Sub-processors
Last updated: May 15, 2026
CVeetje engages the following parties to deliver the service. This page is our public sub-processor list as referenced in art. 28(2) GDPR. We will notify you by email or via this page about any planned change.
CVeetje acts as processor on your behalf for content you input (profiles, CVs). GroeimetAI is controller for account data, payment data and logs.
Active sub-processors
Google Cloud Platform (Firebase Auth, Firestore, Cloud Storage, Cloud Run)
Purpose
Authentication, storage of profiles/CVs/transactions, file storage, application hosting.
Data processed
Account & profile data, CV content, uploads, session cookies, server-side logs.
Location
europe-west4 (Eemshaven, Nederland)
Safeguard
Google Cloud DPA, EU SCCs for any intra-group transfers, EU-US Data Privacy Framework certification.
Anthropic, PBC
Purpose
Platform AI (Claude Opus 4.7) for generating CV content, cover letters, fit analysis and style.
Data processed
Prompt content: profile summary, job description, user instructions. No login or payment data.
Location
Verenigde Staten
Safeguard
Commercial Terms of Service + DPA, EU SCCs (module 2), zero data retention where available, no training on API inputs (Anthropic commercial terms).
Mollie B.V.
Purpose
Processing of credit purchases (iDEAL, credit card, etc.).
Data processed
Email, name, payment method, transaction amount. Full payment data (PAN) stays with Mollie.
Location
Amsterdam, Nederland
Safeguard
PSD2-regulated payment institution, separate controller/processor under GDPR. Mollie DPA applies.
Adzuna Ltd.
Purpose
Aggregation of public job postings for the jobs board.
Data processed
No personal user data. Only anonymous search queries (location, keywords) are sent to Adzuna.
Location
Verenigd Koninkrijk
Safeguard
UK adequacy decision (EU Commission, June 2021). No personal data in transit.
GitHub, Inc. (Microsoft)
Purpose
Creating issues based on user feedback in a private repository.
Data processed
Feedback body (free text), category, optional screenshot. Email only if explicitly supplied.
Location
Verenigde Staten
Safeguard
Microsoft Products & Services DPA, EU SCCs, EU-US Data Privacy Framework certification.
Google reCAPTCHA v3 (Google Ireland Ltd.)
Purpose
Abuse detection on registration and login, protecting against automated attacks.
Data processed
IP address, browser environment, mouse/touch behavior. Score is returned to CVeetje; no personal data stored on our side.
Location
EU + Verenigde Staten
Safeguard
Google Cloud DPA, EU-US Data Privacy Framework. Used solely on the basis of legitimate interest (art. 6(1)(f) GDPR).
Firebase Trigger Email extension (Google LLC)
Purpose
Queue for transactional emails (verification, notifications). The extension runs as a Cloud Run service.
Data processed
Recipient email address, subject, email body (HTML).
Location
us-central1 (Verenigde Staten) — bron-data staat in EU Firestore
Safeguard
Covered by Google Cloud DPA + EU SCCs. We are evaluating migration to an EU-only SMTP processor.
Google Analytics 4 (Google Ireland Ltd.) — optioneel
Purpose
Anonymous usage statistics, only after explicit consent via the cookie banner.
Data processed
Anonymized IP address, page views, click behavior, device and browser information.
Location
EU + Verenigde Staten
Safeguard
Google Cloud DPA, EU-US Data Privacy Framework, `anonymize_ip` enabled, no advertising features.
BYOK providers (your own API key)
When you configure your own API key in CVeetje, the parties below are not sub-processors of CVeetje. You enter into a direct agreement with the provider and are the controller for that processing.
OpenAI, OpenAI Ireland Ltd.
BYOKPurpose
BYOK: AI generation via user's own key.
Data processed
Prompt content from your browser/CVeetje directly to OpenAI.
Location
Verenigde Staten / Ierland
Safeguard
Under your own agreement with OpenAI. In this mode CVeetje is not a processor — the relationship is directly between you and OpenAI.
Google AI (Gemini) / Google Vertex AI
BYOKPurpose
BYOK: AI generation via user's own key.
Data processed
Prompt content directly to Google.
Location
EU + Verenigde Staten
Safeguard
Under your own Google Cloud / AI Studio agreement.
Overige BYOK-providers (Mistral, Groq, DeepSeek, Together, Fireworks, Azure, Cohere, etc.)
BYOKPurpose
BYOK: AI generation via user's own key.
Data processed
Prompt content directly to the provider.
Location
Variabel (EU/VS/UK afhankelijk van provider)
Safeguard
Under your own agreement with the provider. We recommend reviewing the chosen provider's DPA / privacy policy.