Sub-processors
Last updated 2026-08-11
Every third party that may handle personal data on our behalf, what they do, and where they are. This page is referenced by the Data Processing Agreement and is the record of what customers have been told.
Always engaged
These operate whenever ValiCrew runs.
| Sub-processor | What it does | Location | Personal data involved |
|---|---|---|---|
| Oracle Cloud Infrastructure | Hosting, database, object storage, backups | Abu Dhabi, UAE | All workspace data |
| Stripe | Subscription payments, invoicing, tax calculation | Outside UAE | Billing contact and payment data. Card details go to Stripe directly and never reach us |
| Microsoft 365 | Platform email — workspace welcome, account recovery, security notices | Outside UAE | Recipient name and email address |
| Cloudflare | Turnstile bot protection on public forms | Outside UAE | IP address and browser signals at the moment of a form submission |
| Lenouar support platform | The in-app widget: suggestions, tickets and screen recordings | Abu Dhabi, UAE | Whatever you submit. A recording may contain workforce data — see Feedback, Suggestions & Recordings |
The support platform is ours, not a third-party feedback service. Nothing you report is passed to an external vendor, and it is hosted in the UAE alongside the rest of your data.
The application, its database and its backups run in Abu Dhabi. Your workforce data does not leave the UAE in the course of normal operation.
Engaged only if you choose to connect them
These do nothing unless you switch them on, and they act on your infrastructure or identity provider rather than ours.
| Service | What it does | When it applies |
|---|---|---|
| Microsoft Graph / SharePoint | Stores your uploaded documents in your own Microsoft 365 tenancy | Only after you connect SharePoint storage |
| Google Drive | Stores your uploaded documents in your own Google account, in a ValiCrew folder | Only after you connect Drive storage |
| Microsoft identity | Sign-in with a Microsoft account | Only for users who choose that sign-in method |
| Google identity | Sign-in with a Google account | Only for users who choose that sign-in method |
A connected storage provider is not really a sub-processor of ours. When SharePoint or Drive is connected, documents go from the platform straight into storage you own and control, under your own agreement with that provider. We hold the metadata and a file reference, not the file. See Customer Data & Storage.
Tenant email
Operational email that goes to your workers — reminders, roster notifications, digests — is sent through your own SMTP server, configured by you in the workspace. We do not send tenant operational mail through our own provider, so your workers' addresses are not disclosed to our email sub-processor. If you have not configured SMTP, that mail is recorded in-app and simply not sent.
Changes
We will update this page and notify workspace administrators by email at least 30 days before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot offer an alternative, the objection procedure in the DPA applies.
Contact
Lenouar Artificial Intelligence Developing Services LLC · Al Muroor, Abu Dhabi, United Arab Emirates · Commercial registration CN-6272765