Subprocessors
Version 1.1 · Last updated: 24 August 2026
Every third party that processes personal data on our behalf. Derived from career-be/src/common/env.validation.ts, which is the authoritative list of external services, cross checked against package.json and the API clients.
Active subprocessors
| Provider | What it does | Personal data it receives | Location | Terms |
|---|---|---|---|---|
| Amazon Web Services | Hosting (EC2), database (PostgreSQL), file storage (S3) | Everything in the account, and any file uploaded to a tracked job | Canada (Montreal, ca-central-1) | Privacy · DPA |
| OpenAI | Reading uploaded resumes; job match analysis; reading job postings from screenshots; drafting application answers | Full resume text on first upload (so includes contact details). Otherwise: name, summary, skills, work history, education, plus the job description | United States | Privacy · API data usage · DPA |
| Anthropic | Cover letters; resume tailoring; rewriting individual lines | Name, summary, skills, work history, education, plus the job description. No contact details | United States | Privacy · Commercial terms · DPA |
| Polar | Selling paid plans as merchant of record: taking payment, managing the subscription, invoicing, tax, and refunds. Not a processor acting on our instructions — Polar sells the plan in its own right and decides how it handles the payment data it collects | Email address and the plan bought. Card details are collected by Polar's payment processor and never reach us | United States | Privacy · Buyer terms |
| Resend | Sending verification, password reset and referral invitation emails | Recipient email address, recipient name where included, and the message body | United States | Privacy · DPA |
Identity providers (only if the user chooses them)
| Provider | Scopes requested | What we receive | Location | Terms |
|---|---|---|---|---|
email, profile | Name, email address, profile picture | United States | Privacy | |
openid, profile, email | Name, email address, profile picture | United States | Privacy |
Neither grants access to mail, calendar, files, contacts or connections. No Google restricted or sensitive scope is requested, so the Google API Services User Data Policy Limited Use requirements do not apply to Hike.
Not subprocessors, but worth listing
| Service | Why it is here | Personal data |
|---|---|---|
| tesseract.js CDN | The OCR engine downloads its language model from a public CDN the first time it runs | None. Files are downloaded to our server; nothing is uploaded |
| Job sites (Workable, Greenhouse, LinkedIn public job pages, and others) | When you paste a job link, our server fetches that page to read the posting | None about you. The request comes from our server with a generic browser user agent, and carries no identifier. The job site sees our server, not you |
| GitHub Actions | Runs our scheduled jobs (account purge, mail monitoring) by calling our own API | None. These calls carry an operations key and return counts only |
Deliberately absent
Verified across career-be, career-fe, chrome-ext and career-mobile:
No analytics. No error tracking or crash reporting. No session replay. No advertising or conversion pixels. No support chat widget. No payment processor. No customer data platform. No email marketing tool.
Changes
We will update this page before adding a subprocessor. If a change materially affects how personal data is handled, we will give notice as described in the Privacy Policy.
Open items before publication
- Canada (Montreal,
ca-central-1) must be filled in. It determines whether data leaves the United States. - Signed DPAs are not yet in place with any provider. See OFF-CODE-TODO.md.
- Whether our OpenAI and Anthropic accounts carry zero retention or enterprise terms is unconfirmed. The Privacy Policy currently states the providers' standard published API position and is marked provisional.