Version 1.0 · 7 September 2026
The companies that process information on Refery’s behalf, what each one does, and what we hold about them. If you are a candidate and want to know where your information goes, this is the list.
What “being confirmed” means
Every provider below is one we genuinely use. What is still being established for each is the exact contracting entity, the regions it processes in, and the contract terms that apply to our own account. We would rather publish that plainly than fill the gaps with something that sounds right. A provider’s head office is not the same fact as where your data is processed, and a company’s published terms are not evidence of the settings on our account.
Vercel
Being confirmedHosting and application delivery
Everything the application serves, in transit. Request logs.
Deployment, edge and log regions being confirmed against the plan we are on.
Supabase
Being confirmedDatabase, authentication and file storage
Candidate records, CVs, accounts, agreements.
Project region, storage privacy settings, backup and log retention being confirmed.
Resend
Being confirmedTransactional email
Recipient addresses and message content, including signed agreements.
Retention of message content and processing countries being confirmed.
Vercel AI Gateway
Being confirmedRouting model requests to the providers below
Whatever a given request contains, in transit.
Downstream contract chain and the settings on every fallback route being confirmed.
Anthropic
Being confirmedModel inference
CV text and role descriptions, for assessment and drafting.
Whether we reach it directly or through the gateway, and the no-training and retention terms that apply to that route, being confirmed.
OpenAI
Being confirmedModel inference
CV text and role descriptions, for assessment and drafting.
Endpoint behaviour, data-sharing settings and retention eligibility being confirmed.
Model inference, and separately mailbox and calendar access
CV text for inference. Mail and calendar entries for scheduling and correspondence.
These are different services under different terms and are being recorded separately rather than as one entry.
Slack
Being confirmedInternal notification and approval
Candidate names and short summaries in internal messages.
Message payload minimisation, workspace region and deletion being confirmed.
Granola
Being confirmedMeeting notes and transcripts
Notes and transcripts of calls, which may mention candidates.
Recording notice, retention and onward AI processing chain being confirmed.
We use automated tools to read CVs, summarise them, suggest which roles someone may suit and draft correspondence. Candidate information is not used to train these providers’ models. That is a commitment we make in our partner agreement, and every route a request can take is on an approved list: a model that is not on it cannot be reached, even by misconfiguration, so a provider being unavailable can never quietly move your data somewhere we have not approved.
What we are still documenting is the contractual chain behind each route: the exact contracting entity, the terms that apply to our account, and how long a provider holds a request for its own abuse monitoring. No training and no retention are different promises, and we would rather show our working than round the second one up to the first.
If you want the detail behind any row, including the contracting entity and the terms we hold, write to privacy@refery.io. See also our privacy notice.
This register is versioned. When a provider is added, removed, or its status changes, the version and date at the top change with it.