resume.coffee - Professional Resume Builder

1. About This List

This page lists all third-party subprocessors (Auftragsverarbeiter) engaged by resume.coffee to process personal data on behalf of our users. Under GDPR Art. 28 and the Swiss nDSG, we are required to inform you about the subprocessors we use and to obtain consent (or provide a right to object) before engaging new subprocessors. This list is maintained and updated whenever there are changes to the subprocessors we engage. We encourage you to review this page periodically. For details on how we handle your data overall, please see our Privacy Policy. Definitions: - Subprocessor — A third-party service provider that processes personal data on our behalf to deliver part of our service. - Transfer mechanism — The legal safeguard ensuring your data is protected when transferred outside the EU/EEA or Switzerland. - Data categories — The types of personal data processed by the subprocessor.

2. Infrastructure & Hosting

Google LLC (Firebase) - Purpose: Cloud hosting, authentication (Firebase Auth), database (Firestore), file storage (Cloud Storage) - Data categories: Account data, authentication tokens, resume content, uploaded files, application data - Location: Europe (europe-west4, Netherlands) - Transfer mechanism: EU Adequacy - DPA / Privacy: Google Cloud Data Processing Terms

3. Payment Processing

Stripe, Inc. - Purpose: Payment processing, billing, subscription management - Data categories: Billing name, email address, billing address, tokenized payment methods, transaction data, subscription status - Location: United States (EU processing via Stripe Technology Europe, Ltd., Ireland) - Transfer mechanism: EU Standard Contractual Clauses (SCCs) + EU-US Data Privacy Framework - DPA / Privacy: Stripe Privacy Policy Note: resume.coffee does not store full payment card numbers. All payment data is processed and stored directly by Stripe, which is PCI DSS Level 1 certified.

4. Analytics & Tag Management

Google LLC (Google Analytics 4) - Purpose: Web analytics, traffic measurement, usage pattern analysis - Data categories: IP address (anonymized), usage data, device information, browser type, page interactions - Location: United States / EU - Transfer mechanism: EU Standard Contractual Clauses (SCCs) + Google Data Privacy Framework (DPF) - DPA / Privacy: Google Analytics Terms of Service Google LLC (Google Tag Manager) - Purpose: Tag management, consent mode integration, script loading management - Data categories: Consent state, page load data, tag firing events - Location: EU - Transfer mechanism: EU Adequacy - DPA / Privacy: Google Tag Manager Terms of Service Note: Google Analytics is only activated with your explicit consent via our cookie consent banner. IP anonymization is enabled by default.

5. AI & Machine Learning

Google LLC (Generative AI / Gemini) - Purpose: AI-powered resume optimization, professional summary generation, experience description suggestions, skill suggestions, cover letter generation - Data categories: Resume content submitted for AI processing (job titles, descriptions, skills, education). Data is processed in real-time and is not stored by Google for model training purposes. - Location: United States / EU - Transfer mechanism: EU Standard Contractual Clauses (SCCs) - DPA / Privacy: Google Cloud Data Processing Terms Note: AI features are optional. Resume content is sent to Google's Generative AI API only when you explicitly use AI-powered features (e.g., "Optimize with AI" buttons). Google does not use this data to train its models under our service agreement.

6. Consent Management

Cybot A/S (Cookiebot) - Purpose: Cookie consent management, consent record-keeping, cookie scanning - Data categories: Consent preferences, IP address (anonymized), consent timestamp, user agent - Location: EU (Denmark) - Transfer mechanism: EU Adequacy (intra-EU processing) - DPA / Privacy: Cookiebot Privacy Policy

7. Deployment

Google LLC (Firebase App Hosting) - Purpose: Application deployment, hosting, CDN, request routing - Data categories: Application code, request logs, access logs - Location: Europe (europe-west4, Netherlands) - Transfer mechanism: EU Adequacy - DPA / Privacy: Google Cloud Data Processing Terms

8. Change Log

We document all changes to our subprocessor list here. If you have subscribed to notifications, you will be informed of material changes in advance. February 7, 2026 — Version 1.0 - Initial publication of subprocessor list

9. Contact

If you have questions about our subprocessors or wish to object to the engagement of a new subprocessor, please contact us: dataWorks GmbH Seestrasse 59 8702 Zollikon Switzerland Email: hello@resume.coffee You may also exercise your data protection rights via our Data Deletion Request page. For questions about how we handle your data in general, please refer to our Privacy Policy.

Subprocessor List