Sub-processors
- Effective
- Last updated
This document is awaiting legal review.
It describes how NexumeLab actually handles your data today and is published in good faith, but it has not yet been reviewed by a qualified lawyer. Wording may change once it has been.
Running NexumeLab means relying on a small number of other companies. Each one below is bound by a data processing agreement, may only act on our instructions, and may not use your data for their own purposes.
This list is part of our Privacy Policy. We update it when a processor is added or removed.
Current sub-processors
| Processor | What they do | What they receive | Location |
|---|---|---|---|
| Amazon Web Services | Object storage for uploaded files | Résumés, documents and images you upload | United States |
| OpenAI | Powers résumé auditing, generation, scoring and search matching | Career content, work history, uploaded résumé text, assistant messages | United States |
| Stripe | Payment processing | Name, email, card details (collected by Stripe, never stored by us) | United States and Ireland |
| "Sign in with Google" authentication | Email, name, Google account identifier — only if you use it | United States | |
| Bright Data | Collects public job postings | No user data. Job postings only | United States and Israel |
| [EMAIL PROVIDER] | Sends service email — password resets, receipts | Email address, message content | [LOCATION] |
| [HOSTING PROVIDER] | Runs the application and database | All platform data | [LOCATION] |
What OpenAI receives, specifically
Because it is the processor that sees the most, it is worth being precise. When you use an AI feature, the relevant career content is sent to OpenAI to produce the result. That includes text from résumés you upload and anything you have written into your Career Vault.
Under our agreement with OpenAI, data sent through the API is not used to train their models and is retained by them only briefly for abuse monitoring.
If you would rather no AI feature ever ran against your data, do not use the audit, generation, scoring or search features. The rest of the platform works without them.
Transfers outside the UK and EEA
Most processors above are in the United States. Those transfers rely on the UK International Data Transfer Agreement and the EU Standard Contractual Clauses, plus the relevant adequacy decision where the recipient is certified under the EU–US and UK–US Data Privacy Framework.
You can ask us for a copy of the safeguards for any specific transfer at privacy@nexumelab.com.
Changes
We will update this page before a new sub-processor starts handling personal data. If you have a commercial agreement with us that entitles you to advance notice, we will follow whatever that agreement says.