Career1 uses these companies to run the Service. Each one receives personal data so that it can provide its service to us, and some are used only in particular circumstances, which the table says. We never sell personal data to anyone.
1. The list
| Provider | What for | Data it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| Contabo | Hosts the application servers and the database. Always in use. | All data held by Career1. | France (EU) | Within the EU. |
| Amazon Web Services (Amazon S3) | Stores resumes, interview recordings, company logos and database backups. Always in use. | Resume files, interview video with audio, backups of the database. | EU (Stockholm, eu-north-1) | Within the EU. |
| OpenAI | Runs the voice interviewer and transcription, writes interview reports and feedback, reads resumes into profiles, powers talent search, the free tools and the help assistant. Always in use. | Live interview audio, candidate name and resume text, job details, transcripts, help-chat messages, text pasted into the free tools. | United States | EU Standard Contractual Clauses and the UK Addendum. OpenAI does not train its models on data sent through its API. |
| Resend | Sends account, sign-in and interview emails. Always in use. | Email address, name and the content of the email. | United States | EU Standard Contractual Clauses and the UK Addendum. |
| Stripe | Takes payment for company subscriptions. Only when a company subscribes to a paid plan. | Billing email and company reference. Card details go to Stripe directly and never reach Career1. | Ireland and United States | EU Standard Contractual Clauses and the UK Addendum. |
| Google sign-in, Google Calendar scheduling, Google Analytics, and the connection helper (STUN) that lets the interview's voice link reach you. Only when you sign in with Google, a company connects its calendar, you accept analytics cookies, or you join a voice interview. | Sign-in: name and email. Calendar: event details and attendee emails. Analytics: pages visited, device and approximate location. STUN: your IP address. | United States | EU–US Data Privacy Framework, EU Standard Contractual Clauses and the UK Addendum. | |
| GitHub | Optional GitHub sign-in and the public-repository summary shown on a talent profile. Only when a job seeker connects GitHub. | GitHub username, name, email and public profile and repository details. | United States | EU Standard Contractual Clauses and the UK Addendum. |
| ip-api.com | Looks up the approximate country and city of website visitors for our own visit statistics. Always in use. | IP address. | Not published by the provider | The provider states it keeps the queried address in memory for up to one minute. |
2. Which ones handle applicants' data
When a company hires through Career1, we process its applicants' data on its behalf, under the Data Processing Addendum. The providers that touch that data, and so act as that company's sub-processors, are: Contabo, Amazon Web Services (Amazon S3), OpenAI, Resend and Google. The rest process only data for which Career1 itself is responsible, as the Privacy Policy explains.
3. How we tell you about changes
Before we add or replace a provider that processes applicants' data, we update this page and email the owner of every company workspace at least 30 days before the change takes effect. A company may object during that time, as the DPA sets out. Other changes to this list take effect when this page is updated, and the date at the top of the page shows when that last happened.