Subprocessors
Last updated 2026-10-12
These are the outside providers that process personal data for ApplyPilot, or that are built in but switched off. Only providers marked Active receive any data today. Files in your Local Agent workspace are not sent to any of them.
Active
Receives personal data today.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| GitHub (GitHub Pages) | Hosting the public website and dashboard static files | Visitor IP address and request metadata in GitHub's own logs | United States |
| Google (Apps Script / Google Sheets) | Collecting early-access waitlist submissions from the website | First name, Last name, Email, Role family, Career level, Marketing preference, Country | Determined by Google; under review |
Integrated, switched off
Code exists in ApplyPilot but is switched off and receives nothing.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google (Gemini API, paid tier) | Drafting tailored resumes and cover letters from allowlisted professional information Customer data is not sent until paid-tier processing is approved. | Job description, Verified skills, Job titles, Employers, Employment dates, Experience bullets, Degrees and institutions, Certifications, Published papers, Products and projects, Awards and trainings, Years of professional experience | Determined by Google; under review |
| Stripe | Hosted checkout, subscription billing and customer portal One of two payment processors under evaluation. Billing is off; no payment is taken. | Email, Stripe customer and subscription identifiers, Plan, Payment status | Under review |
| Razorpay | Subscription billing and the payment page Preferred by the owner, subject to merchant eligibility. Billing is off; no payment is taken. | Email, Razorpay customer and subscription identifiers, Plan, Payment status | India; under review |
| Error monitoring (optional) | Server error reports | Request path, Error stack traces, Request id; never passwords or session tokens | To be decided |
Planned, not selected or not in use
A candidate provider. Receives nothing until it is reviewed and switched on.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare (Workers, D1, Durable Objects) | Running the cloud account API, database and live connections | Cloud-stored account data described in the Privacy Notice | To be decided |
| Transactional email provider (not yet selected) | Email verification, password reset and security notification emails | Email address, Content of service emails | To be decided |
Changes to this list
A provider is switched on only after a security and privacy review and a data processing agreement. Before a new provider starts receiving customer data, we will update this page and notify account holders by email in advance, so you have time to object or close your account.