Subprocessors
Version 2026-07-12
CVSuite.ai uses the third parties below to deliver the service. Each processes personal data only for the stated purpose. We will keep this list current and notify institutions of material changes.
Active subprocessors
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Vercel | Hosting and running the application, including scheduled retention checks via Vercel Cron | Application traffic and operational metadata, including requests, responses, IP/device metadata, logs, and any personal data processed while using the application. | Application server functions are configured to run from Vercel's London region. Some provider operations, security, support, logging, analytics, edge/CDN, or administrative processing may occur outside the UK, subject to provider terms. |
| Neon | Managed PostgreSQL database hosting | Application database records, including user accounts, organisation data, experience/profile content, application records, consent records, audit records, feedback and pilot-request records, and related metadata. Original uploaded files are not stored. | Database hosting is configured to Neon's London region. Some provider operations, security, support, backup, or administrative processing may occur outside the UK, subject to provider terms. |
| OpenAI* | AI features including CV parsing, job-description analysis, role/company-context analysis, and application-tailoring assistance | CV/profile text; job-description, role/company context, and profile/experience text used for analysis or tailoring. | United States / global. UK data is transferred under the Standard Contractual Clauses with the UK Addendum, per OpenAI's data processing addendum. |
| Resend | Sending transactional and notification emails, including sign-in magic links and feedback / pilot-request notifications | Email addresses and email contents, including sign-in links and the details submitted in feedback or a pilot request (such as name, institution and message) | United States. Emails are sent from an EU (Ireland) region; Resend participates in the EU-US Data Privacy Framework and its UK Extension. |
*How AI inputs are handled (training, storage, data minimisation and the controls you retain) is set out in the AI Use Transparency section of the Privacy Notice.
Questions
For the current subprocessor list or for queries/concerns, contact privacy@cvsuite.ai.