TalioCV — Legal

Sub-processors

Last updated:

TalioCV engages the following sub-processors to operate the Service. This list is updated with at least 30 days' notice before any material change, in line with §19.9 of our system design and Section 4 of the Privacy Policy.

To receive automated change notices, subscribe via the DPO contact form and request the sub-processor mailing list.

Current sub-processors

  • Amazon Web Services (AWS) (us-east-1) — Compute (ECS / Lambda), database (RDS PostgreSQL with pgvector), object storage (S3 — exports + attachments), event scheduling (EventBridge), queues (SQS). Privacy & DPA
  • Stripe (Global (US headquartered)) — Subscription billing, payment processing, refunds, webhook delivery. Card data is tokenised by Stripe and never reaches our servers. Privacy & DPA
  • Resend (Global (US headquartered)) — Transactional email delivery (verification, password reset, payment-failure notifications, refund decisions, DPO contact replies). Privacy & DPA
  • Twilio (Global (US headquartered)) — Optional SMS delivery for interview / application reminders. Only triggered when the user opts in to SMS notifications. Privacy & DPA
  • Hirebase (Global) — Real-time job-search semantic provider used by /jobs. Only the search query and minimal context (location, job preferences) are forwarded. Privacy & DPA
  • Apify (Global (Czech Republic / EU)) — Background scraper actor used to refresh the local job-cache nightly so Hirebase outages degrade gracefully. Privacy & DPA
  • Sentry (Global (US / EU regions available)) — Error monitoring & performance tracing. PII bodies are scrubbed before transmission; only stack traces, request paths, and structured tags are sent. Privacy & DPA
  • Google (Gemini) (Global (US headquartered)) — LLM provider for platform-managed AI on every plan. Processes résumé and job-description text for keyword extraction, gap analysis, rewriting, and quality checks. Plans differ by how much you can run, not by which model runs it. Privacy & DPA
  • OpenAI (Global (US headquartered)) — Platform-owned embedding model (used for master-résumé chunk retrieval and fit scoring) and Whisper speech-to-text for voice input on paid plans. We do not accept customer-supplied API keys. Privacy & DPA

How we choose sub-processors

Every sub-processor is required to (a) sign a Data Processing Addendum or equivalent, (b) provide adequate technical and organisational safeguards, and (c) host data in jurisdictions compatible with our cross-border transfer mechanism (Standard Contractual Clauses where applicable).

Object to a sub-processor

If you object to a new sub-processor within the 30-day notice window, contact privacy@flintapply.com. We will discuss reasonable alternatives or, where impossible, provide an exit path with a refund of pre-paid unused fees.