Varren - Sub-processors

Alpha Innovation Technologies - F.Z.C, a free zone company registered in Ajman Free Zone, United Arab Emirates, trading as AlphaIT Engineering. Effective date: 22 September 2026 Version: 1.2 Applies to: varren.co, the Varren application, the Varren API, and every associated Varren service (together, the "Service").

Published at https://varren.co/subprocessors. This page is referenced by Section 6 of the Privacy Policy and by section 7 and Annex 3 of the Data Processing Addendum. This page is Annex 3 to that Addendum and Annex III of the Standard Contractual Clauses. The Addendum carries no separate list; this page is the single controlling list.

A sub-processor is an entity engaged by Alpha Innovation Technologies - F.Z.C to process personal data on its instructions in the course of providing the Service, under Article 28 of the GDPR and the equivalent provisions of the other Data Protection Laws that apply. Each sub-processor is bound by written terms no less protective than those Alpha Innovation Technologies - F.Z.C owes its customers, and Alpha Innovation Technologies - F.Z.C remains fully liable for each sub-processor's performance as for its own.

Varren is operated from the United Arab Emirates. For transfers of personal data from the European Economic Area, the United Kingdom or Switzerland, Alpha Innovation Technologies - F.Z.C relies on the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914, with the UK International Data Transfer Addendum and the Swiss amendments where applicable, and on the supplementary measures and transfer impact assessment described in Section 7 of the Privacy Policy and section 8 of the Data Processing Addendum.

1. Infrastructure

2. AI model providers

Routing is provider-agnostic. The routing layer selects a model for each request from the categories below. Any provider listed may receive a given prompt.

For every provider in this section, Alpha Innovation Technologies - F.Z.C routes only through paid commercial or enterprise API tiers, disables every optional data-sharing setting, and requires that the terms of the tier used prohibit training a general-purpose or foundation model on customer content. Where a provider's terms cease to meet that requirement, Alpha Innovation Technologies - F.Z.C removes that provider from the routing configuration. Routing is a single service-wide configuration; a customer may require any provider to be removed for all customers by writing to [email protected].

3. Feature-triggered

These entities receive data only when the associated feature is used.

4. Connected platforms are not sub-processors

LinkedIn, X, Meta (Facebook, Instagram, WhatsApp), TikTok, Google (Gmail send, YouTube upload), Reddit, Telegram and Discord receive content when Varren posts, sends or reads on an account the customer connected, under a mandate the customer granted and can withdraw. They receive that content at the customer's direction and on the customer's own account. They are recipients rather than sub-processors, and each platform's own terms govern its subsequent processing. Varren reaches them through the connector or browser infrastructure named in section 3, or directly with credentials the customer provides.

5. Not sub-processors

• The source code host and package registry serve Varren's own code and build its container image, and receive no customer data.
• A mail server the customer connects by IMAP or SMTP is the customer's own system.
• Public web pages Varren reads during research receive the URL request and Varren's user agent, and no customer identifiers.

6. Change notices and the right to object

To receive change notices, email [email protected] with the subject line "subprocessor notices" and the address for delivery. Every customer holding a Data Processing Addendum is notified whether or not it subscribes.

Before adding or replacing a sub-processor, Alpha Innovation Technologies - F.Z.C publishes the change on this page and notifies every subscriber and every customer holding a Data Processing Addendum at least thirty (30) days before it takes effect. That is the notice period specified for clause 9(a) of the Standard Contractual Clauses. Within those thirty days a customer may object in writing to [email protected] on reasonable data protection grounds, and Alpha Innovation Technologies - F.Z.C will work with the customer on an alternative. Because routing is one service-wide configuration, the alternative for an AI model provider is removal from the routing configuration for all customers rather than exclusion for a single workspace. If no alternative exists, the customer may terminate the affected part of the Service and receive a refund of the unused portion of prepaid fees for it. A sub-processor may be added on shorter notice only where urgently required to keep the Service secure or operational, in which case Alpha Innovation Technologies - F.Z.C notifies customers as soon as it does so.

This page is the general written authorisation required by Article 28(2) of the GDPR, exercised under section 7 of the Data Processing Addendum.

7. Version history

Prior versions of this page are available from the company on request to [email protected].

Questions and contract or countersignature requests: [email protected].