Subprocessors
Last updated: May 11, 2026
Candor, operated by Highline Beta Inc., uses the third-party service providers listed below ("subprocessors") to deliver the product. Each receives only the data it needs to perform its function.
We commit to providing existing customers at least 30 days’ email notice before adding a new subprocessor that would process their data. Customers under a DPA may object within that window as described in the agreement. Questions: privacy@runcandor.com.
Current subprocessors
| Service | Purpose | Data processed | Location | Legal entity |
|---|---|---|---|---|
| Supabase | Database, authentication, storage | All workspace content, account information, usage logs | United States (AWS us-east-1) | Supabase, Inc. |
| Vercel | Application hosting, serverless compute | Request metadata, IP addresses, app logs | United States (AWS us-east-1) | Vercel Inc. |
| Anthropic | Large-language-model inference (Claude) | Prompts and responses for persona generation and interview simulation | United States | Anthropic, PBC |
| Voyage AI | Embedding generation for uploaded documents | Document chunks submitted for embedding | United States | Voyage AI Innovations, Inc. |
| Tavily | Web search for research evidence retrieval | Industry and region search queries (no personal data) | United States | Tavily AI, Inc. |
| Inngest | Background job orchestration | Job payloads (study IDs, session IDs — minimal metadata) | United States | Inngest, Inc. |
| Resend | Transactional email delivery | Email addresses, subject lines, message bodies | United States | Resend, Inc. |
| OAuth sign-in (optional, when a user chooses Google) | Email address, display name, profile image URL | United States | Google LLC | |
| Apify | Public web search to enrich waitlist email addresses with publicly available professional information | Waitlist email addresses (used as search queries), publicly available search results | United States / European Union | Apify Technologies s.r.o. |
| Gravatar (Automattic) | Public avatar and display-name lookup for waitlist email addresses | MD5 hash of the waitlist email address (sent as the lookup key) | United States | Automattic Inc. |
| Google Analytics | Aggregate visitor analytics on public marketing pages only (not loaded on the authenticated application) | IP address (truncated), user agent, referrer, page-view events, anonymous client identifier | United States | Google LLC |
Infrastructure (Candor-owned)
In addition to the vendors above, Candor processes data internally using its own application code running on Vercel (hosting) and Supabase (database + storage). No additional third-party processor touches customer data outside the list above.
Recent changes
- May 11, 2026 — Added Apify and Gravatar (Automattic) for waitlist email enrichment using publicly available data. Neither processes authenticated-application data.
- May 11, 2026 — Added Google Analytics for aggregate visitor analytics on public marketing pages. Not loaded on the authenticated application.
- April 15, 2026 — Initial publication. Current list: Supabase, Vercel, Anthropic, Voyage AI, Tavily, Inngest, Resend, Google (OAuth only).
For questions about this list or to request our Data Processing Agreement, email privacy@runcandor.com.