The providers and transfer safeguards below are described in sections 6 and 7 of our Privacy Policy.
6. WHO WE SHARE YOUR DATA WITH
The companies below process data for us under written contracts, and may only use it to provide their service to us. This is the full list of providers that handle your personal data. We update this section, and the date at the top, before a new provider starts handling user data.
Hosting and database
Supabase: stores your account, profile, CVs, statements and usage records, and handles login. Location: London, UK.
Vercel: hosts and delivers the Scrubmyo website and app. Our servers run in London, UK. Vercel may also process technical data, such as page requests and logs, in other countries as set out in its own privacy policy.
Payments
Stripe: takes card payments for credit packs. Stripe collects your card details directly and we do not see or store your full card number. Stripe also acts as an independent controller for fraud prevention and legal compliance. Location: may be outside the UK, including the United States.
AI (see section 5)
Vercel AI Gateway: passes your AI requests from Scrubmyo to the AI providers below. It does not keep prompts or outputs after the request is complete. Location: may be outside the UK, including the United States.
Anthropic: AI processing of CV text (contact details removed), job descriptions and the examples you give us. Location: may be outside the UK, including the United States.
Google (Gemini): the same. Location: may be outside the UK, including the United States.
OpenAI: the same. Location: may be outside the UK, including the United States.
Cloud platforms that run these models, such as Amazon Web Services and Google Cloud, may also process this data on the providers' behalf.
Messages and email
Our text message provider: sends one-time login codes to your mobile number. Location: may be outside the UK, including the United States.
Our email delivery provider: sends account and service emails such as login links and receipts, using your email address. Location: may be outside the UK, including the United States.
Kit: holds early sign-ups and sends marketing emails, only to people who have agreed to receive them. It holds your email address and marketing choice. Location: may be outside the UK, including the United States.
Analytics (only if you accept analytics cookies)
PostHog: shows us how the site is used. Location: European Union (Frankfurt, Germany).
Google Analytics: shows us how the site is used. Location: may be outside the UK, including the United States.
We do not send your name, email address, phone number or CV content to either analytics tool.
Others. We may share data with professional advisers (such as our accountant), with regulators or law enforcement where the law requires, and with a buyer if the business is sold, in which case this policy continues to apply.
7. TRANSFERS OUTSIDE THE UK
Some of the providers in section 6 are based or process data outside the UK, including in the US and other countries where they operate. Where we send personal data abroad, we rely on a UK-approved safeguard: the UK Extension to the EU-US Data Privacy Framework where the provider participates, UK adequacy regulations (which cover the EEA), or the ICO's International Data Transfer Agreement or UK Addendum. You can ask us which safeguard applies to a particular provider by emailing hello@scrubmyo.com.