Sub-processors
The companies Varly engages to process personal data on behalf of its customers, where they process it, and how we tell you about changes.
Version 1.0 — November 6, 2026
On this page
Varly uses the companies below to process personal data on behalf of its customers, as described in section 11 of our Data Processing Agreement. Each one is bound by a contract with the same data protection obligations.
Current sub-processors
| Company | What they do for Varly | Where | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Hosts Varly's application, databases, files and nightly backups. All stored customer data is kept here. | Germany (EU) | Not needed: data stays in the EU |
| Cloudflare, Inc., USA | Delivers the Varly snippet to your website and receives its events, then passes them on to Varly's server in Germany. If that server is briefly unreachable, events wait in a Cloudflare queue for at most 4 days. Also stores off-server copies of Varly's backups, and provides DNS for varly.ai. | Snippet and events: Cloudflare's global network, at the data center closest to each visitor. Backups: European Union jurisdiction. | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.), USA | Sends Varly's emails, such as team invitations, password resets, report review requests, weekly summaries and notifications. Processes the recipient's name and email address and the content of the email. | EU sending region (Ireland) | Standard Contractual Clauses |
Services you choose yourself
Some services only receive data because your team connects them. They process it under your own agreement with them, so they are not Varly's sub-processors.
- Your AI provider. Varly's AI features (Oran) run on an AI key your organization adds, from Anthropic, OpenAI, Google, DeepSeek or Mistral. Oran then sends the research data of the site it works on to the provider of that key, such as page statistics, survey answers and session recordings, with hidden text still hidden. Check where your provider processes data; some process it outside the EU. Varly does not run AI for customers on its own provider accounts. If that changes, the provider is added to the list above first, with notice as described below.
- Google Analytics 4. If you leave Send test data to GA4 on, the Varly snippet tells your own GA4 property which test version a visitor saw. That data follows your GA4 settings.
- Your shop platform, such as Shopify or WooCommerce, or your own system through the order API. It sends orders to Varly.
- Slack or a webhook address that your team adds for notifications. Varly sends the notification text there.
- AI assistants that a team member connects to Varly, such as Claude or ChatGPT. They receive what that person asks for.
Processing inside Varly
These steps happen on Varly's own server in Germany. No other company is involved.
- Speech to text. Voice notes your team speaks into Varly are turned into text with an open-source speech model, and the audio is not kept.
- Screenshots and page snapshots of your website, for heatmaps, reviews and test previews.
- Survey fonts. When a survey uses a font from Varly's list, Varly's edge service fetches it from Google Fonts. Your visitors' browsers never contact Google for this.
How we tell you about changes
At least 30 days before a new or replaced sub-processor starts processing personal data for our customers, we:
- update this page, with the date of the change in the history below;
- email the owners of every Varly organization.
You can object within those 30 days by emailing [Privacy contact email], as described in section 11 of the Data Processing Agreement.
History
| Date | Change |
|---|---|
| November 6, 2026 | First version of this list. |