Sub-processors
Contents
5 sections, 0 numbered clauses
Contents
Last updated 14 September 2026
Version 1, effective 14 September 2026
About this page
This page lists the third-party sub-processors Kapsule Group Limited ("KapsuleHost") currently engages to process personal information on behalf of our customers. It is maintained in accordance with clause 5 of the Data Processing Agreement.
We will notify you of any addition or material change to this list at least thirty (30) days before the new sub-processor begins processing. Notification is automatic, by email to your account address, and by update to this page; you do not need to request it.
If you object to a new sub-processor on reasonable grounds, email privacy@kapsulehost.com before the date given in that notice. See clause 5.4 of the Data Processing Agreement for what happens next.
Current sub-processors
| Sub-processor | Purpose | Primary location |
|---|---|---|
| Hetzner Online GmbH | Server infrastructure: all customer sites, databases, and email are hosted on Hetzner dedicated and cloud servers, and Hetzner keeps daily backups of some of those servers; Hetzner Object Storage holds encrypted email backups, stored in Helsinki, Finland | EU, US, Asia-Pacific |
| Cloudflare, Inc. | R2 object storage for encrypted off-site backups: customer sites, databases and managed servers stored with an Oceania location hint, our own platform databases with a Western Europe location hint, and our object storage service with an Asia-Pacific location hint | United States |
| BunnyWay d.o.o. | Content delivery network (CDN), edge caching, and DDoS protection for customer sites and the marketing site | Slovenia (EU) |
| Stripe, Inc. | Payment processing and subscription billing | United States |
| Hosting Concepts B.V. (Openprovider) | Domain registration, renewal, and DNS management | Netherlands (EU) |
| Stalwart Mail Server (self-hosted) | Customer email hosting: IMAP, SMTP, and webmail for customer mailboxes (operated on Hetzner infrastructure) | EU |
| Resend, Inc. | Transactional outbound email: account notifications, billing emails, password resets, and other service emails | United States |
| Anthropic, PBC | Large language model API powering Kora, our AI customer-support assistant | United States |
| Sentry (Functional Software, Inc.) | Error tracking and application performance monitoring | United States |
| GitHub (Microsoft Corporation) | Source code hosting and automated daily backups of the KapsuleHost platform codebase; OAuth sign-in ("Sign in with GitHub"); and repository access for Orbit deployments, where GitHub receives the authorisation you grant and returns the repository contents Orbit builds | United States |
| Apple Inc. | Authentication email relay via Apple Private Relay, for customers who use "Sign in with Apple" to access KPanel | United States |
| Google LLC | OAuth sign-in ("Sign in with Google") for customers who authenticate to KPanel with a Google account, and PageSpeed Insights performance checks, which send Google the address of the site being checked | United States |
| Discord Inc. | OAuth sign-in ("Continue with Discord") for customers who create or access a KPanel account with a Discord account; Discord returns the account id, username, and verified email address | United States |
| Twilio Inc. | Delivery of one-time verification codes by SMS and WhatsApp for two-factor authentication and account verification; Twilio receives the mobile number you provide for that purpose | United States |
| Intuition Machines, Inc. (hCaptcha) | Bot and abuse defence on sign-up and checkout; hCaptcha receives your IP address and browser interaction signals when a challenge is presented | United States |
| Better Stack, Inc. | Synthetic uptime monitoring of customer websites from multiple regions; the monitor carries the site address and its account identifier | United States |
| Atlassian, Inc. (Bitbucket) | Repository access for Orbit deployments, for customers who connect a Bitbucket account; Atlassian receives the authorisation you grant and returns the repository contents Orbit builds | United States |
| fal (Features & Labels Inc.) | Image generation and image editing in Kapsule Agents; receives the prompt you write and any source image you supply | United States |
| Tillify | Payment initiation for New Zealand customers who pay an invoice by direct bank transfer | New Zealand |
Changes to this list taking effect
The entries below are being added to this list, or their description updated. Some of them already process customer personal information for the purpose shown: this list was incomplete, and it is being corrected with the notice that clause 5.3 of the Data Processing Agreement requires. Each entry forms part of the list above from the date given in that notice.
For accounts opened on or after 26 September 2026, these entries apply from the day the account is opened. The line below applies to accounts opened before 26 September 2026.
These entries take effect thirty (30) days after we notify customers by email. That notice has not been sent yet; this page will show its date once it has.
| Sub-processor | Purpose | Primary location |
|---|---|---|
| PayPal Pte. Ltd. | Payment processing for customers who choose to pay with PayPal at checkout; PayPal receives the payer's name, email address and the amount | Singapore (processing in the United States and other countries) |
| Sampark, Inc. (Composio) | Connection of third-party app accounts to Kapsule Agents; Composio stores the authorisation you grant each connected app and relays the requests an agent makes to it | United States |
| Telegram Messenger Inc. | Delivery of support conversations with Kora for customers who contact us through Telegram; and every live-chat request from the website or KPanel, which reaches our support staff in Telegram with the visitor's email address, if given, and their last four messages (up to 120 characters each); when our staff accept a request, the rest of that live chat is relayed through Telegram in full | Outside the EEA; Telegram does not publish the jurisdiction of this entity (its group companies are in the British Virgin Islands and Dubai, United Arab Emirates) |
| GitLab Inc. | Repository access for Orbit deployments, for customers who connect a GitLab account; GitLab receives the authorisation you grant and returns the repository contents Orbit builds | United States |
| Cloudflare, Inc. | R2 object storage, which holds: encrypted off-site backups of customer sites, databases and managed servers, stored with an Oceania location hint, and email backups made before 25 September 2026 until they expire; encrypted backups of our own platform databases, stored with a Western Europe location hint; encrypted backups of our object storage service, stored with an Asia-Pacific location hint; the site backups you create in KPanel; files you upload when you migrate a site to us, and files uploaded to KPanel and the Sites builder; the account data exports you request; archived server logs; and, for Orbit, your project source code, build output and build logs, and the objects you store. Also Turnstile bot checks on reseller sign-up, which receive the visitor's IP address | United States |
| Google LLC | OAuth sign-in ("Sign in with Google") for customers who authenticate to KPanel with a Google account, and PageSpeed Insights performance checks, which send Google the address of the site being checked; address suggestions at checkout, which send Google the address you type; and web fonts on some pages, which Google serves to your browser | United States |
| BunnyWay d.o.o. | Content delivery network (CDN), edge caching, and DDoS protection for customer sites and the marketing site; and a standby copy of the DNS records of every domain whose DNS we host, kept on BunnyWay's name servers so that we can switch a domain to them if our own name servers cannot answer | Slovenia (EU) |
| Apple Inc. | Authentication through "Sign in with Apple", for customers who use it to access KPanel: Apple returns your Apple account identifier and the name and email address you choose to share, and, where that address is an Apple Private Relay address, relays our emails to you | United States |
| Twilio Inc. | Delivery of one-time verification codes by SMS and WhatsApp for account verification and two-factor authentication, and checking a mobile number's line type (Twilio Lookup) to prevent fraud and abuse; Twilio receives the mobile number you provide for those purposes | United States |
International transfers
Some sub-processors are located outside New Zealand. Where personal information is transferred internationally, we ensure comparable safeguards apply as described in clause 9 of the Data Processing Agreement and clause 7 of the Privacy Policy.
Sub-processors in the European Union or Switzerland are subject to the GDPR or a comparable privacy framework. Sub-processors in the United States are subject to contractual safeguards, including by reference to Standard Contractual Clauses where appropriate.
Changes to this list
We will update this page when sub-processors are added, removed, or their details change materially. We will notify customers by email at least thirty (30) days before a new sub-processor begins processing Customer Personal Information, or a material change to an existing sub-processor takes effect, as set out in clause 5.3 of the Data Processing Agreement.
If you have concerns about a sub-processor, please email privacy@kapsulehost.com.
Eleven documents, and none of them is behind a login.
Every one is indexed, searchable by word, and deep linkable by clause. Six of them are not in the footer and this is how you reach them.