Third-Party Data Sharing
A technical summary of which external services CareerStudioMax's code sends data to, and why.
What this page is: a factual, code-level account of data flows, generated by reviewing the actual integration code — not a legal document. It does not represent a compliance certification.
What this page isn't: a substitute for a lawyer's review. If you need this for GDPR Art. 13/14, CCPA, or another compliance framework, have it reviewed and adapted by counsel before relying on it.
Which of these are actually active depends on which API keys are configured in the live deployment — a service listed here is one the code is capable of using, not a guarantee every one is switched on in every environment.
GDPR Safeguards — Data Processing Agreements (DPAs)
Researched directly against each provider's own published legal terms (not assumed). "Auto-incorporated" means the DPA with Standard Contractual Clauses applies automatically by using the service, with no separate signature needed on our end.
| Provider | DPA / SCCs | Status | EU data residency |
|---|
| Stripe | Yes | Auto-incorporated | No EU-only option (global processor) |
| Groq | Yes | Auto-incorporated | No — explicitly US/global processing |
| Anthropic | Yes | Auto-incorporated on accepting Commercial ToS | No direct EU option |
| OpenRouter | ⚠ Unconfirmed for our tier | DPA appears tied to Enterprise plans — needs direct confirmation from OpenRouter for our account tier | No by default |
| ElevenLabs | Yes | Auto-incorporated for self-serve accounts | Optional EU region (with subprocessor carve-outs) |
| HeyGen | ⚠ Unconfirmed for our tier | DPA text is real, but appears tied to Business/Enterprise plans — needs confirming against our actual plan | Not confirmed |
| Twilio (incl. SendGrid) | Yes | Auto-incorporated since Jan 2020 | Optional EU (Ireland) region |
| AWS / S3 | Yes | Auto-incorporated globally | Yes — we use eu-west-1 (Ireland) |
| Render | Yes | Auto-incorporated | EU region exists, but Render is a US company subject to the CLOUD Act — not full data sovereignty even if EU region selected |
| MongoDB Atlas | Yes | Auto-incorporated for self-serve | Yes — our cluster is in eu-west-1 (Ireland) |
| Google (Sign-in) | Different framework | Controller-Controller terms, not a standard processor DPA — a real legal nuance worth a lawyer's specific read | N/A |
| Google Cloud Translate | Yes | Self-serve, but requires active acceptance in the Cloud Console — not automatic like AWS's | Partial, provider-dependent |
| Resend | Yes | Auto-incorporated, self-serve, EU-US Data Privacy Framework certified | Not confirmed EU-only |
| Sentry | Yes | Auto-incorporated | Self-serve EU option available (permanent once chosen at signup) |
⚠ = flagged as needing direct confirmation from the provider before this page can be treated as fully accurate — not yet done.
AI Inference
Powers resume analysis, interview coaching, career advice, and every AI chat feature. Your questions, resume/CV text, and career details are sent to whichever provider is handling that request.
| Service | Data sent | Purpose |
|---|
| Groq | Chat messages, resume text, career context you provide | Primary fast-inference AI engine |
| Anthropic (Claude) | Chat messages, resume text, career context you provide | Fallback AI engine when the primary is unavailable |
| OpenRouter | Chat messages, resume text, career context you provide | Secondary fallback AI engine |
Payments
Card and payment details are never stored on CareerStudioMax's own servers — they go directly to the payment processor.
| Service | Data sent | Purpose |
|---|
| Stripe | Name, email, payment method details (handled directly by Stripe, not our servers) | Subscription billing |
| Paystack / Flutterwave / PayPal | Name, email, payment method details | Regional payment processing, where enabled |
Communication
| Service | Data sent | Purpose |
|---|
| Resend / SendGrid / Mailgun | Your email address, email content (notifications, verification codes, digests) | Transactional email delivery — a 3-provider fallback chain, in that priority order |
| Twilio | Your phone number, message content | Primary SMS and WhatsApp notifications, where enabled |
| Termii / Africa's Talking / Vonage / MessageBird | Your phone number, message content | Regional SMS fallback providers (used when Twilio is unavailable or for specific regions), where enabled |
| Telegram Bot API | Your Telegram chat ID, message content | Bot-based notifications and support, where enabled |
| Slack | Basic profile info and calendar-alert content, if you connect a Slack workspace | Optional calendar/meeting alerts via Slack, where enabled |
Voice & Video
| Service | Data sent | Purpose |
|---|
| ElevenLabs — text-to-speech | Text to be spoken (AI responses, interview feedback) | Text-to-speech voice synthesis |
| ElevenLabs — voice cloning | A recording of your own voice, uploaded by you (Elite plan, opt-in only). This is biometric-adjacent data — we delete it from ElevenLabs' platform when you remove it or delete your account, not just our own reference to it. | Optional personalized voice clone for AI-narrated content |
| HeyGen | Interview script/text content — not your face or photo (avatar video uses HeyGen's own stock avatar library) | AI avatar video generation, where enabled |
| RunPod (GPU compute) | Audio/rendered video for talking-head interview video | GPU-accelerated video rendering, where enabled |
Search & Data Enrichment
| Service | Data sent | Purpose |
|---|
| Tavily / Brave Search | Search queries derived from your questions (e.g. role, country, company names) | Live web grounding for career/market answers |
| Apify | Public profile URLs or search terms you provide | LinkedIn profile analysis and lead enrichment, where used |
| Hunter.io | Company domain names derived from your search | Finding public contact/email addresses at target companies for lead-generation features, where used |
| Google Cloud Translate / DeepL / Microsoft (Azure) Translator / LibreTranslate | Page text and your questions, when a non-English language is selected | UI and content translation — a multi-provider fallback chain |
Sign-in
| Service | Data sent | Purpose |
|---|
| Google OAuth | Basic profile info you consent to share (name, email, avatar) per Google's consent screen | "Sign in with Google" |
| LinkedIn OAuth | Basic profile info you consent to share, per LinkedIn's consent screen | "Sign in with LinkedIn" |
Infrastructure
| Service | Data sent | Purpose |
|---|
| Render | All traffic to and processing on our application server (Oregon, United States) | Web application hosting |
| MongoDB Atlas | All account and application data | Primary database hosting (eu-west-1, Ireland — within the EU/EEA); daily encrypted backups also stored in our AWS S3 bucket |
| AWS S3 | Uploaded files (resumes, avatars), where configured | File storage |
← Back to Privacy Policy