Service providers
Who processes personal data for GTJ, and what none of them can see.
This page will be reviewed by a qualified lawyer before registration opens. Last updated .
Current service providers
Global Talent Journey uses 3 service providers that process personal data on the operator’s instructions. None of them can read the contents of your vault: vault files, workspaces and private profiles are encrypted on your device before any provider stores them.
| Provider | What for | Personal data | Where | Transfer safeguard | Agreement status |
|---|---|---|---|---|---|
| Railway Corporation 548 Market St PMB 68956, San Francisco, California 94104, United States Provider’s terms (checked ) | Hosting the community engine: the application servers, the database and the cache that hold accounts, community posts, moderation records, encrypted workspace and profile records, file metadata and server logs | Account data (e-mail address, username, name), community content, moderation and appeal records, professional applications and contact requests, IP addresses and usage logs, encrypted records the operator cannot read | EU West region (Amsterdam, Netherlands). Railway's own volume backups are not used; database backups are kept in Cloudflare R2 storage in the EU jurisdiction | EU–US Data Privacy Framework and its UK Extension (Railway listed as active), with the EU Standard Contractual Clauses and UK Addendum in Railway's DPA as fallback. KVKK standard contract: not signed | Railway's data processing agreement has not been signed yet (it is completed through Railway's signature form) |
| Cloudflare, Inc. 101 Townsend St, San Francisco, CA 94107, United States Provider’s terms (checked ) | Registration of the domain name, DNS, delivery of this website, storage of encrypted vault files, storage of the community engine's database backups and deletion records, and forwarding of e-mail sent to the contact address | IP addresses and request data of website visitors; encrypted vault files the operator cannot read; daily copies of the community engine's database (account data, community content, moderation and professional records, logs with IP addresses, and the encrypted records), and deletion records holding an account number and times; the sender, recipient, subject and content of e-mail sent to the contact address | Encrypted vault files, database backups and deletion records: EU jurisdiction storage. Website delivery, DNS and e-mail forwarding: Cloudflare's global network | EU–US Data Privacy Framework and its UK Extension (Cloudflare listed as active; recertification due 23 September 2026), with the EU Standard Contractual Clauses and UK Addendum in Cloudflare's DPA as fallback. KVKK standard contract: not signed | Cloudflare's data processing addendum (version 6.4) is part of its self-serve agreement; the date GTJ accepted it has not been recorded yet |
| Plus Five Five, Inc. (Resend) 2261 Market Street #5039, San Francisco, CA 94114, United States Provider’s terms (checked ) | Sending account e-mails from the community engine: address confirmation, sign-in links, password resets, notifications and contact requests delivered to a professional | Recipient e-mail address and name, and the content of those e-mails (for a contact request to a professional: the name, e-mail address and message the member chose to share) | Sending region EU (Ireland). Resend's regions page states that all account data, including e-mail metadata, logs and API records, is stored in the United States whatever the sending region, and its agreement states that its primary processing takes place in the United States | EU Standard Contractual Clauses, UK Addendum and the EU–US Data Privacy Framework with its UK Extension, as named in Resend's DPA; Resend's framework listing not yet checked by GTJ. KVKK standard contract: not signed | Resend's data processing addendum takes effect when its terms are accepted; the GTJ sending domain is set up and the engine has sent through it since 13 September 2026, but the date GTJ accepted the terms has not been recorded |
Each provider’s status was read from its own published terms on the date shown in its row. “Not signed” and “not recorded” describe GTJ’s paperwork, which is still being completed before registration opens.
Hosting providers
For Turkish Law No. 5651, the hosting providers of this service are Railway Corporation (the community engine) and Cloudflare, Inc. (this website and file storage). Their names and addresses are in the first column above.
How changes are announced
- A new provider is added to this list before it receives any personal data, and a change is published here with its date.
- Where possible, GTJ publishes a change at least 30 days before it takes effect. The providers themselves give GTJ advance notice of their own sub-processor changes: Railway 10 days and Cloudflare 30 days, so a change announced by Railway may reach this page with less than 30 days to go.
- A change that affects what data is used or why is also announced in the app before it takes effect.
- If you object to a new provider, tell GTJ through the contact form; you can also delete your account at any time.
List last checked: .
More
What each provider processes as part of GTJ’s wider data use, transfer safeguards and your rights: privacy notice, contact.