Sub-processors
Every third party that may process personal data on Policy Monster’s behalf. The list is short by design, and two categories that would normally be on it — analytics and error tracking — are absent because we host that software ourselves.
Current sub-processors
A sub-processor is a third party we engage to process personal data on our behalf. This page is Annex III to the Data Processing Addendum, and it is the complete list. The last column says whether a provider touches only data about you as our customer, or also the personal data of your own users that we process as your processor.
| Provider | What it does | Data processed | Location | Applies to |
|---|---|---|---|---|
| Stripe, Inc. | Card payment processing for clause purchases, refunds, and receipts. Stripe collects your card details directly; they never pass through our systems. | Name, email address, billing address, payment method details, transaction history. | United States; Ireland for EEA customers | Our own customer data |
| PayPal, Inc. | PayPal payments for clause purchases, when you choose PayPal at checkout, and refunds of those payments. You sign in to PayPal on PayPal's own pages; your PayPal credentials and funding details never pass through our systems. | Name, email address, PayPal account and transaction identifiers, amount and currency of the payment. | United States; PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg for EEA customers | Our own customer data |
| SMTP2GO Limited | Delivery of transactional email — account verification, password resets, receipts and refund notices, policy-change notices, and the verification links sent to people who submit a privacy rights request to you. | Recipient email address and message content. | New Zealand; delivered through SMTP2GO's global sending network | Our own customer data, and yours |
| Cloudflare, Inc. | Turnstile bot protection on sign-in, sign-up, password reset and the public rights-request form, and network-layer protection for our domains. | IP address, browser and device signals, challenge result. | United States; processed at the nearest edge location globally | Our own customer data, and yours |
| DigitalOcean, LLC | AI inference for optional assistance features: explaining a questionnaire question, and classifying unrecognised third-party hosts found by the website scanner. It never writes or edits the text of a document. The model runs on DigitalOcean's own inference service. | The question being explained and the privacy laws your business selected; hostnames of third-party services found on a scanned website. No account details are sent. | United States | Our own customer data, and yours |
| [to be confirmed before launch] | Cloud infrastructure — the servers, managed network and block storage on which the application, the database and the backups run. | All data held by the Service, at rest and in transit through its network. | [to be confirmed before launch] | Our own customer data, and yours |
Each is engaged under a written contract imposing data protection obligations no less protective than those we owe you, including the Standard Contractual Clauses where the transfer requires them. We remain fully liable to you for their performance.
Things you would expect to see here, and why they are not
Two categories of vendor that appear on almost every list of this kind are absent, because we run the software ourselves rather than buying it as a service. No third party receives the data.
- Product analytics. We run Umami on our own infrastructure. It is cookieless, assigns no cross-site identifier, and is never loaded on hosted policy pages. No analytics vendor receives anything.
- Error tracking. We run Bugsink on our own infrastructure. Credentials, cookies and tokens are stripped from an event before it is stored, and user email and IP address are excluded by default. No error-tracking vendor receives anything.
Both decisions cost us operational effort. They are worth it: a privacy product that shipped its customers’ behavioural data to a third-party analytics vendor would be arguing against itself.
Third parties that are not sub-processors
Sign-in providers
If you sign in with Google or GitHub, that provider authenticates you and tells us your name, email address and account identifier. It is acting as an independent controller in its own relationship with you, not as our sub-processor, and its own privacy policy governs what it does. Using email and password avoids this entirely.
Your own vendors
Anything you connect to your own website, and anyone you send your exported documents to, is outside this list and outside our control.
Notice of changes
We give at least 30 days’ notice before a new sub-processor begins processing personal data. This page is updated at the same time, and its change history is part of our records.
To be notified by email, send a message with the subject “Subscribe: sub-processor notices” to privacy@policy.monster. We keep that list for this purpose only, and never use it for anything else.
Objecting to a sub-processor
You may object to a new sub-processor on reasonable data-protection grounds within the notice period, by writing to privacy@policy.monster. We will work with you in good faith on an alternative. If we cannot find one, you may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for the unused remainder of your term, as set out in the Data Processing Addendum.