Sub-processors

Operated by Jaspin LLC · Effective August 20, 2026

At a glance

13 third parties touch SupaCV data, and this page names every one of them along with exactly what it receives.

Only one receives your resume content: Anthropic, to run the AI features. Nobody else sees it.

No advertising networks, no data brokers, no analytics company that gets your content.

This summary is for orientation only. The full text below is what actually applies.

A sub-processor is a company that processes personal information on our behalf so that SupaCV can work. Most privacy policies say “we use service providers” and leave it there. This page is the actual list, with a description of what each one receives that is specific enough to check.

Read it with the Privacy Policy, which explains the purposes, retention periods, and your rights.

1. The list

Supabase

United States

Database and authentication

Everything you save in your account: email, password hash, Resume text and structured data, Analyses, Target Roles, Cover Letters, Interview Session answers, saved stories, Applications, and billing identifiers.

Vercel

United States

Application hosting, content delivery, and visitor counting

Every request to supacv.com passes through Vercel, so it sees IP address, request path, and headers in transit. Vercel Web Analytics separately receives page path, referrer, coarse country, and device type. It sets no cookies and keeps no identifier beyond 24 hours.

Anthropic

United States

AI features (Claude)

The Resume text, job description, and prompt for whichever AI feature you run, including Interview Session answers you write and the Resume bullets scored alongside them. Sent as you wrote it, without identifier removal.

Stripe

United States

Payment processing and subscription billing

Your email address, and the card details you enter on Stripe’s own hosted checkout page. Card numbers never reach SupaCV; we store only Stripe customer and subscription identifiers.

Upstash

United States

Rate limiting

Your IP address or account ID as a counter key, to stop abuse of public endpoints. No content. Keys expire on their own within one hour for most limits and 24 hours for the free landing-page scan.

Resend

United States

Transactional email

Your email address and the contents of the message being sent (score results, password resets, reminders, receipts).

Mailrelay

European Union (Spain)

Transactional and follow-up email

Your email address, optional first name, and the contents of the message being sent. No resume content.

Microsoft Clarity

United States

Session replay and heatmaps

A recording of how you use the site: mouse movement, clicks, scrolling, and page structure. Loads only after you accept cookies, so it receives nothing at all if you decline or have not chosen.

Consent required. Receives nothing unless you accept cookies. See the Cookie Policy.

Ahrefs Analytics

Singapore / European Union

Aggregate marketing-page measurement

Page path, referrer, and coarse device information for public marketing pages. Cookieless, and it sets no identifier on your device.

Cloudflare

United States

Domain registration, DNS, and bot protection on the free scan

DNS queries for supacv.com. Where the Turnstile bot check is enabled on the free scan, Cloudflare also receives your IP address and a challenge token.

Zoho Cliq

United States / India

Internal error alerting

Error type, error message truncated to 300 characters, one stack frame, deployment environment, region, and timestamp. By construction it receives no request URL, no request body, no user ID, no email, and no Resume content.

logo.dev

United States

Company logos next to job listings

Your browser requests logo images directly, so logo.dev sees your IP address and the company domain being displayed. It receives nothing about you or your Resume.

Voyage AI

United States

Text embeddings for keyword analysis

Short skill and keyword phrases, never a full Resume.

Not currently in use. Configured but not in the live path: semantic matching is switched off after evaluation, so no user text is currently sent.

2. What is deliberately not here

A list is only meaningful if the absences are real, so to be explicit, SupaCV uses:

No advertising or retargeting networks.
No data brokers, and we buy no personal data about you from anyone.
No Google Analytics. Our product analytics stay in our own database.
No AI provider other than Anthropic. AI requests go directly to Anthropic rather than through a gateway or a reseller.
No file storage provider. Uploaded PDFs and DOCX files are parsed in memory and never written to a storage bucket, so there is no vendor holding your original documents.

Job listings shown in the product are fetched from public sources and third-party feeds including Greenhouse, Lever, Ashby, and Adzuna. Those are read-only: we request public postings from them and send them nothing about you, which is why they are not sub-processors.

3. How this list changes

We update this page when a provider is added, removed, or changes what it receives, and we revise the effective date at the top. If you would like advance notice of changes, write to privacy@supacv.com and we will add you to the notification list.

4. Contact

Questions about a provider on this list: privacy@supacv.com

Other policies

Terms of ServiceThe contract between you and Jaspin LLC covering accounts, subscriptions, your content, AI output, and dispute resolution.
Privacy PolicyWhat we collect, who receives it, how long we keep it, and the controls you have over all of it.
Cookie and Tracking PolicyEvery cookie and storage key SupaCV sets, what each one does, and how to change your choice at any time.
Refund, Cancellation and Subscription PolicyHow billing, renewal, cancellation, trials, price changes, and refunds work on the Pro and Career plans.
Acceptable Use PolicyWhat you may not do with SupaCV, including the line between tailoring a resume and falsifying one.