controller.

If the Customer turns on Cadu's visitor statistics for their site, Cadu records each page a visitor views: the page's address, the website or app that sent them there, their country, and whether they are on a phone, tablet or computer. No cookies are used and nothing is stored on the visitor's device. To count how many different people visited each day, Cadu combines the visitor's IP address and browser details with a random key that changes every day and keeps only the short code that results. The IP address itself is not stored with these statistics, and each day's key is deleted after two days, after which no one, including Cadu, can tell which visitor a code belonged to or connect one day's visits to another's. Visits by search engines and other automated tools, including Cadu's own checks of the site, are not counted. The statistics are kept for about three months and are available only to the Customer.

Cadu's obligations as processor are set out in the Data Processing Agreement, which forms part of every Customer's Terms of Service. The Customer decides how long to keep submissions and can delete any of them at any time, on any plan including the free one; everything a site collected is deleted when the account is deleted. A file a visitor attaches to a form (a photo or a PDF) is delivered to the Customer and kept by Cadu for 30 days, then deleted automatically; it is deleted sooner if the Customer deletes the submission. If you are a website visitor and have a question about how your data is being handled, you should contact the operator of the website you visited. We will forward any direct requests we receive to the relevant Customer.

9. Security

We implement technical and organisational measures appropriate to the risk, including TLS encryption in transit, per-customer data isolation, restricted administrative access, and logging for incident detection. A summary of our security measures is set out in Annex 1 of the Data Processing Agreement. No system is perfectly secure, but we take reasonable steps to protect personal data.

10. Children

Cadu is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact [email protected] and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. If we make material changes, we will notify you via WhatsApp or email before the changes take effect.

12. Contact

For questions about this policy, to exercise your rights, or to raise a data protection concern, email [email protected].