Data processing
Subprocessors
Last updated: 20 September 2026
We keep the list of companies that process user data on our behalf short, and we say what each one actually receives — not just its name. We update this list before adding any new provider that touches user data.
Supabase
- What it does for Lykka
- Database, authentication, file storage
- What user data it receives
- Everything you store in Lykka: account and profile (including optional personal details and photos), career data including target roles and their derived embeddings, uploaded resume files, applications, match scores and per-dimension analyses, generated documents, usage records, notifications, the anonymous deletion-feedback record, and security telemetry (CSP violation reports).
- Processing region
- Switzerland
- Transfer safeguard
- Data Processing Addendum; data remains in Switzerland (no third-country transfer for storage).
Anthropic
- What it does for Lykka
- AI generation and analysis (drafting, match scoring, section regeneration, resume parsing, onboarding suggestions)
- What user data it receives
- Per request, feature-dependent: your pseudonymized career narrative — identity fields replaced by placeholder tokens before sending — plus the job description (title, company, location, posting URL reduced to its address); onboarding and role-enrichment details and worksheet answers (no identity fields); on section regeneration, the current generated document with its header removed and letter greeting/signoff tokenized. Disclosed exception: uploaded-resume text for parsing is sent as-is — the parse exists to find this data. Names or contact details you type into free-text career content are not reliably removable and may ride along. Content is not retained by default on the API endpoints we use (trust-and-safety-flagged content up to 2 years) and is not used to train models.
- Processing region
- United States
- Transfer safeguard
- Data Processing Addendum incorporated in Anthropic's Commercial Terms, including Standard Contractual Clauses for international transfers.
Voyage AI
- What it does for Lykka
- Similarity embeddings for job matching
- What user data it receives
- Public job titles and your chosen target-role titles, as bare text — no account identifiers, no broader career history.
- Processing region
- United States
- Transfer safeguard
- Provider terms. Voyage may retain and use the submitted title text under its standard terms; the payload carries no account identifiers or personal details.
Netlify
- What it does for Lykka
- Web hosting / CDN
- What user data it receives
- As the application host it transiently processes every web request the app makes — including sign-in requests (credentials in transit), file uploads, and the account, career, and application data the server renders — plus standard request metadata (IP address, user agent). It does not hold the database at rest.
- Processing region
- Global CDN (origin functions in the EU/US)
- Transfer safeguard
- Netlify Data Processing Agreement (incl. SCCs).
Resend
- What it does for Lykka
- Transactional email delivery for account emails (confirmation, password reset)
- What user data it receives
- Recipient email address; message content including one-time sign-in links; delivery, bounce, and suppression metadata. Open/click tracking is disabled for account mail.
- Processing region
- Message content: Ireland (EU); account and delivery metadata may be processed in the United States or elsewhere under Resend's DPA
- Transfer safeguard
- Resend Data Processing Addendum (incl. Standard Contractual Clauses).
Cloudflare
- What it does for Lykka
- Turnstile bot detection for the public waitlist
- What user data it receives
- Browser and device security signals: IP address, TLS fingerprint, user-agent header, the Turnstile site key, and the page origin. Lykka sends the short-lived challenge token — never your waitlist email — for validation and retains neither token nor response. In your browser, the widget keeps one functional value (cf.turnstile.u) in Cloudflare's own partitioned storage; in our audit it set no cookies, and the browser's partitioning is designed to prevent cross-site recognition. Cloudflare acts as processor when protecting Lykka and as controller when improving its bot detection.
- Processing region
- Global security network
- Transfer safeguard
- Cloudflare Data Processing Addendum (incl. EEA/Swiss/UK transfer terms).
Sentry
- What it does for Lykka
- Server error monitoring — so we learn about failures before you have to email us
- What user data it receives
- Error reports from our servers only (nothing runs in your browser): the error's type, scrubbed message and stack trace, which endpoint failed, timing, and a pseudonymous user ID where relevant. A strict filter strips unknown fields and request bodies/headers/cookies and redacts email addresses and token-like values before anything is sent; IP-address storage is disabled at the provider. Events are deleted after 90 days.
- Processing region
- EU data residency (Frankfurt ingestion)
- Transfer safeguard
- Sentry Data Processing Addendum.
Zoho Mail
- What it does for Lykka
- The support and privacy-contact inbox (support@lykka.io)
- What user data it receives
- Whatever you choose to send to support: your email address, message content, and any attachments — plus our replies. Nothing is pushed from the app to this inbox.
- Processing region
- EU data center
- Transfer safeguard
- Zoho data-processing terms.
Superwall (Nest22, Inc.)
- What it does for Lykka
- Hosted paywalls, campaigns, placements, Web Checkout, subscription-entitlement reconciliation, and conversion reporting; automated post-purchase emails are disabled
- What user data it receives
- An environment-scoped opaque billing subject carried as the hosted-checkout app_user_id (not your raw Lykka account ID); paywall, placement, and purchase events; the email you enter at checkout; hosted-page device, network, and browser-storage data; and Stripe-reconciled product, subscription, and entitlement facts. Lykka sends no resume, cover letter, job, profile, or career content.
- Processing region
- United States and international subprocessors
- Transfer safeguard
- Superwall Data Processing Addendum: processor role; EU Standard Contractual Clauses Modules 2 and 3, UK addendum, and Swiss FADP amendment. Superwall offers reasonable assistance with individual erasure requests but states no completion deadline. At service termination, the customer may request return or destruction within 30 days, subject to backup practices; that is not an end-user deletion deadline.
Stripe
- What it does for Lykka
- Payment checkout and processing, provider-authenticated hosted Customer Portal, exact server subscription reads for owner support and deletion, and account-deletion cancellation for Lykka+
- What user data it receives
- Purchaser email; payment method; billing and tax information; fraud, security, and request metadata; checkout, invoice, transaction, dispute, and subscription records; and minimum exact subscription identifiers and hosted-login or deletion-request metadata.
- Processing region
- Global
- Transfer safeguard
- Stripe Data Processing Addendum: processor for running payments and independent controller for fraud prevention, AML/KYC compliance, billing and invoicing, and service improvement; Standard Contractual Clauses Modules 1 and 2, EU-US/Swiss-US/UK-US Data Privacy Framework, and UK addendum. Processor data lasts for the contract term and post-termination duties; legal and controller retention can continue longer.
Third-party content requests
Not processors, but you should know: company logos shown in the app are served from Lykka's own infrastructure. Our servers fetch them from DuckDuckGo's public icon service using only the company's domain — your browser never contacts that service, and nothing about you (not your IP address, browser, or data) is sent to it.
Not subprocessors (for clarity)
GitHub hosts our source code and runs our job-ingestion automation — it processes public job-posting data, never user data. Analytics: no third-party service receives user-level behavioral data; if an aggregate traffic tool is ever adopted, it is added here first.
Questions? The contact route in our Privacy Policy applies here too.