Sub-processors

Sub-processors

These companies process personal data on behalf of to run CVSheets. Each one acts only on our instructions, under a data processing agreement.

Name	Purpose	Location	Data
Microsoft Azure	Hosting in UK South: the app, Cosmos DB, Blob Storage, Key Vault, logs. Email delivery through Azure Communication Services (data kept in the UK). Website files from Western Europe	United Kingdom; encrypted backups in a second Azure region; website files in the Netherlands	Encrypted account and CV data, encryption keys, the emails we send you, technical logs
Cloudflare	DNS, CDN and protection from abuse, Turnstile bot check, Web Analytics	Global network, including the United States	IP addresses and request details; no cookies for analytics
Anthropic	AI features, Premium only, when you start an AI action	United States	The CV text for that action, with your name, email, phone and links removed

Paddle

Paddle.com Market Limited sells Premium to you as the merchant of record. Paddle is responsible for the payment, tax and invoice data it collects at checkout under its own privacy notice, so it is a separate controller rather than our sub-processor. We send Paddle only a random account ID, so a purchase can be linked to your account. You give Paddle your email address and payment details yourself at checkout. See the billing terms.

Sign-in providers you choose

If you sign in with Google, Microsoft or LinkedIn, that provider sees that you are signing in to CVSheets. We receive your email address and name from them. They act under their own privacy terms, and we use them only if you choose to.

Changes

When we add or replace a sub-processor, we update this page first. If the change matters to you, for example a new country, we tell you by email.