Sub-processors
The third parties that process personal data on our behalf, as required by Article 28(4) of the GDPR.
- Effective
- September 4, 2026
- Entity
- Antigravity
- Jurisdiction
- India
- Applies to
- kafei.in
1. How to read this page
Under our Data Processing Addendum, we act as a processor for the data you and your guests put into Kafei. The companies below are our sub-processors: each one is bound by a written agreement no less protective than the DPA, and each only receives the data it needs for the purpose listed.
2. Current sub-processors
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase (PostgreSQL) | Primary application database and file storage | Account, restaurant, order, and guest data | India / Singapore |
| Vercel | Web application hosting and CDN | Request metadata, IP addresses, access logs | Global edge |
| Railway | API and background worker hosting | Application data in transit, server logs | Singapore / EU |
| Cloudflare | DNS, TLS termination, DDoS protection | IP addresses, request metadata | Global edge |
| Google LLC | Google Sign-In (OAuth 2.0) identity verification | Email address, name, profile picture | Global |
| Google (Gemini API) | AI forecasting and copilot responses | Prompt content for the requested feature only | Global |
| Razorpay | Subscription and in-restaurant payment processing (India) | Billing contact, payment instrument, transaction records | India |
| Stripe | Subscription payment processing (international) | Billing contact, payment instrument, transaction records | US / EU |
| Email and SMS delivery providers | Transactional email, OTP, and order status messages | Email address, phone number, message content | India / US |
3. Data obtained through Google Sign-In
The email address, name and profile picture we receive when you sign in with Google are stored only in our own database (Supabase) and are used for authentication and for showing you in your workspace. They are not passed to any advertising provider, data broker, or AI model provider, and they are not part of any prompt sent to the Gemini API. See the Privacy Policy for the full Limited Use commitment.
4. Changes and objections
We will post any new or replacement sub-processor on this page at least 30 days before it starts processing customer data. To be notified by email when this page changes, write to privacy@kafei.in and ask to be added to the sub-processor notification list.
If you have a reasonable, documented objection to a new sub-processor on data protection grounds, tell us within those 30 days. We will work with you on a commercially reasonable alternative, and if none exists you may terminate the affected subscription with a pro-rated refund of the unused prepaid term.
5. International transfers
Where a sub-processor stores or accesses personal data outside the country it was collected in, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the technical measures described in our Security Policy.
Questions about this policy?
Write to us for data subject requests, deletion requests, security reports, or compliance reviews. We respond within 5 business days.
Antigravity, Kolkata, West Bengal, India