Sub-processors
Last updated: 9 October 2026
Capital AI Srl uses the providers below to run KaizenProof. Each processes personal data only to provide its part of the service. Before a new sub-processor receives customer personal data, we add it to this page at least 30 days in advance and record the change in the change log at the bottom (see the Data Processing Agreement, section 7). Questions or objections: vincent@capital-ai.eu.
In use
Google Cloud and Firebase (Google)
| Purpose | Hosting of the web application (Cloud Run through Firebase App Hosting), database (Cloud Firestore), sign-in (Firebase Authentication), sign-in link emails (Firebase Authentication), secrets (Secret Manager), logs (Cloud Logging) |
|---|---|
| Data | Everything stored in KaizenProof: account data, workspace content (including each workspace's brand on templates: name, colours and logo), invitations, usage records. Firebase Authentication holds the email address, name, profile photo address, sign-in provider, IP addresses and browser type. Request logs hold IP addresses, browser type and URLs |
| Location | Database: europe-west1 (Belgium). Application: europe-west4 (Netherlands). Firebase Authentication: United States, according to Google. Request logs: Cloud Logging's default bucket, whose location is "global" (not limited to the EU), kept 30 days |
| Terms | Firebase Data Processing and Security Terms and the Google Cloud Data Processing Addendum, depending on the service |
| Transfer mechanism | Standard Contractual Clauses in Google's data processing terms; Google LLC is certified under the EU-US Data Privacy Framework |
Google Workspace (Google), email
| Purpose | Sends KaizenProof's emails other than sign-in links (welcome, check-in and invitation emails, and Capital AI's own notice of each new workspace) through Capital AI's Google Workspace mailbox, over SMTP |
|---|---|
| Data | Recipient email address and the email's contents: for check-ins, friction titles (up to 120 characters each), answer links and an unsubscribe link carrying the user id and a signature; for invitations, the inviter's email address, the workspace name, the invited address and the invitation link. A copy of each sent email stays in the mailbox's sent mail |
| Location | Google's data centres, which may be outside the EEA |
| Terms | Google Workspace terms and the Cloud Data Processing Addendum |
| Transfer mechanism | Standard Contractual Clauses in Google's data processing terms; Google LLC is certified under the EU-US Data Privacy Framework |
| Tracking | None: the emails carry no tracking pixel and their links are not rewritten |
Anthropic
| Purpose | The Claude model: classifies a friction's waste, asks the why questions, writes the root cause and the countermeasure; suggests possible duplicate frictions; writes the sentence of the weekly workspace summary from figures computed by our code |
|---|---|
| Data | Friction text, waste category, why questions and answers, root cause, rejected countermeasures and the reasons given, the preferred countermeasure type, and whether time figures were entered (yes or no, not the figures). For duplicate suggestions, the titles of other frictions in the same workspace (up to 80 characters, email addresses removed). For the weekly summary, figures and labels only. Not sent: names, email addresses, user ids, workspace name, the workspace's brand on templates or its logo |
| Location | Data at rest: United States. The analysis itself: United States. KaizenProof restricts processing to the United States on every request (inference_geo: "us") |
| Contracting entity | Anthropic Ireland, Limited (for customers in the EEA), per Anthropic's Commercial Terms |
| Retention at Anthropic | Inputs and outputs deleted within 30 days. If flagged under its usage policy, up to 2 years, and safety classification scores up to 7 years, per Anthropic's privacy centre |
| Training | Commercial Terms: "Anthropic may not train models on Customer Content from Services." (Checked 6 October 2026, terms effective 17 June 2025) |
| Terms | Anthropic Commercial Terms and Data Processing Addendum, which the Commercial Terms incorporate |
| Transfer mechanism | Standard Contractual Clauses, incorporated in Anthropic's Data Processing Addendum |
Stripe (payments)
| Purpose | Payments for paid plans, by the payment methods Stripe Checkout offers (cards and, where Stripe offers it, SEPA Direct Debit among them): Stripe Checkout, subscriptions and their renewal, SEPA Direct Debit mandates and the debit notices the SEPA rules require, retries of failed payments, invoices, and the Customer Portal where workspace owners change plan, update payment details and cancel. Used only for workspaces that buy a plan |
|---|---|
| Data | The billing email address (the email of the workspace owner who starts the purchase), the Customer's legal name, billing address and tax ID (for example a VAT number), payment method details (collected by Stripe on its own pages; we never receive a full card or account number), for a SEPA Direct Debit the mandate (the authorisation to debit the account, and when and how it was given), invoices and payments. The workspace's internal id and plan, as metadata. Not sent: the workspace name, the workspace's brand or logo, frictions or any other workspace content, member lists |
| Location | Stripe Payments Europe, Limited is in Ireland. Stripe transfers data to Stripe, Inc. and other companies in its group, including in the United States |
| Contracting entity | Stripe Payments Europe, Limited (Ireland), for accounts in the EEA |
| Role | Processor for Capital AI. For some purposes, such as fraud prevention, loss prevention and compliance with financial regulation, Stripe decides for itself how it uses the data, as an independent controller under the Stripe Privacy Policy |
| Retention | Invoices and payment records are kept 10 years, as Italian law requires for accounting records (see the Privacy Policy) |
| Terms | Stripe Services Agreement, Stripe Data Processing Agreement and Data Transfer Addendum (checked 7 October 2026; DPA last updated 28 September 2026) |
| Transfer mechanism | Stripe, Inc. is certified under the EU-US Data Privacy Framework; Stripe's Data Transfer Addendum adds the Standard Contractual Clauses in case the Data Privacy Framework cannot be relied on |
Website analytics, with consent
These two receive data about visitors to the public website only, and only after the visitor clicks "Accept analytics" (one answer covers both). They never run inside the app or once someone is signed in, so they receive no customer personal data. Details: Privacy Policy.
Google Analytics (Google)
| Purpose | Counting visits to the public website (page views and four events: landing viewed, intake viewed, pricing viewed, template downloaded) |
|---|---|
| Data | Visitors of the public pages who accepted analytics: page address without query string or fragment, page title, event names (template id and file format for downloads), a random browser identifier (_ga cookies, 13 months), browser, device, language, referrer, approximate location from the IP address. Never: anything from the signed-in app, user ids, names, email addresses, workspace data or friction text. Google signals, ad storage, ad user data, ad personalisation and data sharing with Google off |
| Retention | 2 months |
| Location | United States and other countries where Google processes data |
| Transfer mechanism | Google LLC is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses in Google's data processing terms |
Microsoft Clarity (Microsoft Corporation)
| Purpose | Heatmaps and recordings of how visitors move through the public website (clicks, scrolling, pointer movement, page layout) |
|---|---|
| Data | Visitors of the public pages who accepted analytics: page address, clicks, scrolling and pointer movement, page layout with all text masked (Clarity's Strict masking mode, and every input marked to be masked), a random browser identifier (_clck cookie, 1 year; _clsk cookie, 1 day), browser, device, screen size, referrer, approximate location from the IP address. Never: anything from the signed-in app, anything typed, user ids, names, email addresses, workspace data or friction text |
| Retention | Recordings 30 days; heatmaps and aggregate data 13 months, according to Microsoft |
| Location | United States |
| Transfer mechanism | Microsoft Corporation is certified under the EU-US Data Privacy Framework |
Not used
- Embeddings provider: not used. Duplicate suggestions use the Claude model above, not embeddings.
- Other analytics or advertising networks: none.
Not a sub-processor
- Google sign-in (the "Continue with Google" button): Google acts for itself as the provider of the user's Google account.
Change log
| Date | Change |
|---|---|
| 6 October 2026 | First published version |
| 6 October 2026 | Google Analytics switched on for public-website visitors who accept analytics (2-month retention, Google signals and advertising features off). Microsoft Clarity added on the same terms, with Strict masking. Neither receives customer personal data |
| 7 October 2026 | Stripe added for payments, as paid plans go on sale. It receives billing data only for workspaces that buy a plan, and no workspace content |
| 9 October 2026 | No provider added or removed. Stated more fully: a workspace's brand on templates (name, colours, logo) is stored in the database at Google Cloud and is sent to no other provider; Stripe keeps the mandate when a plan is paid by SEPA Direct Debit |