Sub-Processor List
Plain-language summary
Capsure uses a small number of carefully selected vendors to run our Service. This page lists every sub-processor that may process personal data on our behalf, their purpose, and the data locations involved.
This page lists the third-party sub-processors Capsure (operated by Brilliant Monkey, LLC) currently authorizes to process personal data on our behalf. It is a supplementary notice to our Privacy Policy (§ 7).
1. Current sub-processors
| Sub-processor | Entity country | Purpose | Data location | Privacy / DPA |
|---|---|---|---|---|
| Stripe, Inc. | United States | Payment processing; affiliate payouts via Stripe Connect | United States | stripe.com/privacy |
| Cloudflare, Inc. | United States | DNS, content delivery network (CDN), DDoS protection, origin IP masking, bot mitigation | Global edge network | cloudflare.com/privacypolicy |
| Amazon Web Services, Inc. | United States | Object storage (Amazon S3) for photo and video uploads; transactional and bulk email delivery (Amazon SES) | United States (us-east-1 / us-east-2) | aws.amazon.com/privacy |
| Functional Software, Inc. (Sentry) | United States | Error tracking and application performance monitoring. Note: We are actively migrating Sentry to self-hosted infrastructure; this entry will be removed when the migration is complete. | United States | sentry.io/privacy |
No advertising or analytics sub-processors. We do not use Google Analytics, Meta Pixel, LinkedIn Insight, Mixpanel, Amplitude, PostHog, Segment, or any equivalent third-party analytics or advertising service.
2. Update notifications
We update this list when we add or remove a sub-processor. Where required by our agreements or applicable law, we will provide advance notice of new sub-processors (typically 30 days for customers subject to a Data Processing Agreement). We will update the "Last Updated" date at the top of this page when any change occurs.
If you wish to object to a new sub-processor, contact [email protected].
3. Data transfer safeguards
For transfers of personal data from the EEA, UK, or Switzerland to sub-processors located in the United States, Capsure relies on:
- the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor); and
- for UK-to-US transfers, the UK International Data Transfer Addendum to the EU SCCs (adopted by the UK ICO).
You may request a copy of any executed SCCs or addenda by emailing [email protected].
4. Contact
Brilliant Monkey, LLC6597 Janero Bay South, Cottage Grove, MN 55016, USA
[email protected]