Sub-processors
InTransparency engages the following sub-processors to deliver the service. We commit to inform users of any changes to this list with 30 days’ notice via product update or email.
| Provider | Role | Location | Data types | Safeguards | DPA |
|---|---|---|---|---|---|
| Vercel Inc. | Application hosting + CDN + Web Analytics | United States (company) — served from the global edge network; compute region is not pinned to the EU | Request metadata, IP addresses, page views | EU-US DPF + SCC | view |
| Neon Inc. | Managed Postgres database (primary data store) | EU (Frankfurt) | All user-submitted data | EU region, set at the Neon project level · AES-256 at rest · TLS in transit | view |
| Cloudflare, Inc. | R2 object storage (uploaded files), Turnstile (bot protection) | EU + global edge | Uploaded documents, project files, R2 access logs | EU-US DPF + SCC | view |
| Anthropic, PBC | Claude API (AI matching, parsing, project analysis) | US | Project descriptions, search queries, profile text passed for AI processing | SCC · Limited to the text the feature needs · Not used to train models, under their commercial API terms | view |
| Resend Inc. | Transactional email (verification, notifications, magic links) | US | Email address, message content of system emails | EU-US DPF + SCC | view |
| Stripe Inc. | Payment processing for Premium subscriptions | US (with EU representative) | Email, billing address, payment method (tokenized) | PCI-DSS Level 1 · EU-US DPF + SCC · Stripe is an independent controller for fraud prevention | view |
| Mixpanel, Inc. | Product analytics (in-app behaviour) | United States (company) — data sent to their EU host, api-eu.mixpanel.com | User id, email, page paths, in-app events | SCC · EU ingest host · Loaded only after analytics consent | view |
| HubSpot, Inc. | Website tracking and CRM (portal 147782942) | United States (company) — EU region endpoint, js-eu1.hs-scripts.com | Page views, IP address, form submissions on marketing pages | SCC · EU region · Loaded only after the visitor accepts marketing cookies | view |
Cross-border data transfers
Personal data is primarily stored in the European Union (Neon Frankfurt region). Where a sub-processor is established outside the EEA — currently Vercel, Anthropic, Resend, Stripe, Mixpanel, HubSpot, and Cloudflare for parts of its infrastructure — transfers rely on:
- EU-US Data Privacy Framework certification, where the provider is certified.
- Standard Contractual Clauses (SCC) Module 2 (controller → processor), as fallback and complement.
- Supplementary measures: encryption in transit and at rest, contractual prohibitions on government access requests without prior notice (where legally permitted), data minimization before transfer.
For Anthropic specifically, project content is sent under their commercial API terms, which provide that inputs are not used to train their models. We send only the text a feature needs. We hold no separate zero-retention addendum, and nothing in our code sets a zero-retention flag on the request.
Retention periods
| Data category | Retention | Legal basis |
|---|---|---|
| Active account profile + projects | For the lifetime of the account | Contract performance (Art. 6.1.b GDPR) |
| Your account, once you delete it | Erased when you delete it in Settings or in the apps; within 30 days when you ask us to | Right to erasure (Art. 17 GDPR) |
| AuditLog (compliance + AI traceability) | 24 months from the event | Accountability (GDPR Art. 5.2) + security (Art. 6.1.f) |
| Behavior analytics (page views, clicks, scroll depth) | 90 days, then deleted · only with analytics consent | Consent (Art. 6.1.a GDPR) |
| Newsletter for schools (email, optional role and school, proof of consent) | Until you unsubscribe · unconfirmed sign-ups deleted after 30 days | Consent (Art. 6.1.a GDPR) |
| Profile views (recruiter activity log shown to students) | 180 days | Legitimate interest (transparency to data subject) |
| Email logs (Resend bounce/delivery) | 30 days | Legitimate interest (deliverability monitoring) |
| Stripe billing records | 10 years | Legal obligation (Italian fiscal law DPR 600/1973) |
| Backups (Neon point-in-time recovery) | 7 days | Legitimate interest (disaster recovery) |
| Sign-in sessions | Website: 7 days after your last visit. Apps: 30 days after you last used the app. Changing or resetting your password ends every session, the one you are using included. | Contract performance |
Legal bases per processing activity
| Purpose | Legal basis | Detail |
|---|---|---|
| Account creation and platform use | Art. 6.1.b — Contract performance | Required to provide the service. |
| AI matching between students and opportunities | Art. 6.1.b — Contract performance | Core platform function. Turning off "profilePublic" takes a student out of recruiter match search. Results of a talent-match search are stored in a MatchExplanation record the student can read. |
| Importing your LinkedIn profile, only if you choose to | Art. 6.1.a — Consent | It happens only if you click "Import from LinkedIn" and approve it on LinkedIn's own screen; it is available to LinkedIn accounts in the EU/EEA and Switzerland. LinkedIn (LinkedIn Ireland Unlimited Company) then shares, once, the CV sections of your profile: name, headline, summary, experience, education, skills, languages, certifications, projects, honours, courses, publications and volunteering. We never request your posts, messages, connections or activity, and we discard your date of birth, address and postcode before anything is read. The rest is read by our AI provider (Anthropic, listed above) exactly like an uploaded CV, and only pre-fills your profile: nothing is saved until you check it. We keep the reading with your account until you replace it or delete the account. We do not keep LinkedIn's access key, so we cannot read your profile again unless you reconnect; you can also remove our access in LinkedIn's settings under Permitted services. Uploading a CV instead remains available. |
| Using InTransparency from your own Claude, only if you connect it | Art. 6.1.a — Consent | It happens only if you add InTransparency as a connector in your Claude account and approve it on our consent screen. Claude (Anthropic) can then read your profile, the skills on it with the work they come from, your projects with their analyses, job postings with how well they match you, and your applications; it can save a posting to your saved jobs and save a cover-letter draft, which you review and send yourself. It cannot apply for you, message companies or change your profile. What Claude reads goes into your Claude account and is handled by Anthropic under your own agreement with them, as an independent controller; we do not pay for or control that processing. We keep a record of the connection (when it was made and last used) and the drafts you save. You can disconnect it at any time from Settings → Connected apps, which stops access immediately. |
| Marketing emails (newsletter, product updates) | Art. 6.1.a — Consent | Opt-in only. Every non-essential email carries a one-click unsubscribe link, and the same control appears natively in Gmail and Outlook (List-Unsubscribe). No sign-in is needed to use it — it works for recipients who have no account with us. Once used, the address is suppressed for all senders except messages you need for an account you hold, such as a password reset. |
| The newsletter for schools, only if you sign up | Art. 6.1.a — Consent | You sign up with a box that is not pre-ticked, then confirm through the link we email you (sent by Resend, listed above); nothing is sent before you confirm. We keep your email address, the role and school you chose to give, the sentence you agreed to, when you agreed and on which page. Sign-ups that are never confirmed are deleted after 30 days. You can unsubscribe from any issue, and an unsubscribe from any of our emails stops this one too. |
| Behavior analytics (page views, clicks, heatmaps) | Art. 6.1.a — Consent | Analytics consent gates our product analytics (Mixpanel) and on-site behaviour tracking; the HubSpot tracker waits for marketing consent. Vercel Web Analytics and Speed Insights are mounted in the root layout and are gated by neither. |
| Audit log and security monitoring | Art. 6.1.c + Art. 6.1.f — Legal obligation + legitimate interest | GDPR Art. 5.2 accountability, AI Act Art. 12 traceability, fraud prevention. |
| Your CV on your school's public CV page (art. 6 D.Lgs. 276/2003) | Art. 6.1.a — Consent | Only if you switch it on in Privacy settings, school by school, and only when the date of birth you entered shows you are 18 or over and the school has opened its page. The school decides whether to open the page; we host it at /curricula/<school> and in the version the school embeds on its own website. It shows your name, programme, qualification year, bio, skills, experience, languages, certifications and a link to your profile if it is public, minus any section you hid on your CV; never your date of birth, address, phone or email. The page asks search engines not to index it. Switching it off takes you off the page at its next load and deletes the consent and its date; the page also stops showing you when your enrolment is no longer active. |
| Bot protection (Cloudflare Turnstile) | Art. 6.1.f — Legitimate interest | Necessary to protect the platform from automated abuse. Turnstile is privacy-preserving by design and does not set tracking cookies. |
| Tax and accounting records | Art. 6.1.c — Legal obligation | Italian fiscal law requires retention of billing records for 10 years. |
Automated decision-making (GDPR Art. 22 · AI Act Art. 86)
Our matching engine ranks candidates against open positions. The ranking itself runs without a human step in front of it; the decision to contact a candidate is taken by a recruiter. For the results of a talent-match search we keep a structured explanation — score, factors and the evidence behind them (visible to the student via the student dashboard). It is kept in a dedicated MatchExplanation record for 24 months from the match, after which a weekly job deletes it — unless a human review was recorded against it, or an open request of yours still needs it, in which case it is kept. The general audit log is kept for the same 24 months.
Public-facing details on the matching algorithm are available in our algorithm registry.
Security measures
- AES-256 encryption at rest (Neon, AWS-KMS managed keys)
- TLS 1.2+ for all in-transit traffic
- Application-level AES-256-GCM encryption for two-factor secrets, the tokens of connected integrations and ATS keys; two-factor backup codes are stored as bcrypt hashes
- Bcrypt cost-12 password hashing
- Two-factor sign-in with an authenticator app (TOTP): students turn it on in Settings → Security; other accounts have no screen to set it up
- Role-based access control + audit logging on sensitive operations
- Rate limiting on authentication, AI, and public endpoints
- HSTS, CSP, X-Frame-Options DENY (except the /embed widgets, which are made to be framed), SameSite cookies
- Cloudflare Turnstile bot protection on registration and login
Data subject rights & how to exercise them
- Access (Art. 15): download your data, as one JSON file that says what it leaves out and why, from /dashboard/student/privacy → Export.
- Rectification (Art. 16): edit your profile in the dashboard at any time.
- Erasure (Art. 17): students delete their account in Settings → Privacy, and school and tech-park staff in their own Settings; in the InTalent, InRecruiting and InCampus apps it is under Profile → Delete account. The deletion runs at once, and copies in database backups are gone within 7 days. Any other account asks us, from the rights section of /privacy or by email, and that deletion is due within 30 days.
- Portability (Art. 20): same export endpoint returns machine-readable JSON.
- Objection (Art. 21): opt out of marketing emails in settings. To change your analytics choice, write to us — the banner records the choice once and there is no way to re-open it in the product today.
- Complaint to supervisory authority: Garante per la protezione dei dati personali — garanteprivacy.it, or the supervisory authority of the country where you live.
Contact
Privacy enquiries: info@in-transparency.com. We respond within 30 days as required by GDPR.
This document is informational and forms part of our overall privacy framework with the high-level Privacy Policy and the Terms of Service. If you are signing a Data Processing Agreement (DPA), please request the latest version at the contact above.