Service Providers and Data Recipients
1. Why This Page Exists
Most privacy policies say "we use trusted third parties" and stop there, which tells you nothing. This page names them, says what each one does, and says what each one is barred from doing. If a company is not on this page and it is not a provider you personally asked to be matched with, it should not have your data.
This list is reviewed every quarter and is updated in the same release as any change to the vendors we use, so it does not drift away from reality between reviews.
2. The Contract Floor Every Provider Sits On
Every company below is contractually required to:
- use Banrox data only to deliver its service to Banrox, and for no purpose of its own
- never sell it, never share it for advertising, and never use it to build or improve a product for anyone else except as narrowly permitted by law
- never combine it with data from other clients or from other sources, except where the law expressly allows it for security
- maintain security measures at least as strong as the ones described at Security and Vulnerability Disclosure
- notify Banrox without undue delay of any security incident affecting Banrox data
- help us answer your privacy requests, and delete or return data when the contract ends
- bind any subcontractor to the same terms and remain responsible for it
These are the terms California law requires for a "service provider" or "contractor," and the equivalent terms other state laws require for a "processor." Where a company will not accept them, we do not use that company.
3. Who Processes What
| Category | Provider | What it does for Banrox | Data it can see |
|---|---|---|---|
| Cloud hosting and storage | Amazon Web Services | Runs the servers, databases and backups | All stored data, encrypted at rest |
| Edge security and delivery | Cloudflare | Blocks bots, denial of service and scraping, delivers pages | IP address, request metadata |
| Credit data | Array, and the nationwide consumer reporting agencies it connects to | Retrieves your credit report and score at your written request and powers monitoring alerts | Identity details needed to locate your file, and the file itself |
| Bank account connection | Plaid | Connects an account you choose so balances and transactions can appear in your dashboard | Account and transaction data you authorise. Banrox never sees your bank login |
| Identity verification | LexisNexis Risk Solutions and equivalent identity providers | Confirms you are who you say you are before your file is retrieved | Name, address, date of birth, Social Security number, verification answers |
| Fraud and device intelligence | Fingerprint, IPQualityScore | Detects bots, account takeover and fraudulent signups | Device and network signals, IP address. Not used for advertising |
| Payments | Stripe, and Tilled where a merchant service is used | Takes subscription payments and issues refunds | Payment method token, amount, billing contact. Banrox does not store full card numbers |
| Email delivery | Resend | Sends account, security, billing and alert email | Email address, message content, delivery events |
| Phone verification and telephony | Twilio, Dialpad | Sends one time codes, verifies phone numbers, carries support calls | Phone number, message and call metadata |
| Insurance quoting | The licensed quoting partner named on the insurance page at the time you use it | Produces quotes from carriers. Banrox is not an insurance producer | Only the details you enter into the quote form |
| Analytics | The analytics provider named in the cookie banner | Aggregate measurement of which pages work | Page and event data, loaded only after you consent |
| Advertising measurement | The advertising platforms named in the cookie banner | Measures whether an advert worked | Loaded only after you consent, and never on a page showing your credit or account data |
Where a row names a category rather than a company, the specific company in use is named on the page where the feature appears and in the cookie banner, so the name is always available at the point it matters.
4. Companies That Are Not Service Providers
A lender, bank, card issuer, or insurer you ask to be matched with is not a Banrox service provider. It receives your request as an independent business and decides for itself what to do with it under its own privacy policy. That is why the transfer is treated as a sale under California law and why you get the opt out described at State Privacy Rights, even though you asked for it.
Data brokers we write to on your instruction under Privacy Protect are not service providers either. They receive a deletion demand about you, not a transfer of data for their use. See Identity Protection and Privacy Protect Service Terms.
5. Professional and Corporate Recipients
Auditors, insurers, banks, and outside counsel may see personal information where necessary and under a duty of confidentiality. In a merger, acquisition, financing, or sale of assets, information may transfer to the successor, which stays bound by the privacy policy under which the information was collected. We give notice before any material change in handling.
6. Ask Us About Your Own Data
Write to [email protected] and we will tell you which specific companies processed a specific category of your information, and when. That is a stronger answer than this table, because it is about you rather than about the architecture, and it is free.
7. Changes to This List
When we add a vendor that will process personal information, this page is updated before the vendor goes live, not after. When we remove one, we record the date of removal and require deletion or return of the data. Prior versions of this page are available on request.