Processor List
Last updated: 2026-09-06
About This List
CV Score is operated by The CodeCave GmbH, Alfred-Nobel-Straße 29, 50226 Frechen, Germany. To run the Service we rely on a small number of service providers who process personal data on our behalf. This page names each of them, so you can see who is involved before you upload anything.
Each of these providers acts as a processor under Article 28 GDPR and is bound to:
- Process data only on our documented instructions and only for the stated purpose
- Apply appropriate technical and organisational security measures
- Place their staff under a duty of confidentiality
- Engage sub-processors only under equivalent obligations
- Delete or return the data when the engagement ends
Current Processors
OpenAI
USAPurpose
AI evaluation of your CV
Data processed
The text extracted from your CV, including any personal data it contains, such as your name and contact details. No account identifier, no login email address, no payment data.
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
The model used is gpt-4o-mini, called through the business API. Under OpenAI's API terms, content submitted this way is not used to train OpenAI's models by default.
Supabase
USAPurpose
Authentication, database and storage of the uploaded CV files
Data processed
Account data (email address, password hash, user identifier), CV files, evaluation results, payment records, questionnaire answers, feedback messages
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
CV files are held in a private storage area that is separated per user and is not publicly accessible. Database access is restricted by row-level security.
Google Cloud
Servers in Frankfurt, Germany (europe-west3)Purpose
Hosting of our API backend and of the scheduled jobs that trigger our emails
Data processed
All data the backend handles while processing a request, including the CV text during extraction, plus server logs
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
The servers we use are located in Germany. Google is nevertheless part of a US-based group, so access from a third country cannot be ruled out.
Netlify
USAPurpose
Delivery of the web application at app.cvscore.net
Data processed
IP address, browser and request data in server logs
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
Netlify only delivers the application files to your browser. CV files and evaluation results are not stored there.
Railway
USAPurpose
Delivery of the website at cvscore.net
Data processed
IP address, browser and request data in server logs
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
This concerns the public marketing pages only. No account data and no CVs are processed here.
Polar
USAPurpose
Payment processing, tax determination and invoicing
Data processed
Email address, payment method and billing details, amount, currency, transaction data
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
Card details are entered on Polar's pages and never reach us. We receive only the email address, the amount, the status and a transaction reference.
Resend
USAPurpose
Sending our transactional and marketing emails
Data processed
Recipient email address, subject line and content of the message
Safeguards
EU standard contractual clauses under Art. 46(2)(c) GDPR
Marketing emails are sent only with your consent and always carry a one-click unsubscribe link.
Notes on Infrastructure
Two points that are easy to miss when reading the table above:
| Provider | Used by | Purpose | Certifications |
|---|---|---|---|
| Rybbit | Not a processor | Reach measurement for our pages and the application — no cookies, one identifier in local storage, nothing passed to third parties | Self-hosted, therefore not listed as a processor |
| Google Sign-In | Only if you choose it | Optional sign-in; Google then transmits your email address and basic profile data to us and acts as an independent controller for its own processing | Governed by Google's privacy policy |
| Google Fonts | The application only | The typeface of app.cvscore.net is loaded from Google's servers; your IP address reaches Google in the process. The pages at cvscore.net use fonts we host ourselves. | Governed by Google's privacy policy |
How Your Data Flows
What happens between the upload and the finished report:
You upload a CV
Stored under your account, not publicly accessible
The text is extracted
Extraction and, for scanned PDFs, text recognition both run on our server — no third party involved
The AI evaluation runs
No account identifier, no login email address, no payment data is transmitted
The result is stored
Linked to your account until you delete it
You are notified
Transactional message telling you the report is ready
Safeguards for Transfers to Third Countries
Several of the providers above are established in the United States or belong to a US-based group. For those transfers we rely on:
EU standard contractual clauses
The clauses adopted by the European Commission under Art. 46(2)(c) GDPR, agreed as part of the data processing agreements with our providers.
Applies to: All providers outside the EEA
EU-US Data Privacy Framework
Where a provider is certified under the framework, the European Commission's adequacy decision of 10 July 2023 applies in addition.
Applies to: Certified US providers
Supplementary measures
Encrypted transmission, access restricted to what is necessary, and data minimisation — in particular no account identifiers and no payment data are transmitted to our AI provider.
Applies to: All providers
Despite these safeguards, a residual risk remains that authorities in a third country may seek access to data under local law. We cannot rule this out, and we say so rather than imply otherwise.
Changes to This List
We add or replace processors from time to time. When we do:
- We update this list and the corresponding section of our privacy policy
- We update the date shown at the top of this page
- For business customers with their own data processing agreement, we notify as agreed in that contract
If you have concerns about one of these providers, write to privacy@cvscore.net.
Questions
If you have questions about our processors or about how your data is handled, contact us at privacy@cvscore.net