Legal

Subprocessors

The vendors Simonara uses to process customer data. Every entry lists what they do, what data flows to them, where they operate, and how long they hold it. Version 2026-02-15.

OpenAI

Purpose: AI resume review, hiring brief generation, interview practice, and coaching completions.

Data shared: Resume text · job descriptions · session prompts · user-facing generated content.

Region: United States (SOC 2 Type II · GDPR/CCPA compliant)

Retention: Zero-retention API mode (0 days) for all Simonara traffic; no training on your data.

Google Gemini

Purpose: Fallback + specialist AI matching, resume parsing enrichment.

Data shared: Resume text · job descriptions.

Region: United States (SOC 2 Type II · GDPR/CCPA compliant)

Retention: No training on customer data (Gemini API terms).

PostHog

Purpose: Product analytics (page views, feature usage, funnel timings).

Data shared: Anonymous device IDs · click paths · signed-in user_id. No form values, no resume contents.

Region: United States

Retention: Rolling 12-month event retention.

Emergent (hosting + object storage)

Purpose: Application hosting, database (MongoDB), and object storage for resumes, avatars, and chat attachments.

Data shared: All customer data at rest and in transit.

Region: Kubernetes cluster in a US-primary region.

Retention: Retained for the life of your account · deleted within 30 days of account termination.

Resend

Purpose: Transactional email delivery (application ack, status change, chat notifications).

Data shared: Recipient email · subject · body.

Region: United States

Retention: Message metadata retained 30 days for deliverability audit.

Affinda

Purpose: Resume parsing (skills, years, work history extraction).

Data shared: Resume file (PDF/DOC/DOCX).

Region: Australia (US-region processing available on request).

Retention: 48 hours in Affinda staging; permanently deleted after parse completes.

Checkr

Purpose: Employer-authorized background screening (identity, employment, references).

Data shared: Candidate personal identifiers · consent record · report artifacts.

Region: United States (FCRA + state-compliant).

Retention: Governed by FCRA (7 years for reports); consent record retained per Simonara Privacy Policy.

Stripe

Purpose: Payment processing for employer subscriptions.

Data shared: Billing contact · card last-4 · invoice metadata. Full card numbers never touch Simonara servers.

Region: United States (PCI DSS Level 1).

Retention: Retained per Stripe's own retention policy.

Change notifications

Simonara notifies employers 30 days before onboarding a new subprocessor for customer data. Customers on a signed Data Processing Agreement can object in writing during the notice window. Questions? Email privacy@simonaratalent.us.