Sub-processors

Sub-processors

A sub-processor is a company we use to run this service that may handle personal data on our behalf. This page lists them: what each one does, where it processes data, and what makes any transfer outside the European Economic Area lawful. It is the list the privacy notice promises.

We keep it current. Where a provider is established outside the EEA, we rely on the European Commission's standard contractual clauses, on an adequacy decision where one applies, and on the provider's own data processing agreement.

Vercel

Application hosting. Vercel runs the web application and its serverless functions, so everything you send to the service passes through it in transit.

Processed in the European Union. Vercel is established in the United States; transfers are covered by the standard contractual clauses and its data processing agreement.

Stripe

Payments and subscription billing. Stripe processes card details and billing information for customers who pay for the service. We never see or store a card number.

Processed in the European Union by Stripe Payments Europe. Where Stripe group companies outside the EEA are involved, transfers are covered by the standard contractual clauses.

Resend

Transactional e-mail. Resend delivers the messages the service sends to its customers: address verification, password resets, invitations, billing receipts and search alerts.

Processed in the European Union. Resend is established in the United States; transfers are covered by the standard contractual clauses.

OVHcloud

Managed database, cache, search and language model inference. OVHcloud hosts the Postgres database that holds accounts, saved searches, credit ledger entries and revealed contact records, together with the cache, the search index and an archive of the raw job data we buy. We also send it job advertisement text to work out which company is hiring, and the text of a CV when a customer uploads one to build a search. Contact details are never sent to the language model.

Processed in Germany and France, by a French company. Nothing leaves the European Economic Area, which is why this provider was chosen.

PostHog

Product analytics. It records which parts of the service are used, so we can see where the product fails the people using it. It handles account and usage data, never revealed contact details.

Processed in the European Union, on PostHog's EU infrastructure. PostHog is established in the United States; transfers are covered by the standard contractual clauses.

Sentry

Error tracking. When something breaks it records the technical detail we need to fix it, which can include the identifier of the signed-in user who hit the error.

Processed in the European Union, on Sentry's EU infrastructure. Sentry is established in the United States; transfers are covered by the standard contractual clauses.

Business contact data vendors

We obtain business contact details from third-party business-contact data vendors, who compile them from public professional sources. On this page we describe them by category. The privacy notice explains what they supply and how we use it.

That does not put the answer out of reach of the person it is about. Every record we store carries the vendor's name, the identifier it had there and the date we retrieved it, and we give you all three when you exercise your right of access. The opt-out page is the route.

Transfers outside Europe

We choose European regions wherever a provider offers one, and every provider above processes in the European Union. Several of them are established in the United States, which means their staff can in principle be asked to access data in the course of support.

Where that is the case we rely on the European Commission's standard contractual clauses, together with the provider's own data processing agreement and its technical measures. We do not transfer contact records to a country without one of those safeguards in place.

Changes to this list

When we add or replace a sub-processor we update this page. If the change affects how personal data is handled, we update the privacy notice with it, and the date at the top of both pages changes.