Subprocessors
Last updated: August 13, 2026
Memoa uses the following third-party service providers (“subprocessors”) to help operate the Service. Each subprocessor receives only the data described below, and only for the purpose described below. Where a provider publishes a data processing addendum, its name links to it; we are completing processing terms with the remaining providers before the Service opens beyond invited beta users.
Current Subprocessors
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database hosting, authentication, and storage | Account information, professional content, authentication tokens | United States |
| Vercel | Application hosting, edge function execution, and product/performance analytics (Vercel Analytics and Speed Insights — consent-gated) | Technical and usage data, request metadata; page views and Web Vitals only after you accept analytics | United States (edge: global) |
| OpenAI | AI extraction processing (data-use opt-out — not used for training) | Note text submitted for extraction (per-request, isolated) | United States |
| Stripe | Payment processing | Billing information, email, subscription metadata (no full card numbers stored by Memoa) | United States |
| Postmark | Transactional email delivery | Email address, message content (account verification, security alerts, receipts) | United States |
| Railway | NLP preprocessing — hosts Memoa's spaCy entity/metric service | Raw note text, sent at capture time for entity and number extraction | United States |
| PostHog | Product analytics (consent-gated — never runs before you accept) | Product events and a pseudonymous account identifier. No email address, no raw note or résumé text | United States |
| Sentry | Error monitoring | Diagnostic error data, which may include request context | United States |
| Upstash | Rate limiting and ephemeral cache | IP address; for the anonymous 'try' flow, submitted note text (15-minute TTL) | United States |
| Cloudflare | Bot protection (Turnstile) — signup, sign-in, password reset, and the anonymous try flow | IP address and browser challenge data | Global |
| Mapbox | Map tiles and place/address geocoding on the career map | IP address and the map area you are viewing when tiles load; the place or address text you type into location search | United States |
| OpenStreetMap Foundation | Map tiles on the jobs map (and as a fallback elsewhere), plus reverse geocoding (Nominatim) — turning a point you tap on the map into an address | IP address and the map area you are viewing; the coordinates of a point you tap on the map. Not the text you type into location search — that goes to Mapbox | United Kingdom / European Union |
| Expo (650 Industries) | Mobile push notification delivery | Device push token, and the title and body of each notification sent to you | United States |
Changes to This List
We will update this page when we add or remove subprocessors. If you would like to be notified of changes, contact privacy@mymemoa.ai.