Subprocessors
Version 2026-10-12 · Effective October 12, 2026
Companies that process personal information for Kyrolane.
Current list
This is the list we rely on to run Kyrolane. A provider may use its own infrastructure. Locations are the regions we intend for our use of that provider.
MongoDB Atlas is used in AWS us-east-1. Backend services run on a Contabo server in the European Union. Those are the operator’s hosting arrangements.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel | Hosts the web application. May store files in Vercel Blob when that storage option is used. | United States |
| MongoDB Atlas (Amazon Web Services, us-east-1) | Primary database for accounts, applications, partner records, and the contact directory. | United States (AWS us-east-1) |
| Amazon Web Services S3 | Resume and file storage when S3 is the configured store. The application default region is us-east-1. | United States (us-east-1 by default) |
| Stripe | Job-seeker subscription checkout, renewal, and the billing portal. We do not receive full card numbers. | United States |
| OpenAI | Drafts you ask for, such as cover letters. Match embeddings only when semantic matching is enabled. That switch is off unless it is set to the exact value true. | United States |
| Optional Google sign-in, and Gmail sending when you connect a mailbox. | United States | |
| Microsoft | Outlook sending when you connect a Microsoft mailbox. | United States |
| GitHub | Optional GitHub sign-in. | United States |
| Firebase (Google) | Optional web push notifications, only if you turn them on. | United States |
| Gentlytics | Cookieless product analytics: pages, clicks, outbound links, and form metadata. Not field values such as passwords. | As published by Gentlytics (ingest.gentlelytics.com) |
| Hunter | Optional business-email lookup, used as a fallback when a Hunter key is configured. | Provider infrastructure (enrichment) |
| Apollo | Business-contact enrichment for directory and sales research when an Apollo key is configured. | Provider infrastructure (enrichment) |
| Contabo | Backend services in the European Union, including the mail server used for transactional messages when that host is configured. | European Union |
| Job-search providers | Public job feeds and search APIs used to fill the job catalog, including Remotive and a Google Jobs search API. They receive search criteria, not your mailbox. | Depends on the source |
| The mailbox you connect | Gmail, Outlook, or your own SMTP server sends the messages you approve. That provider processes the message because you asked it to send. | The provider you choose |
Changes
The list lives in a versioned file, currently 2026-10-12. We will update this page before a new subprocessor processes personal information. For Customer Data under the Data Processing Addendum, an administrator emails organization admins at least 30 days before the effective date. That email is not sent automatically when the file changes. You may object as the Addendum describes.
Job seekers who do not want a provider involved can stop using the feature, or stop using the service, and can email privacy@kyrolane.com.
Keys you connect
If you paste your own OpenAI, Anthropic, Google, or Hunter key into settings, that provider processes the requests you trigger, under your agreement with them as well as ours. We store the key encrypted when an encryption key is configured for Kyrolane.
Contact
Questions: privacy@kyrolane.com. Agency objections: info@kyrolane.com.
Other documents
- Legal hub — All current documents, with version history.
- Terms of Service — For job seekers using the Kyrolane workspace.
- Partner Terms — For recruitment agencies on the Partner Portal.
- Data Processing Addendum — How we process candidate and client data for agencies.
- Privacy Policy — What we collect, why, and the choices you have.
- Cookie notice — The cookies we actually set, and the ones we do not.
- Acceptable use — What you may not do with the service.
- Responsible AI — How matching and drafts assist, and do not decide.
- Privacy request — Access, export, correction, deletion, or a concern.
- Directory opt-out — Remove a business email from the contact directory.