Cross-Border Data Transfer Policy

When personal data leaves India or your country, and the safeguards we apply.

Effective date and version: September 20, 2026 (Version 1.0). This document is available in English only and forms part of, and shall be read together with, the Terms of Service and the Privacy Policy.

1. Purpose

1.1 This Policy expands Section 7 of the Privacy Policy.

2. When Transfers Occur

2.1 Personal Data may be processed on servers located outside the Data Principal’s home country, including by the Company’s messaging provider (Meta, for WhatsApp), its authentication provider (Google Firebase) and its AI providers (OpenAI and Google). The current list of providers, with the location of the data, is on the Sub-Processors page.

2.2 The Company does not sell Personal Data.

3. Safeguards

3.1 The Company applies the following safeguards:

  1. the Company never collects a child’s legal name; content sent for AI processing is identified only by a display name or profile;
  2. only the data needed for the purpose is sent (for example, only the parent’s mobile number and the message content to the messaging provider, and no child data at all to the authentication provider);
  3. data is encrypted in transit; and
  4. transfers of the Personal Data of Indian Data Principals outside India are made in accordance with Section 16 of the Digital Personal Data Protection Act, 2023 and any restriction the Government of India notifies under it.

3.2 For data of persons in the European Union or European Economic Area, transfers outside the EEA are to be governed by Standard Contractual Clauses. These are in the course of being finalised and are not yet fully executed with every provider.

3.3 No signed data processing agreement is yet in place with the providers named above; their services are used on their standard, publicly available terms. This Policy will be updated as agreements are signed.

4. Questions

4.1 Questions about transfers may be sent to dpo@khypri.com.

Select Language