Subprocessor Register

1. The commitment

Before any new subprocessor processes Customer Data, this register is updated and customer organization contacts are notified at least 30 days in advance, with an objection right — the mechanics are in DPA §7, including its emergency-replacement exception, which requires materially equivalent protections, notice without undue delay and the same objection right, subject to the SCCs’ and mandatory law’s prior requirements. Every subprocessor is bound by a written contract imposing data-protection obligations at least as protective as the DPA’s for the processing it performs on our behalf, and Pharen remains fully responsible for each one’s performance.

2. Current subprocessors

No other vendor processes Customer Data. Apple and Google receive data as delivery relays only for Apps whose owner has configured delivery credentials, and Amazon Web Services only once a Customer subscribes an address to email notifications — listing them here is what makes the Section 1 promise keepable the moment you do. Any further addition arrives through that process first: register update, 30 days’ notice, objection right — subject to the emergency-replacement procedure in DPA Section 7, which does not override applicable SCC or mandatory-law requirements before processing starts.

Ordinary connection metadata and separate roles. Render and Cloudflare also receive network address, routing, timing, protocol, status and service-performance metadata for requests they handle. Their terms reserve separate roles for some of this processing; listing a provider above does not make every activity processing on our behalf. We recognize separate legally determined roles for limited lawful hosting, delivery, security, abuse prevention, troubleshooting, maintenance and optimization of the contracted infrastructure, or applicable legal obligations. The Privacy Notice links their terms, and DPA Section 7 states the boundary. It does not authorize sale or rental, advertising, model training using Customer Data or End-User personal data, unrelated profiling or personal-health inference; it does not authorize prohibited sharing or turn payloads or health-revealing URL components into ordinary metadata. Processing on Pharen’s behalf remains subject to the DPA’s flow-down restrictions.

3. Providers for account data

Separate from Customer Data, the vendors that process customer account data (the identity, contact and operational data of the people who operate an organization on Pharen or receive our notices about it, and the records of those notices) are described in the Privacy Notice, which names each of them. We process that data as controller, and it is not Customer Data. An address you also subscribe to email notifications about your Apps is, in that subscription, Customer Data, processed as Section 2 describes.

Why Google’s Workspace is in Section 2. It holds our email. The instructions and support requests you send us, and the security reports anyone sends us, arrive there and can carry your End Users’ identifiers, so Section 2 lists it for that correspondence; the rest of our email is our own, described in the Privacy Notice.

Data sources are not subprocessors. Where you connect your own app-store credential, the Service retrieves data from Apple at your instruction — your reviews, sales, and performance data, plus public listing information. In that flow Apple processes data as Apple, under your agreement with it; the Service uses your credential to request that data. Apple appears in Section 2 only for the delivery-relay role.

4. Changes & notifications

This page shows the current list. We retain dated prior lists and the related notices so the list and notice applicable to a processing period can be identified. To receive change notices by email in addition to the DPA’s organization-contact notice, email hello@pharen.ai with the subject “Subscribe: subprocessor notices.”