jobdownupThe third parties we use to run the service.
A subprocessor is a company we engage to process personal data on our behalf. Each one is bound by a data-processing agreement and is only allowed to process the data for the specific purpose listed below.
1. What a subprocessor is
Under GDPR Article 28, a controller (us) may engage processors (subprocessors) only under a written agreement that binds them to the same data-protection obligations. This page lists the current set. It is the source of truth — subprocessors added elsewhere without appearing here are a mistake we would want to hear about.
2. Current subprocessors
If you are relying on this list for a compliance review, request the latest version at contact@jobdownup.app.
| Vendor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting, edge network, CDN, functions, logs | IP address, request metadata, page views, application data at rest and in transit | USA / Global edge (EU regions available) | SCCs (Module 2), EU-U.S. DPF certified |
| Stripe Payments Europe, Ltd. | Payment processing, subscription billing, invoicing | Name, billing address, payment token, transaction amount, currency | Ireland / USA | SCCs, EU-U.S. DPF. Stripe stores card details; we never receive or store them. |
| Anthropic PBC | Role scoring, message drafting, interview coaching inference | Job listing text, redacted profile facets required for scoring, coaching prompts (no direct identifiers where avoidable) | USA / EU | SCCs + Anthropic zero-retention API terms (no training on customer inputs) |
| Resend | Transactional email (sign-in links, receipts, service notifications) | Email address, message content | EU (eu-west-1) | Processing in the EU region; SCCs where transfers apply |
| Meta Platforms Ireland Ltd. | Advertising measurement (Meta Pixel + Conversions API) | Post-consent (EU/UK) or opted-in (elsewhere) event data: ViewContent, StartTrial, Subscribe, with hashed email and UTM parameters | Ireland / USA | Data Processing Terms + SCCs, EU-U.S. DPF |
| Clerk, Inc. | Authentication, account and session management | Name, email address, password hash, sign-in metadata (IP, device, timestamps) | USA / EU | SCCs, EU-U.S. DPF |
| Neon, Inc. | Application database (managed Postgres) | Everything the product stores about you: CV and search profile, applications, generated documents, coach conversations, interview notes, imported contacts | USA (AWS us-east-1) | SCCs (Module 2). This is a transfer to a third country: the database holding your CV, applications and coach conversations is hosted in the United States. |
| Svix, Inc. | Webhook delivery from our authentication provider (e.g. account-deletion events) | Account identifier and event type only; no CV, application or message content | EU | SCCs; engaged as a subprocessor of our authentication provider |
| Google LLC (Google Workspace / Gmail API) | The mailbox behind support@jobdownup.app and the addresses published on the legal pages. Read keylessly over Workload Identity Federation so no key exists. | Everything a person sends to a published address — their email address, subject and message. Read-only: the scope is gmail.readonly and nothing here can send, modify, label or delete. | USA / Global (EU data regions available on Workspace) | EU Standard Contractual Clauses under the Google Workspace Data Processing Addendum |
3. How we notify of additions
Paid customers can subscribe to notifications of new subprocessors — email contact@jobdownup.app to be added to the list. We aim to give at least 30 days’ notice before engaging a new subprocessor that processes customer personal data, so you can raise an objection.
4. Legal safeguards for international transfers
Where a subprocessor is located outside the EEA/UK, we rely on appropriate safeguards: EU-U.S. Data Privacy Framework certification where available, otherwise the European Commission’s Standard Contractual Clauses together with a transfer risk assessment. See Privacy Policy §6.