Subprocessors
Last updated 6 September 2026.
These companies process personal data on our behalf so the product can work. The list is part of our privacy policy and changes when our stack changes.
| Provider | What it does | Where | Transfer basis |
|---|---|---|---|
| Clerk | Sign-in and account identity | United States | EU-US Data Privacy Framework |
| Stripe | Card payments, invoices and receipts | United States and Ireland | EU-US Data Privacy Framework |
| Supabase | Database for accounts, interviews and scores | Project region | Standard Contractual Clauses |
| OpenRouter | Routes AI requests to the model providers below | United States | Standard Contractual Clauses |
| Google (Gemini 3.5 Flash Lite, via OpenRouter) | Writes your questions, grades answers, writes the debrief | United States | Standard Contractual Clauses |
| Mistral (Voxtral) and NVIDIA (Parakeet), via OpenRouter | Speech to text when you answer out loud | European Union and United States | Standard Contractual Clauses |
| xAI (Grok voice), via OpenRouter | The interviewer voice | United States | Standard Contractual Clauses |
| PostHog (EU Cloud) | Product analytics, consent-gated, no interview content | European Union | Not applicable |
| Sentry | Error traces, scrubbed of candidate content | United States | Standard Contractual Clauses |
| Cloudflare | Website hosting and protection | Global edge | Standard Contractual Clauses |
| Railway | API hosting | United States (US West) | Standard Contractual Clauses |
Retention
| Data | Kept for |
|---|---|
| Interview transcripts, scores and debriefs | 12 months, or immediately on account deletion |
| Résumé and job description text | Not stored. Used once to write your questions |
| Interview audio | Not stored. Streamed for transcription only |
| Server logs and AI call records | 90 days |
| Account record | Until you delete it |
| Invoices and payment records | 10 years (French Commercial Code) |
Ask a question about this list at [email protected].