This is a convenience translation. Only the German version is legally binding. Read the German version
Legal and transparency
Our service providers.
Last updated:
Deutsche Fassung1. Purpose and classification
This overview describes the service providers and data flows of the Reclyra platform. A provider is a sub-processor only insofar as it acts for the processing commissioned by the customer. Reclyra may itself be the controller for its own contract, payment and business data; a provider may also pursue its own statutory purposes.
Which providers and categories of data belong to the specific engagement is determined at contractual incorporation. The rules on incorporation and on changes of provider result from the data processing agreement.
2. Vercel – hosting and AI Gateway
Vercel Inc. provides website delivery, hosting and server-side functions. Technical request and access data as well as the application content transmitted in the process are processed. In the current architecture, application forms and initially uploaded CVs pass through the server functions. For an activated AI analysis, AI Gateway receives the prepared document text, job criteria and the analysis response.
The Vercel DPA excludes sensitive or special categories of data from Customer Data. Corresponding application content is therefore only covered by the scope of services after a separate contractual and technical clarification. This also applies to sensitive information contained unintentionally in a CV.
Vercel processes data internationally with the involvement of further subcontractors. This may include processing in the USA and access from outside the European Economic Area; this also covers support and administrative processes.
3. Supabase – database and private file storage
Supabase Pte. Ltd. provides the PostgreSQL database and private file storage. This concerns in particular user and workspace assignments, applications, documents, messages, notes, processes, analysis results and necessary technical records.
The Supabase DPA contains special requirements for Sensitive Data regarding necessary information and explicit consent. For such a scope of data, the contractual terms must be compatible with the specific legal basis of the applicant processing.
The Reclyra project is set up in the Frankfurt, Germany region (eu-central-1). Support, administrative and subcontractor access may take place outside this region. The project region therefore does not mean exclusively European processing of all data and operations.
4. Resend – transactional email communication
Resend, operated by Plus Five Five, Inc., sends the account and platform messages set up for this purpose as well as applicant communication triggered by the customer. The service receives the sender, recipient, subject, message content as well as sending and delivery metadata. Team invitations are currently provided as a link.
Where reply import is activated, Resend also receives applicant replies to protected reply addresses, including any attachments sent with them. After a technical check, Reclyra transfers only the plain text, subject, sender, time of receipt and number of attachments into the application. The provider's copy is not automatically removed by a deletion in Reclyra. Resend states 30 days for email and log data on the Pro plan, seven days for backups and early removal of individual messages via its support.
Resend names the USA as its primary processing location. The contractual data protection provisions and the conditions for international transfers are described in the DPA linked below.
5. AI inference via the gateway
For the CV analysis, Claude Haiku 4.5 with the model identifier anthropic/claude-haiku-4.5 is configured via Vercel AI Gateway. Anthropic is the model developer. It does not follow from this that every request is processed directly by Anthropic as the inference provider.
The current application path does not fix a single inference provider. The gateway can select the executing provider dynamically. The service used for the respective route receives document text and criteria and generates the analysis response. Excluding certain personal information in the text is not complete anonymisation.
The scope of the AI service requires a predetermined and permissible chain of recipients, including their processing locations. European processing or inference without retention does not follow from the model identifier. The general data processing agreement does not grant a blanket authorisation for additional dynamically selected inference providers.
6. Optional Google and Microsoft connections
Available Google or Microsoft calendar functions are used only after active connection by an authorised user. Account identifiers, calendar and appointment data, participants, meeting links, access permissions and synchronisation data may be processed in the process.
The role, contracting entity and processing locations depend on the connected account, the service and the underlying customer contract. For accounts commissioned by the customer itself, its Google or Microsoft agreements apply.
7. Service providers for Reclyra's own business operations
Stripe is used for payment, subscription and invoicing processes. Necessary customer, billing and transaction data is processed for this purpose. Application documents are not transmitted to Stripe for billing purposes. The legal role depends on the respective payment or billing product.
IONOS provides the business email mailboxes. Contact and support messages, including the content transmitted by the sender and technical metadata, pass through them. Please do not send complete application documents or login credentials unsolicited via general support channels. If data relating to the engagement is required for processing, the specific transmission method must be agreed in advance.
8. Changes and questions
In the event of an intended change to a sub-processor authorised for the engagement, the information and objection procedure of the agreed data processing agreement applies. An updated public overview alone does not replace the required prior information of the customer.
Questions about a specific data flow, contractual documents or the protective measures applicable to them can be sent to privacy@reclyra.app.