Subprocessor List
A subprocessor is a third-party provider that processes personal data on our behalf to help us run Callings.ai. This page lists our current subprocessors, what each one does, the categories of data it handles, and where it operates. It is the authoritative, living version of the list referenced in our Privacy Policy.
Each subprocessor processes data under its own agreement and only as needed to provide its service. No subprocessor uses your content to train AI models, and we do not sell your personal information.
Last updated: September 19, 2026.
Infrastructure and Security
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, databases, storage, compute, and email infrastructure | All account and content data | United States |
| Cloudflare | Content delivery, DNS, edge security, and bot protection | IP address and request metadata | United States and global edge |
AI and Content Generation
These providers generate content you request. They receive only the content needed for the task, and none of them train their models on your data.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI | Resume, cover letter, and report generation; document parsing, including the resume files you upload; embeddings | Resume and profile text, job descriptions, your instructions | United States |
| Google (Gemini) | Image generation and selected content generation | Content you create, such as post or card text and reference images | United States |
| Cerebras | Job match scoring, and interpreting what you typed into job search | A condensed extract of your resume, the job descriptions being scored, and your search text | United States |
| Groq | Interpreting what you typed into job search, and drafting of welcome and suggestion content | Your search text and profile-derived context | United States |
| ElevenLabs | Text-to-speech voiceovers for Calling Cards | The voiceover script you create | United States |
| OpenRouter | Illustration image generation, job match scoring, and writing the introduction of your daily job email (routed only to hosting providers that retain no data) | The illustration prompt and image you create; a condensed extract of your resume, the job descriptions being scored, and your first name with the titles of the jobs in your email | United States |
Identity and Profile Enrichment
When you create an account, we look up your professional details from your email address so your profile and first job matches are useful straight away. These providers receive your email address and return public professional information, such as your job title, employer, and public profile.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Enrich.so | Looking up your public professional profile from your email address when you create an account | Email address | United Arab Emirates |
| Apify | Standby provider for the same lookup, used only when Enrich.so is unavailable | Email address | Czech Republic |
| RocketReach | Fallback lookup of your public professional profile when the above return no result | Email address, and name and employer when known | United States |
Payments
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe | Payment processing, subscriptions, and billing | Name, email, and billing details (card data is handled directly by Stripe) | United States |
Email, Messaging, and CRM
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Twilio SendGrid | Transactional and notification email | Name, email, and message content | United States |
| Customer.io | Onboarding and lifecycle email, and CRM | Name, email, account and subscription attributes, and activity events | United States |
Analytics (only with your consent)
These run only if you accept cookies. If you decline, they are disabled.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| PostHog | Product usage analytics, and the internal event record we use to monitor and operate the service | Pseudonymous identifier and feature-usage events | United States |
| Google (Analytics and Ads) | Marketing analytics and advertising measurement on public pages | Online identifiers, IP address, and page and campaign data | United States |
Consent management
This one runs before you make a cookie choice, because it is what asks you.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| CookieYes | Cookie consent banner and consent record-keeping | Consent choices, a consent identifier, IP address and approximate region (used to apply the right privacy law) | European Union |
Sign-In and Connected Accounts
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Sign in with Google | Name and email | United States | |
| Optional account connection to publish posts you choose to share to LinkedIn | The content of the posts you publish, and your authorization to publish on your behalf | United States |
Contracted Personnel
Some engineering and database work is carried out by contracted specialists rather than employees. They work inside our own systems, under our direction, using individual accounts that we issue, control, and can revoke at any time. Because no personal data is transferred to their systems or processed on their own infrastructure, they are treated as authorized personnel rather than as a subprocessor, and so are not listed in the tables above. They are bound by confidentiality obligations equivalent to those of our employees, and some of them work outside the United States. Institutional customers can request further detail, including the name of the contracting company, under a confidentiality agreement.
AI Assistants You Connect Yourself
Callings can be connected to an outside AI assistant (Claude, ChatGPT and other products that speak the same open standard) so that the assistant can answer questions about your own job hunt. When you set that up, the assistant reads your Callings data and what it reads passes through the company that runs it.
These companies are not listed as subprocessors above, for the same reason contracted personnel are not: the relationship runs the other way. They do not process your data on our behalf under our instruction. You choose the assistant, you authorize it in your own browser, it acts as your agent, and the terms that govern the conversation are the ones you accepted with that company, not ours. We hold no data-processing agreement with them covering it, and saying otherwise on this page would be inaccurate.
What that means in practice:
- Nothing is connected unless you connect it, and no assistant is connected by default.
- The connection reads your account only, never another user's, and it cannot see your password or payment details.
- We never receive your conversation with the assistant.
- You can see and revoke every connection from Settings > Integrations in your account, which ends its access immediately.
The full detail of what a connected assistant can read and change is in our AI Assistants security and privacy page.
Providers That Do Not Receive Your Personal Data
To run job discovery and networking, we also use job-data feeds, search, and page-fetching providers that receive only a search query or a public web address, never your resume, profile, or account data. Because they do not process your personal data, they are not listed as subprocessors above.
Changes to This List
We update this page when we add or remove a subprocessor. The date at the top reflects the most recent change. For material changes, we update our Privacy Policy and may notify you.
Questions
To ask about a specific provider or request more detail, email [email protected].
Related Topics
- Trust Center - How we protect your data
- Data and Privacy FAQ
Transparency about who touches your data is part of earning your trust. This list stays current so you always know who helps us run Callings.ai.