Last updated: October 12, 2026
Umamy takes data protection seriously. This page summarises how we host, process and protect data, who our sub-processors are, and how to exercise your rights. It reflects our current setup and is updated as we mature.
Some ancillary tools may process data outside the EU under appropriate safeguards (Standard Contractual Clauses and/or the EU-US Data Privacy Framework).
| Sub-processor | Purpose | Data region | Transfer safeguard |
|---|---|---|---|
| AWS | Core hosting (database, servers) | EU (Frankfurt) | EU region + DPF/SCC |
| Azure OpenAI (Microsoft) | AI analysis of profiles/messages | EU region | EU data zone + DPF |
| Unipile | LinkedIn connection & messaging | France (EU) | Intra-EU |
| Data-broker partner (US-incorporated) | Candidate data enrichment | EU (Frankfurt) | SCC (EU 2021/914) + UK IDTA |
| Seltz | Web search (candidates / employers) | To be confirmed | SCC where outside the EU |
| Unified.to | ATS synchronisation | US / Canada | SCC |
| OpenAI (API) | AI analysis (partial) | US / EU option | DPF + SCC |
| Mistral AI | AI analysis (EU) | EU | Intra-EU |
| Stripe | Billing & payments | EU (Ireland) / US | DPF + SCC |
| Resend | Transactional email | US | DPF + SCC |
| PostHog | Product analytics | EU Cloud (Frankfurt) | Intra-EU |
| Cloudflare | CDN / security | Global / EU option | DPF + SCC |
| Vercel | Web app hosting | US / EU functions | DPF + SCC |
| Supabase | Application database (candidate data) | EU (EU instance) | SCC (EU 2021/914) |
Last updated October 12, 2026. Our full sub-processor register is available on request.
Our data-broker partner is SOC 2 Type 2 certified, hosted on ISO 27001-certified infrastructure, CCPA-compliant, stores data in the EU, and frames any onward transfer under the EU Standard Contractual Clauses (Decision 2021/914). Its default retention is 3 months.
Our legal basis for candidate sourcing is legitimate interest (Art. 6(1)(f) GDPR). Candidates are informed via our Candidate Notice. You can exercise your rights (access, rectification, erasure, objection, restriction, portability) at [email protected], and lodge a complaint with the CNIL. An objection to contact is applied across all our clients (do-not-contact list).
Umamy uses AI to score and rank candidate fit. This does not involve solely automated decisions with legal or similarly significant effect (Art. 22 GDPR): a human reviews and decides the final shortlist, and you can request a review.
AI Act. Our system is classified as high-risk under Annex III of Regulation (EU) 2024/1689 (recruitment). Umamy is the provider; our clients are deployers. We are completing our compliance program: systematic human oversight, event logging and traceability, technical documentation, risk management and data governance.
Use of your data. Our third-party AI providers do not reuse your data to train their own models via their API tiers. Umamy itself, as an independent data controller, reuses only interest signals derived from candidate responses (such as availability or openness to new opportunities) — not the content of exchanges or client-confidential data — to improve its own matching technology, on the basis of its legitimate interest.