Sub-Processors
The providers that process personal data on our behalf
Last updated: 24 June 2026
FolioBuild uses the third-party services below to operate the product. Each is a sub-processor that processes personal data on our behalf under a data-processing agreement (DPA). We do not sell or rent your personal data. For how this relates to your rights and to international transfers, see our Privacy Policy (§6–§7).
| Provider | Purpose | Personal data | Region | Transfer safeguard | DPA |
|---|---|---|---|---|---|
| Clerk | Authentication & account management | Email, name, avatar, login activity | USA | UK Addendum to SCCs (per DPA) | DPA |
| Convex | Application database (accounts, portfolios, projects, file records) | Account + portfolio/project/file content | USA | UK Addendum to SCCs (per DPA) | DPA |
| Vercel | Hosting, image storage (Blob) & cookieless analytics | Uploaded images, request/usage data | USA / global edge | EU–US Data Privacy Framework (UK extension) — certified | DPA |
| Stripe | Subscription billing & payments | Name, email, billing details (card data handled by Stripe — we never see it) | USA / global | EU–US Data Privacy Framework (UK extension) — certified | DPA |
| OpenAI | AI CV parsing & content generation | CV text submitted for extraction (may include special-category data) | USA | UK Addendum to SCCs (per DPA); not used for training, inputs retained ≤30 days for abuse monitoring | DPA |
Transfer safeguards and Data Privacy Framework (DPF) certifications shown are as at June 2026; certification status is entity-specific and can change — verify a provider’s current listing on the public DPF list.
We review this list as our stack changes and will update it here. If a change materially affects how your data is processed, we will note it in the Privacy Policy and, where appropriate, notify you. Questions or a concern? Use our complaints form or email sup.foliobuild@gmail.com.