Clarvo Sub-processor List
Pursuant to the Clarvo Data Processing Agreement
Document
Clarvo Sub-processor List
Version
February 2026
1. Overview
This document lists the sub-processors engaged by Clarvo Oy to provide the Services described in the Principal Agreement and the Data Processing Agreement (DPA). Clarvo maintains this list and will notify the Controller at least thirty (30) days prior to any changes.
2. Infrastructure
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, compute, database, storage, CDN | Sweden Central — EEA | N/A (data remains in EEA) |
3. AI Services
Clarvo uses AI models to power semantic search, relevance scoring, and profile enrichment. Candidate names and direct identifiers are not transmitted to AI models. Data sent consists of anonymized or pseudonymized professional context only.
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| OpenAI, Inc. | AI-powered semantic search, relevance scoring, and natural language processing | United States | EU Standard Contractual Clauses (SCCs) |
| Google LLC (Gemini API) | AI-powered candidate relevance scoring, natural language understanding, and profile enrichment | EEA / United States | EU SCCs; Google Cloud DPA |
4. Communication & Integrations
LinkedIn and email integrations are opt-in features that the Controller activates at their discretion.
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Unipile SAS | LinkedIn and E-mail messaging integration (opt-in). Enables outreach via the Controller's own LinkedIn account or E-mail account. | France (Scaleway) — EEA | N/A (data remains in EEA) |
| SendGrid (Twilio Inc.) | User account authentication and transactional system notifications (e.g., password resets). Note: SendGrid is not used to process Candidate Data or send candidate outreach. | EU region — EEA | N/A (data remains in EEA) |
| Google LLC (Gmail API) | OAuth authentication for Gmail integration (opt-in). Email sequence sending. | EEA (EU data region) | EU SCCs; Google Cloud DPA |
5. Payments
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoicing | Ireland (EU entity) — EEA | N/A (Stripe Technology Europe, Ltd.) |
6. Analytics
Analytics tools are consent-based. Users may decline analytics cookies without affecting core platform functionality.
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google Analytics | Website and platform usage analytics (consent-based) | EEA (EU data region) | EU SCCs; Google Cloud DPA |
| Microsoft Clarity | User behavior analytics, heatmaps, session recordings (consent-based) | United States | EU SCCs; Microsoft DPA |
7. Opt-in Architecture
Clarvo's platform uses an opt-in architecture for integrations involving third-party data processing. The Controller's data protection exposure is limited to only the sub-processors relevant to the features they activate:
- LinkedIn integration (Unipile): Facilitating candidate outreach and synchronization via connected email accounts and LinkedIn profiles. This processing only occurs if the user explicitly authenticates and connects their external email account or personal LinkedIn account. All data processed within EEA (France, Scaleway).
- Gmail integration (Google): Only active when the Controller connects their Gmail via OAuth.
- Email outreach (SendGrid): Delivery of transactional system notifications (e.g., account confirmations, password resets) directed solely at Clarvo Users.
- Analytics (Google Analytics, Microsoft Clarity): Consent-based. Declinable via cookie banner.
8. Changes to This List
Clarvo will update this list and provide at least thirty (30) days' advance notice before engaging a new sub-processor, per Section 7 of the DPA.
Contact: info@clarvo.ai
