Kuntum & Embun uses the following third-party services to deliver the Service. Each one processes only the data necessary for its purpose, under a data-processing agreement consistent with PDPA Malaysia §39 cross-border transfer rules.
We update this list whenever we add or remove a sub-processor. If you have specific concerns about a sub-processor, contact us before creating an account.
Supabase
Singapore (ap-southeast-1) / configured per project
Purpose
Database hosting, authentication, file storage
Data shared
- Account email + password hash
- Encrypted candidate profile
- Encrypted resume PDFs
- Audit log entries
Vercel
Global edge network — Singapore + global routing
Purpose
Application hosting and edge functions
Data shared
- HTTP request metadata
- IP addresses (transient, not stored long-term)
Azure OpenAI Service
Selected Azure region
Purpose
AI matching, profile parsing, scoring
Data shared
- Resume text (extracted from uploaded PDF)
- Profile fields (skills, work preferences) for scoring
- Job posting descriptions
Twilio
United States
Purpose
WhatsApp transactional messaging gateway
Data shared
- WhatsApp phone number (E.164 format)
- Message body content
Resend
United States
Purpose
Transactional email (account notifications, deletion alerts)
Data shared
- Recipient email address
- Email subject and body content
Apify Limited
Czech Republic / European Union
Purpose
Optional LinkedIn profile data enrichment during onboarding (opt-in only — used only when a candidate explicitly chooses "Import from LinkedIn")
Data shared
- LinkedIn profile URL (provided by the candidate)
- Publicly-available LinkedIn profile fields returned by the scraper (name, headline, work history, education, skills)
Adding new sub-processors
When we onboard a new sub-processor, we update this page and bump the "Last updated" date on our privacy policy. Material changes are announced by email.