Legal
Subprocessors
Public list of processors used to run ResumeCaliper. Complements Privacy Policy §7. Stripe may also act as an independent controller for payment instruments and fraud prevention.
Last updated: 24 September 2026 (version 2026-09-24). Where this page is translated, the English version prevails in case of doubt, except where the law of your country requires otherwise.
1. Why this list exists
Under GDPR Art. 28, when Arseniy Rusentsov (controller) uses another organisation to process personal data on its instructions, that organisation is a processor. ResumeCaliper publishes this list so users and auditors can see who helps operate the service.
ResumeCaliper is controller for candidate accounts (users analyse their own CV). Details of purposes, bases and rights: Privacy Policy. Role summary: Data Processing Addendum.
2. Current subprocessors
| Subprocessor | Purpose | Personal data (typical) | Location / transfer |
|---|---|---|---|
| OpenAI, L.L.C. (United States) | AI scoring and text generation | Anonymised CV text, job description, notes; model outputs | United States (or OpenAI EU residency if configured). OpenAI DPA with EU SCCs. API data not used for training under OpenAI API terms; may be retained up to 30 days for abuse monitoring unless a zero-retention / EU option applies in the org console. |
| Google Ireland Ltd / Google LLC — Firebase Authentication | Account creation and sign-in (email/password or Google) | E-mail; password hashed by Firebase (email/password); name and picture when provided; user ID; tokens | EU and United States. Google Cloud Data Processing Terms; DPF certification / SCCs as applicable. |
| Contabo GmbH (Germany) | Hosting: app, database, queue, workers, private object storage for run files | Data held by the service; run files encrypted at rest | European Union. |
| Cloudflare, Inc. | DNS, CDN, DDoS/WAF, approximate country for pricing (CF-IPCountry), optional Turnstile | IP address, request metadata, security tokens, edge country code | Global edge; EU processing where available. Cloudflare DPA; DPF certified. |
| Stripe Payments Europe Ltd / Stripe, Inc. | Payment checkout, receipts; fraud where Stripe acts as controller | Payment details entered on Stripe; e-mail; amount; currency; package; session IDs | EU and United States. Stripe DPA; DPF certified. Card numbers never stored by ResumeCaliper. |
| Google Ireland Ltd — Google AdSense (optional, after ads consent) | Display advertising on marketing/app surfaces when enabled | Advertising cookies and identifiers | Per Google advertising terms; DPF. CV content is never shared with advertisers. |
| Google Analytics / Tag Manager, Microsoft Clarity (optional, marketing site only, if configured and accepted) | Usage statistics | Pseudonymous usage events | Vendor terms; DPF where applicable. |
| Google Workspace / Gmail | Receiving and answering privacy/contact e-mail | Your e-mail and message content | Google terms; DPF. |
Other recipients (not subprocessors): public authorities, courts or professional advisers where the law requires or allows disclosure (for example tax inspection or legal claims). ResumeCaliper does not sell personal data and does not share CVs or job descriptions with employers, recruiters, data brokers or other users.
3. Changes to this list
ResumeCaliper updates this page when a subprocessor is added, replaced or removed in a way that materially affects processing. The version date above is updated at the same time. Material changes are also reflected in the Privacy Policy.
If you have questions about a specific provider, e-mail [email protected] or use Contact.
4. Related documents
- Privacy Policy (full Art. 13 notice)
- Data Processing Addendum
- AI transparency
- Terms
- Cookies
- Legal notice
Arseniy Rusentsov — Placa Catalana 1, 1-4, 08032 Barcelona, Spain — NIF Z0402379E — [email protected] — Contact.