shrtlst sub-processors
Draft for review. This text is not yet in effect.
Version 0.2 · Draft updated: 13 October 2026
Review by legal counsel is pending. Contracting entities and processing locations are still being confirmed where noted.
These are the providers that process personal data for shrtlst, including candidate information that you add. They work only on our instructions and under data protection terms. This list goes with our Privacy policy and Data Processing Addendum.
| Provider | What it does for shrtlst | Personal data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and private file storage | Accounts, workspaces, candidate records, CV files, decisions, usage events | European Union (Frankfurt, Germany) |
| Vercel | Hosting, application servers and scheduled jobs | Everything that passes through the app while a request runs; technical logs | Application-server locations are still being confirmed; global network for static files |
| OpenAI | AI models: reading CVs and writing the brief, matching and fit reasons, transcribing Talk recordings, reading Talk answers to understand the brief, writing and speaking Talk questions, answering questions in Ask shrtlst (the in-app help assistant) | CV text, attachments, context, brief, Talk audio, transcripts and typed answers, questions to Ask shrtlst, a hashed account identifier | United States. Requests are sent with storage turned off. Kept up to 30 days for abuse monitoring under the provider’s terms. Not used for training |
| Resend | Sending email: verification codes and password reset links; “You’re in” and referral notices (“Your free run is ready”); the founders’ notices of access requests, top-up requests, feedback and issues flagged from Ask shrtlst | Email addresses, names, workspace names, and the text of feedback and flagged issues | Processing locations are still being confirmed |
shrtlst also reads public company websites and public reference sources, such as Wikidata and Wikipedia, to check companies. These sites receive ordinary web requests from shrtlst’s servers. They receive nothing about the candidate or about you, so they aren’t sub-processors.
Changes
- We tell workspace owners by email at least 30 days before we add or replace a provider, and update this page. In an emergency, to keep shrtlst secure or running, we may make the change first and tell you as soon as we can.
- Provider objections: privacy@shrtlst.app.
- You can object to a new provider on reasonable data protection grounds from the app (Help → Report a problem), or by replying to any email from shrtlst. If we can’t resolve it, you can stop using shrtlst before the change takes effect.
History
| Date | Change |
|---|---|
| 12 October 2026 | First version |
| 13 October 2026 | Resend; domain emails |