Legal
Sub-processors
The third-party service providers YBAWS! Inc. (operating as Capital Toolkit) relies on to deliver the platform.
Last updated: August 16, 2026
How we use sub-processors
Capital Toolkit relies on a small set of trusted vendors to operate the platform. We share personal information with these vendors only to the extent necessary to deliver the service you signed up for, and only under written contract terms that require PIPEDA-equivalent protections.
We do not sell personal information. We do not use it for advertising. We do not share it with third parties outside of the list below without your authorization.
Current sub-processors
| Provider | Purpose | Data categories | Region | Status |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, edge delivery, build infrastructure | Page requests, IP address, request logs | United States (global edge), data primarily in-region | Active |
| Supabase Inc. | Authentication, application database, encrypted file storage | Account credentials (hashed), application data, uploaded documents (T1/T2, financials, supporting docs) | AWS Canada (Central), Toronto (ca-central-1) | Active |
| Resend Inc. | Transactional email (magic-link sign-in, application status) | Email address, message metadata | United States | Active |
| Anthropic, PBC | AI features: business-plan drafting (apply funnel) and Tool Master (marketing site + Toolbox chat assistant) Apply-funnel assist runs only when an applicant explicitly invokes it, and can be disabled by opting out. Tool Master runs only when a visitor opens the chat; the name and email collected before chatting go to our email provider (see Resend, above), not to Anthropic. Tool Master never receives PREC/Articles document text, that's analysed entirely in your browser and never sent to us or any vendor. | Business-plan section drafts and applicant-supplied context (apply funnel); message text you type into Tool Master. No system training on inputs (zero-data-retention configuration). | United States | Active |
| Plausible Insights OÜ | Privacy-respecting site analytics (cookieless, no cross-site tracking) Only loaded when NEXT_PUBLIC_PLAUSIBLE_DOMAIN is set. No cookies, no personal information collected. | Aggregated page-view counts, anonymized referrer | European Union (Estonia / Germany) | Conditional |
Notice of changes
We will update this page at least 30 days before adding a material new sub-processor that handles personal information, or before transferring personal information to a new region. If you would like to be notified by email when this list changes, write to privacy@capitaltoolkit.com and ask to be added to the sub-processor change-notice list.
Questions, objections, requests
If you object to a sub-processor handling your personal information, contact our Privacy Officer at privacy@capitaltoolkit.com. You also have the right to access, correct, or delete the personal information we hold about you. See the Privacy Policy for details, or use the data request form for access and erasure requests.