Sub-processors
Last updated June 23, 2026
To run ResumeLove, ResumeLove LLC ("Company", "we", "us") relies on a small set of trusted third-party vendors that process data on our behalf. We call each of these a "Sub-processor". This page — the Sub-processors page — is the canonical, public list of who they are, what they do, and what data they touch.
A few things we want to be clear about:
- We do not sell personal data, and we do not run third-party or cross-context targeted advertising.
- Every Sub-processor below is bound by a data processing agreement (DPA) and may only use your data to provide its service to us.
- All of our Sub-processors are US-based, and your data is processed in the United States.
- Your data is encrypted in transit (TLS) and at rest.
- We use OpenAI and Anthropic as our AI providers, chosen per feature. Together they power both our AI Features and our help/support AI. Our AI providers do not train their models on your data (commercial/API tier), and we keep retention to a minimum; we do not train our own models on your data without your separate, explicit opt-in consent.
- We keep this list current, and we will notify Users before adding a new Sub-processor so you have a chance to review the change.
Defined terms
- "Service" = the ResumeLove website and app.
- "Resume Content" = everything a User enters or uploads — resume text, work and education history, contact details, photos, cover letters, and interview-prep inputs.
- "AI Features" = the AI scoring, feedback, and generation features.
- "Public Page" = a User-published public web page of their resume.
- "Sub-processor" = a third party that processes data on our behalf.
Current Sub-processors
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database & hosting | Account data + Resume Content | United States | EU-US Data Privacy Framework certification where available; SCCs (with UK IDTA/Addendum) as fallback |
| Stripe | Payments (Pass + Subscription) | Billing and contact data | United States | EU-US Data Privacy Framework certification where available; SCCs (with UK IDTA/Addendum) as fallback |
| Vercel | Hosting / infrastructure | Technical and log data | United States | EU-US Data Privacy Framework certification where available; SCCs (with UK IDTA/Addendum) as fallback |
| OpenAI / Anthropic | AI Features + help/support AI | Resume Content and support metadata sent to the AI | United States | EU-US Data Privacy Framework certification where available; SCCs (with UK IDTA/Addendum) as fallback — plus a no-training commitment and minimal retention |
| Resend | Transactional email — OUTBOUND ONLY (no inbound mailbox) | Recipient email address and message metadata | United States | EU-US Data Privacy Framework certification where available; SCCs (with UK IDTA/Addendum) as fallback |
| Cloudflare | Turnstile bot-protection on the public forms | IP address and browser signals | United States | EU-US Data Privacy Framework certification where available; SCCs (with UK IDTA/Addendum) as fallback |
Notes on specific Sub-processors
- OpenAI and Anthropic are our AI providers, used interchangeably depending on the feature. They process Resume Content when you use AI Features, and process support metadata only (such as your plan, dates, counts, and verdicts) for the help/support AI — never your resume, cover-letter, or interview content for support drafting. Our AI providers do not train their models on your data (commercial/API tier), and we keep retention to a minimum.
- Resend sends outbound transactional email only — receipts, renewal and cancellation notices, support replies we approve, and rights-request confirmations. There is no inbound mailbox; you cannot reply to a Resend address to reach us. To contact us, use our contact form at /contact.
- Cloudflare runs Turnstile bot-protection on our public web forms (the public contact and privacy-request forms), processing your IP address and browser signals to tell humans from bots. This is disclosed on the form itself.
International transfers
Because our Sub-processors are US-based, data about Users outside the United States is transferred to the US. For each transfer we rely on the vendor's EU-US Data Privacy Framework certification where available, and on Standard Contractual Clauses (with the UK International Data Transfer Agreement / Addendum) as a fallback.## Changes to this list
We will notify Users before adding a new Sub-processor. When we make a change, we will update this page and the "Last updated" date above. We encourage you to check back here for the current list.
Contact
Questions about our Sub-processors, or want to exercise your data-protection rights? Use our contact form at /contact, or — for privacy and rights requests — at /privacy-request. We do not publish a contact email address; both forms route to a tracked queue so nothing gets lost.