Why this page exists
We name the third parties you interact with directly — sign-in and advertising — and list the rest of our infrastructure by category of provider, which GDPR Art. 13(1)(e) expressly permits. Each provider has a Data Processing Agreement (or equivalent contract) in place with MEDTIP GmbH and is bound to use your data only to deliver the service.
Before we add a new subprocessor that handles personal data, you will be notified by e-mail and an in-app banner at least 14 days before the change takes effect. This page is updated at the same time. If you object and we cannot operate without the new subprocessor, you can export your data and close your account before the change applies.
Current subprocessors
As of the last-updated date above, MEDTIP GmbH uses the following subprocessors to deliver CVVia. "Mechanism" describes the legal basis for any transfer outside the EU.
| Subprocessor | Service | Data category | Jurisdiction | Mechanism |
|---|---|---|---|---|
| Google Ireland Ltd. | Sign-in — "Continue with Google" (Firebase Authentication) | Email, password hash, Firebase UID | Ireland (EU) | GCP DPA + EU SCCs |
| Meta Platforms Ireland Ltd. | Meta (Facebook) Pixel — Instagram / Facebook ad measurement (loaded only with marketing consent) | Page-view events, IP address, Meta cookie identifier | Ireland (EU); transfers to United States | Meta DPA + EU SCCs + DPF |
| Cloud hosting & infrastructure (EU-based) | Application hosting, database, file storage, off-site backups, DNS / CDN | All application data, logs | EU (Germany) and EU regions | DPAs + EU SCCs |
| AI / LLM providers | CV tailoring, cover letters, ATS scoring, interview prep, embeddings, text-to-speech | Prompt text including CV / profile / answers; interview question text | EU and United States | DPAs + EU SCCs + EU-US DPF |
| Error monitoring | Crash & exception diagnostics (personal data scrubbed before send) | Stack traces, request metadata | EU (Germany) | DPA + EU residency |
| Email delivery | Transactional and contact-form email | Name, email address, message text | EU (Ireland) | DPA + EU SCCs |
How we change this list
Before adding a new subprocessor that handles personal data, we commit to:
- Notify users at least 14 days in advance by email to the account address and via an in-app banner.
- Update this page to reflect the change before it goes live.
- Honor objections — if you do not want your data flowing through a new subprocessor and we cannot operate without it, you may export your data via Settings → Download my data and close your account before the change applies, with a pro-rated refund where applicable.
- Remove processors that no longer hold a DPA with us, or that we have stopped using, and note the removal here.
Questions or copies of the DPAs
If you would like more detail on how a specific subprocessor handles your data, the country where their compute runs, or a copy of an underlying Data Processing Agreement where it is shareable, write to privacy@cvvia.ai. We respond within 30 days.