Legal

Processors and recipients

The services that may process information when you use JobWeGo.

Last updated 2 August 2026

Taktflow ApS is the controller. This list distinguishes processors, providers with mixed roles, and other recipients. Not every service is used in every flow; optional analytics and campaign services are enabled only after your consent.

Supabase

Processor

Purpose and data: Login, database, file storage and API; account, profile, CV, applications and usage data.
Processing location: Primarily Ireland (EU); approved global subprocessors.
When used: Active for all accounts.

Privacy terms

Railway

Processor

Purpose and data: API, background jobs, internal CV/PDF services and Redis queue; application data and necessary server logs.
Processing location: EU West hosting; Railway is US-based and uses global subprocessors.
When used: Active for all accounts.

Privacy terms

Vercel

Mixed role

Purpose and data: Web hosting and default-on aggregated Web Analytics; request and device metadata.
Processing location: Frankfurt hosting; global support/subprocessors.
When used: Hosting is necessary; Analytics starts by default and stops immediately if rejected or withdrawn.

Privacy terms

Anthropic

Processor

Purpose and data: CV analysis, Voice Profile and generation; CV, profile, job and application text.
Processing location: United States and approved subprocessors.
When used: Active when AI features are used.

Privacy terms

Google (Gemini API)

Mixed role

Purpose and data: Private job scoring, embeddings and short-lived caches; CV/profile and job text.
Processing location: Global Google infrastructure.
When used: Active in matching and embedding flows.

Privacy terms

Resend

Processor

Purpose and data: Transactional email and notifications; email address, name and message content.
Processing location: Primarily United States and approved subprocessors.
When used: Active when we send an email.

Privacy terms

Sentry

Processor

Purpose and data: Errors and performance; sanitised technical data and default-on masked Session Replay.
Processing location: EU data region; approved global subprocessors.
When used: Server diagnostics are necessary; Replay starts by default and stops immediately if rejected or withdrawn.

Privacy terms

PostHog

Processor

Purpose and data: Default-on product analytics and a sample of strongly masked Session Replay; product name, pseudonymous user ID, normalised page, device and selected feature events without CV, job or application text.
Processing location: Frankfurt, Germany (PostHog EU Cloud); approved global subprocessors.
When used: Product analytics and Replay start by default; Replay runs while both Analytics and Error diagnostics remain enabled, and stops immediately if either is rejected or withdrawn.

Privacy terms

Stripe

Mixed role

Purpose and data: Subscriptions, payments, fraud prevention and statutory payment data.
Processing location: EU and global Stripe infrastructure.
When used: Only when paid access is activated or administered.

Privacy terms

HeiGIT / openrouteservice

Other recipient

Purpose and data: Commute-time calculation; origin and destination coordinates without name or user ID.
Processing location: Germany (HeiGIT).
When used: Active for a new commute lookup when no cached result exists.

Privacy terms

Google Analytics / Tag Manager

Mixed role

Purpose and data: Visit and conversion analytics; page, referrer, device and online identifiers.
Processing location: Global Google infrastructure.
When used: Only after campaign consent.

Privacy terms

Meta

Other recipient

Purpose and data: Campaign measurement on Facebook and Instagram; browser and campaign data.
Processing location: Global Meta infrastructure.
When used: Only after campaign consent.

Privacy terms

Other recipient

Purpose and data: Campaign measurement on LinkedIn; browser and campaign data.
Processing location: Global LinkedIn infrastructure.
When used: Only after campaign consent.

Privacy terms

Provider	Purpose and data	Processing location	When used
Supabase Processor Privacy terms	Login, database, file storage and API; account, profile, CV, applications and usage data.	Primarily Ireland (EU); approved global subprocessors.	Active for all accounts.
Railway Processor Privacy terms	API, background jobs, internal CV/PDF services and Redis queue; application data and necessary server logs.	EU West hosting; Railway is US-based and uses global subprocessors.	Active for all accounts.
Vercel Mixed role Privacy terms	Web hosting and default-on aggregated Web Analytics; request and device metadata.	Frankfurt hosting; global support/subprocessors.	Hosting is necessary; Analytics starts by default and stops immediately if rejected or withdrawn.
Anthropic Processor Privacy terms	CV analysis, Voice Profile and generation; CV, profile, job and application text.	United States and approved subprocessors.	Active when AI features are used.
Google (Gemini API) Mixed role Privacy terms	Private job scoring, embeddings and short-lived caches; CV/profile and job text.	Global Google infrastructure.	Active in matching and embedding flows.
Resend Processor Privacy terms	Transactional email and notifications; email address, name and message content.	Primarily United States and approved subprocessors.	Active when we send an email.
Sentry Processor Privacy terms	Errors and performance; sanitised technical data and default-on masked Session Replay.	EU data region; approved global subprocessors.	Server diagnostics are necessary; Replay starts by default and stops immediately if rejected or withdrawn.
PostHog Processor Privacy terms	Default-on product analytics and a sample of strongly masked Session Replay; product name, pseudonymous user ID, normalised page, device and selected feature events without CV, job or application text.	Frankfurt, Germany (PostHog EU Cloud); approved global subprocessors.	Product analytics and Replay start by default; Replay runs while both Analytics and Error diagnostics remain enabled, and stops immediately if either is rejected or withdrawn.
Stripe Mixed role Privacy terms	Subscriptions, payments, fraud prevention and statutory payment data.	EU and global Stripe infrastructure.	Only when paid access is activated or administered.
HeiGIT / openrouteservice Other recipient Privacy terms	Commute-time calculation; origin and destination coordinates without name or user ID.	Germany (HeiGIT).	Active for a new commute lookup when no cached result exists.
Google Analytics / Tag Manager Mixed role Privacy terms	Visit and conversion analytics; page, referrer, device and online identifiers.	Global Google infrastructure.	Only after campaign consent.
Meta Other recipient Privacy terms	Campaign measurement on Facebook and Instagram; browser and campaign data.	Global Meta infrastructure.	Only after campaign consent.
LinkedIn Other recipient Privacy terms	Campaign measurement on LinkedIn; browser and campaign data.	Global LinkedIn infrastructure.	Only after campaign consent.

Transfers outside the EU/EEA

Where personal data may be processed in a country outside the EU/EEA without an adequacy decision, we use the provider's applicable transfer mechanism, typically the European Commission's Standard Contractual Clauses and, where relevant, the EU-U.S. Data Privacy Framework. We also assess data minimisation, encryption, access and the provider's subprocessors.

Questions or objections

Email dpa@jobwego.dk if you want more information about a provider or transfer.