Draft for counsel review. Do not treat this as an in-force legal document.
Legal
Data Processing Addendum
Version 0.1.0-draftLast updated 16 September 2026
This draft DPA is intended for employer or other business customers that instruct WorkGraph to process candidate personal data. Jobseeker accounts are described in the Privacy Policy (WorkGraph as controller). Counsel must complete roles, annexes, and signatures before this document is offered.
Roles
Customer is the controller of candidate data it submits (for example hiring-signal applications). WorkGraph is the processor and will process that data only on documented instructions, including this DPA and in-product settings. Each party remains controller of its own employee and billing data.
Categories of personal data and purposes
Customer may submit account, resume, and application-activity data about candidates. Device/analytics data about users of the employer workspace is processed to provide and secure the service. The mapping below is the same category model used in the Privacy Policy.
| Category | Examples | Purpose | Lawful basis (customer) | Retention |
|---|---|---|---|---|
| Account | Name, email, password hash (via auth provider), account identifiers | Create and secure your account, communicate with you, provide the service | Determined by the customer as controller; typically recruitment (contract or legitimate interests) | Until you delete the account, then up to 30 days in backups |
| Resume content | Uploaded files, parsed text, skills, experience, education, portfolio links | Profile, ATS scoring, job matching, cover letters, Talent Intelligence | Determined by the customer as controller; typically recruitment (contract or legitimate interests) | Until you delete the resume/profile or the account; backups up to 30 days |
| Application activity | Saved jobs, tracker stages, Interview Vault purchases, employer connection notes | Provide tracker, marketplace, and hiring-signal features you use | Determined by the customer as controller; typically recruitment (contract or legitimate interests) | Until you delete the records or the account; backups up to 30 days |
| Device / analytics | Cookie consent choice, coarse device/browser data, security logs | Operate the site, remember consent, detect abuse, measure reliability | Determined by the customer as controller; typically recruitment (contract or legitimate interests) | Consent choice stored locally until you clear it; security logs typically 90 days |
Named subprocessors
Customer authorizes the subprocessors listed here. We will post material changes on this page and, once this DPA is in force, provide the notice period counsel specifies.
| Provider | Function | Hosting region |
|---|---|---|
| Supabase | Authentication, PostgreSQL database, and object storage for resumes and profile files | United States (AWS) |
| Vercel | Application hosting, edge network, and preview deployments | United States / global edge |
| Stripe | Payment processing for Interview Vault purchases when payments are enabled | United States |
| Resend | Transactional email (account, employer connection, and product notices) | United States |
| Groq | Large-language-model inference for resume parse, ATS scoring, and matching assistance | United States |
| Adzuna | Jobs-API vendor used to ingest public job listings. We do not send resume files or account emails to Adzuna. | United Kingdom / European Union (API); listing data cached in our US database |
| Public job sources (USAJobs, RemoteOK, Arbeitnow, Jobicy, Reddit, GitHub, Hacker News, and similar listing APIs) | Ingest of publicly posted job listings. We do not send resume files or account emails to these vendors. | Various (public internet) |
International transfers
Processing occurs primarily in the United States. Draft transfer tool: Standard Contractual Clauses module for processor-to-processor and controller-to-processor relationships, plus supplementary security measures (encryption in transit, access control, logging). Final module selection is for counsel.
Security and assistance with data subject rights
We apply access control, TLS in transit, and row-level security on tenant data in Postgres where implemented. We will assist the customer with data subject requests that concern processor-held candidate data, by in-product tools or by email to privacy@getworkgraph.com, within the time needed for the customer to meet its statutory deadline.
Retention and deletion
On termination of the employer workspace, or on written instruction, we will delete or return candidate data in our production systems within 30 days, except data we must keep for legal claims or backups that rotate out on the backup schedule (typically 30 days). Categories follow the retention column in the table above.
EU Article 27 representative
WorkGraph has not appointed an EU Article 27 representative as of this draft. If appointment is required for the processing described here, the representative's identity and contact details will be added to this section and the Privacy Policy before the DPA is offered for signature.