Legal
Sub-processors
The third-party service providers YBAWS Inc. (operating as Capital Toolkit) relies on to deliver the platform.
Last updated: April 29, 2026
How we use sub-processors
Capital Toolkit relies on a small set of trusted vendors to operate the platform. We share personal information with these vendors only to the extent necessary to deliver the service you signed up for, and only under written contract terms that require PIPEDA-equivalent protections.
We do not sell personal information. We do not use it for advertising. We do not share it with third parties outside of the list below without your authorization.
Current sub-processors
| Provider | Purpose | Data categories | Region | Status |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, edge delivery, build infrastructure | Page requests, IP address, request logs | United States (global edge), data primarily in-region | Active |
| Supabase Inc. | Authentication, application database, encrypted file storage | Account credentials (hashed), application data, uploaded documents (T1/T2, financials, supporting docs) | AWS Canada (Central), Toronto (ca-central-1) | Active |
| Resend Inc. | Transactional email (magic-link sign-in, application status) | Email address, message metadata | United States | Active |
| Anthropic, PBC | AI-assisted business plan drafting (the Claude assist sidebar inside the apply funnel) Used only when an applicant explicitly invokes the assist feature. Disabled for accounts that opt out. | Business plan section drafts, applicant-supplied context. No system training on inputs (zero-data-retention configuration). | United States | Active |
| Plausible Insights OÜ | Privacy-respecting site analytics (cookieless, no cross-site tracking) Only loaded when NEXT_PUBLIC_PLAUSIBLE_DOMAIN is set. No cookies, no personal information collected. | Aggregated page-view counts, anonymized referrer | European Union (Estonia / Germany) | Conditional |
Notice of changes
We will update this page at least 30 days before adding a material new sub-processor that handles personal information, or before transferring personal information to a new region. If you would like to be notified by email when this list changes, write to privacy@capitaltoolkit.com and ask to be added to the sub-processor change-notice list.
Questions, objections, requests
If you object to a sub-processor handling your personal information, contact our Privacy Officer at privacy@capitaltoolkit.com. You also have the right to access, correct, or delete the personal information we hold about you. See the Privacy Policy for details, or use the data request form for access and erasure requests.