Service Providers and Data Recipients
1. Why This Page Exists
Most privacy policies say "we use trusted third parties" and stop there, which tells you nothing. This page names them, says what each one does, and says what each one is barred from doing. If a company is not on this page and it is not a provider you personally asked to be matched with, it should not have your data.
This page was incomplete until this revision, and Banrox says so rather than quietly add the rows. Four outside companies were processing information from this site and were not named here: Microsoft Clarity, Google Analytics 4, OpenAI and Anthropic. Banrox's own behaviour measurement was not described either. This revision adds five more that were also running and also unnamed: the advertising networks Meta, TikTok, Reddit, Microsoft Advertising and LinkedIn, whose pixels load by default for United States visitors until they opt out, and after Accept all for everyone else. All of them are in the table below, and the behaviour measurement is described in full at Cookie and Tracking Technologies Notice. The promise in the paragraph above is only worth something if a gap in it is admitted when it is found, so this is the admission.
Banrox sets itself the target of reviewing this list at least once a quarter, and updates it in the same release as any change to the vendors in use. That is a target Banrox sets for itself, not a duty any law imposes, and the way to test it is the reporting route in section 3 rather than Banrox's word for it.
2. The Contract Floor Every Provider Sits On
Banrox requires every company below to:
- use Banrox data only to deliver its service to Banrox
- never sell it
- never share it for advertising. There is one exception and it is in your hands: the advertising measurement built into Google Analytics 4, which for United States visitors runs by default until you opt out and for everyone else runs only if you choose Accept all, and which you can switch off from Cookie Settings or the Do Not Sell or Share My Personal Information link in the footer
- never use it to build, train or improve any product or model for anyone else, including its own. Two exceptions are stated openly rather than buried: the narrow combination California permits a service provider at 11 C.C.R. section 7050(b), which covers detecting security incidents and protecting against fraud and nothing else, and the companies marked yes in the last column of the table below
- keep it secure, to a standard at least as strong as the one described at Security and Vulnerability Disclosure
- tell Banrox promptly about any security incident affecting Banrox data
- help Banrox answer your privacy requests
- delete or return it when the contract ends
- bind any subcontractor to the same terms and remain responsible for it
These are the terms California law requires for a "service provider" or "contractor," and the equivalent terms other state laws require for a "processor."
Where the floor is different, and why. Some of the companies below run services that only work by comparing signals across many clients. Fraud detection, bot blocking, identity verification, credit reporting and web measurement are all built that way, and a provider of one of them will not sign a promise never to combine what it sees with anything else, because combining is the product. Where that is true, Banrox says so in the table rather than claim a restriction Banrox did not obtain. A fraud and identity network is a legitimate thing for a company to use. Claiming a restriction you did not get is not.
So the table below carries a column saying, for each company, whether it combines what it sees with signals from its other clients or from other sources. Where the answer is yes, that use sits outside what Banrox can control: the company does it under its own terms and its own legal obligations, and Banrox tells you rather than imply otherwise. The rest of the floor still binds that company, including the bar on selling your information.
3. Who Processes What
| Category | Provider | What it does for Banrox | Data it can see | Combines signals across clients |
|---|---|---|---|---|
| Cloud hosting and storage | Amazon Web Services | Runs the servers, databases and backups | All stored data, encrypted at rest | No |
| Edge security and delivery | Cloudflare, including the Turnstile check on the squad signup form | Blocks bots, denial of service and scraping, delivers pages, and checks that a signup is a person | IP address, request metadata, and the result of the Turnstile check | Yes. Cloudflare's threat intelligence is built from traffic across its whole network, which is how edge protection works |
| Credit data | Array, and the nationwide consumer reporting agencies it connects to | Retrieves your credit report and score at your written request and powers monitoring alerts | Identity details needed to locate your file, and the file itself | Yes. A consumer reporting agency assembles your file from many sources by design, and it does that under the Fair Credit Reporting Act rather than under a Banrox contract |
| Bank account connection | Plaid | Connects an account you choose so balances and transactions can appear in your dashboard | Account and transaction data you authorise. Banrox never sees your bank login | Yes. Plaid is not only a Banrox service provider. It has its own direct relationship with you under its own end user privacy policy, and that policy governs what it does with the connection you make |
| Identity verification | LexisNexis Risk Solutions | Confirms you are who you say you are before your file is retrieved. If Banrox routes a check to a different identity provider, that provider has to be named in this table first | Name, address, date of birth, Social Security number, verification answers | Yes. Identity verification works by comparing what you give against records drawn from many sources, and the provider carries its own legal obligations for those records |
| Fraud and device intelligence | Fingerprint, IPQualityScore | Detects bots, account takeover and fraudulent signups | Device and network signals, IP address. Not used for advertising | Yes. A fraud network only works by comparing signals across many clients, and these two do exactly that |
| Payments | Stripe, and Tilled where a merchant service is used | Takes subscription payments and issues refunds | Payment method token, amount, billing contact. Banrox does not store full card numbers | Yes, for payment fraud prevention across their own networks |
| Email delivery | Resend | Sends account, security, billing and alert email | Email address, message content, delivery events | No |
| Phone verification and telephony | Twilio, Dialpad | Sends one time codes, verifies phone numbers, carries support calls, and stores the recording of a call that is recorded | Phone number, message and call metadata, and the recording where a call is recorded | No, beyond the network level abuse prevention a messaging or voice carrier runs on its own traffic |
| Analytics and advertising measurement | Google Analytics 4 | Aggregate measurement of which pages and journeys work. For United States visitors its advertising features run by default until you opt out; for everyone else Accept all turns them on | Page and event data, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on a page showing your credit or account data | Yes. Google measures across the sites that use it; for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Advertising measurement | Google LLC (Google Ads) | Tells Google Ads that a visit or a Squad signup followed one of its adverts, so Banrox can stop paying for adverts that do not work | The address of the page, your browser's own details and the name of the event, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on an application, sign in, sign up or signed-in page. Never your name, email address or telephone number, and never any identifier derived from them | Yes. It measures across the sites that use its pixel, and for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Advertising measurement | Meta Platforms, Inc. (Facebook, Instagram) | Tells Meta that a visit or a Squad signup followed one of its adverts, so Banrox can stop paying for adverts that do not work | From the pixel: the address of the page, your browser's own details and the name of the event, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on an application, sign in, sign up or signed-in page. From Banrox's server, only while server events are switched on, only for Squad waitlist sign-ups and under the same consent rule: a one-way SHA-256 hash of your email address and of your member number, your browser's details, and whether you joined or confirmed. Never your name or telephone number, and never any credit or financial information | Yes. It measures across the sites that use its pixel, and for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Advertising measurement | TikTok Inc. | Tells TikTok that a visit or a Squad signup followed one of its adverts, so Banrox can stop paying for adverts that do not work | The address of the page, your browser's own details and the name of the event, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on an application, sign in, sign up or signed-in page. Never your name, email address or telephone number, and never any identifier derived from them | Yes. It measures across the sites that use its pixel, and for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Advertising measurement | Reddit, Inc. | Tells Reddit that a visit or a Squad signup followed one of its adverts, so Banrox can stop paying for adverts that do not work | From the pixel: the address of the page, your browser's own details and the name of the event, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on an application, sign in, sign up or signed-in page. From Banrox's server, only while server events are switched on, only for Squad waitlist sign-ups and under the same consent rule: a one-way SHA-256 hash of your email address and of your member number, your browser's details, and whether you joined or confirmed. Never your name or telephone number, and never any credit or financial information | Yes. It measures across the sites that use its pixel, and for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Advertising measurement | Microsoft Corporation (Microsoft Advertising) | Tells Microsoft that a visit or a Squad signup followed one of its adverts, so Banrox can stop paying for adverts that do not work | The address of the page, your browser's own details and the name of the event, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on an application, sign in, sign up or signed-in page. Never your name, email address or telephone number, and never any identifier derived from them | Yes. It measures across the sites that use its pixel, and for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Advertising measurement | LinkedIn Corporation | Tells LinkedIn that a visit or a Squad signup followed one of its adverts, so Banrox can stop paying for adverts that do not work | The address of the page, your browser's own details and the name of the event, loaded by default for United States visitors until they opt out and only after Accept all elsewhere, and never on an application, sign in, sign up or signed-in page. Never your name, email address or telephone number, and never any identifier derived from them | Yes. It measures across the sites that use its pixel, and for United States visitors this runs by default until you opt out, and for everyone else only after Accept all |
| Session behaviour | Microsoft Clarity | Heat maps and session replay, so Banrox can see where a page confuses people | Page interactions, and a one way hash of your email address when you are signed in. No field contents. In the United States it is loaded by default until you opt out, and only after Accept all elsewhere | Yes. Microsoft may use what Clarity collects for its own product purposes under Microsoft's own terms, which Banrox does not control |
| AI assistant in the card marketplace | Anthropic | Produces the answer you asked the credit card assistant for, using a Claude model. OpenAI no longer receives anything from Banrox | The text you type into that assistant and the product information Banrox sends with it. Barred from training on it | No |
| AI assistant in the insurance marketplace | Anthropic | Reads the words you type into the insurance assistant into fixed choices (coverage type, state, what matters), using a Claude model. The assistant's replies are templates, not model text | The text you type into that assistant. No account, policy or payment data. Barred from training on it | No |
| AI for internal Banrox tools | Anthropic | Summarises and ranks information for Banrox staff, including the ranking of identity alerts | The text Banrox sends it for that task, which can include information about your account and your alerts. Barred from training on it | No |
| Maps on the public site | OpenFreeMap | Draws the map of your area in the local complaints widget, from OpenStreetMap data | Your IP address and the map tiles your browser asks for, which show the area around the city your connection is in. Nothing you type, no cookies | No |
| Password check | Have I Been Pwned (Pwned Passwords) | Tells the password check whether a password appears in known data breaches | Your IP address and the first five characters of a one way fingerprint of the password you check, sent from your browser. Never the password, and never the rest of the fingerprint | No |
| Link check | abuse.ch (URLhaus), rdap.org | Says whether a link you paste is on a malware list, and how old its website is. Banrox never opens the link | The link you paste (URLhaus) and its domain name (rdap.org), sent from Banrox's servers. Nothing about you | No |
| Insurance quoting | None today. Banrox has not named a licensed quoting partner, here or on the insurance pages | Nothing, until a partner is named. Banrox is not an insurance producer and cannot produce a quote itself | Nothing, until a partner is named | Not applicable until a partner is named |
If a form asks for your details and does not name the company that will receive them, do not send it. That applies to the insurance quote forms above all, because no quoting partner is named today. Tell [email protected] and Banrox will either name the company on that page or take the form down.
Banrox's own behaviour measurement is not in this table, because no other company receives it. It runs on Banrox's own servers, carries no field contents, and is described in full at Cookie and Tracking Technologies Notice.
The rule this page is held to. Every company that processes personal information for Banrox belongs in the table above, by name and not by category. This page did not meet that rule until this revision, which is why the rule now comes with a way to test it: if you find a feature that uses a company not named here, that is a fault in this page. Report it to [email protected], and Banrox will correct the page and tell you what it found. Banrox sets itself five business days to do that.
Two other Banrox documents refer to "monitoring vendors" that watch sources for the identifiers you asked Banrox to watch. Any monitoring provider that is not one of the companies named above falls under the rule in the paragraph above: it has to be named in this table before it receives anything about you, and if it is not, that is a fault to report.
4. Companies That Are Not Service Providers
A lender, bank, card issuer, or insurer you ask to be matched with is not a Banrox service provider. It receives your request as an independent business and decides for itself what to do with it under its own privacy policy. That is why the transfer is treated as a sale under California law and why you get the opt out described at State Privacy Rights, even though you asked for it.
The hard limits on any such transfer. A referral never contains your Social Security number, a government ID number, a financial account number, a precise location, or anything taken from your credit report or your credit score, including anything derived from either. That limit is the same in the Privacy Policy and the GLBA Privacy Notice, and it applies whether or not Banrox is paid for the referral.
Data brokers we write to on your instruction under Privacy Protect are not service providers either. They receive a deletion demand about you, not a transfer of data for their use. See Identity Protection and Privacy Protect Service Terms.
5. Professional and Corporate Recipients
Auditors, insurers, banks, and outside counsel may see personal information where necessary and under a duty of confidentiality. In a merger, acquisition, financing, or sale of assets, information may transfer to the successor, which stays bound by the privacy policy under which the information was collected. We give notice before any material change in handling.
6. Ask Us About Your Own Data
Write to [email protected] and Banrox will tell you which of the companies in section 3 could have processed a given category of your information, and will tell you which ones actually did wherever Banrox's records show it. Where the records do not show it, Banrox will say that plainly rather than guess. This is free, and Banrox answers within the same deadline it answers any request about your own information, which is set out at State Privacy Rights.
7. Changes to This List
The rule Banrox works to is that this page is updated before a new vendor goes live, not after. That rule was broken before this revision, as section 1 records, so the honest version is this: Banrox updates the page with each release that changes the vendors in use, and Banrox has now put the reporting route in section 3 there so that a gap can be caught by you as well as by Banrox. When a vendor is removed, Banrox records the date of removal and requires deletion or return of the data.
If you want to know what this page said on a particular date, write to [email protected]. Banrox will send you the earlier text where it has it, and will tell you plainly where it does not.
