These are the companies that process personal data on KeyStone's behalf, what each does, and what it receives. We update this page when the list changes.
| Provider | What it does for KeyStone | What it receives |
|---|---|---|
| Netlify, Inc. | Hosts the website and the server functions, stores profile photos and the shared pool of public job postings, and measures how fast pages load. | Your requests and IP address, profile photo, and the data your requests carry while they are processed. |
| Google (Firebase Authentication and Cloud Firestore) | Signs you in and stores your account data. | Your email address and name (with Google sign-in), CV text, tailored versions, applications, grant drafts, job-match settings and match list. |
| OpenRouter, Inc. and the AI model providers it routes to | Runs the AI models that write fit assessments, rewrites, cover letters, interview prep and grant drafts. | The CV text, job descriptions, grant calls and briefs you submit for an AI step. Not used for finding job matches. |
| Requesty Ltd and the AI model providers it routes to | Runs the same AI steps as a backup, only when OpenRouter cannot answer. It is an AI gateway that passes the request to a model provider. | The same text OpenRouter would receive for that step. Never used when you have added your own OpenRouter key, and never used for finding job matches. |
| Groq (GroqCloud) | Runs the same AI steps as a further backup, only when OpenRouter cannot answer. | The same text OpenRouter would receive for that step. Never used when you have added your own OpenRouter key, and never used for finding job matches. |
| Resend | Delivers email: sign-in codes, welcome messages, reminders, documents you choose to email yourself or others, and, if you turn it on, the daily matches email. | Your email address and the content of the email. |
| Cloudflare, Inc. | Sits in front of the site as DNS, content delivery and security. | Your IP address and request details as they pass through. |
What the AI backups say they do with your text
We report what each provider publishes, not what we have verified. Read their own terms before you rely on this.
- Requesty says it does not train models on your data. It may keep logs, stored encrypted in the EU, for up to 30 days unless logging is turned off, and it passes your text on to the model provider it selects, whose own practices then apply. Its policy is at requesty.ai/privacy.
- Groq says it does not retain data from API requests by default, though it may keep inputs and outputs for up to 30 days to investigate reliability problems or suspected abuse, and that its data is stored in the United States. Its page does not say whether it trains on customer data. See Groq's data page.
Not subprocessors
To build your job matches we read public job postings from company job boards (through the Greenhouse, Lever and Ashby feeds) and from free public job feeds (Remotive, Remote OK, Himalayas, Jobicy, Arbeitnow, We Work Remotely, Working Nomads and MyJobMag), and each day we re-read the official pages of the grants, fellowships and visa routes we list. That is a one-way read of public pages. None of your data is sent to them.
Where the data goes
These providers operate in the United States and other countries. How we handle transfers is explained in the privacy policy.
Data processing agreements
KeyStone is used by individuals, so we do not currently offer a data processing agreement. If you are an organisation that needs one, email [email protected] and we will talk it through.