Section 01 / 02
GDPR Art 28
| Company | What it does | Data involved | Where | Transfer basis |
|---|---|---|---|---|
| Google (Firebase) | Authentication, database, file storage | Account details, CV content, analytics events, and any name or contact detail a reader typed into the optional card on a shared CV | United States / EU regions | EU–US Data Privacy Framework + Standard Contractual Clauses |
| OpenAI | AI writing, rewriting, grammar and tone review | The CV text you submit to an AI feature | United States | Standard Contractual Clauses; API data is not used for training |
| Stripe | Payments, subscriptions, billing portal | Email, billing details, payment method (we never see card numbers) | United States / Ireland | EU–US Data Privacy Framework + Standard Contractual Clauses |
| SendGrid (Twilio) | Transactional email — receipts, alerts, password resets | Email address, message content | United States | Standard Contractual Clauses |
| IPinfo | Country lookup for tracking events — nothing narrower is stored | IP address of a document viewer, at the moment of lookup | United States | Standard Contractual Clauses |
| Vercel | Application hosting and delivery | Request metadata, IP address | Global edge network | Standard Contractual Clauses |
Section 02 / 02
On transfers to the United States
Most of these vendors process data in the US. The European Commission’s adequacy decision for the EU–US Data Privacy Framework remains in force, and we rely on it where a vendor is certified. Because that decision is under appeal, we also keep Standard Contractual Clauses in place with every vendor as an independent fallback, so a change in the framework’s status would not leave transfers without a legal basis.