Privacy Policy

Scope and roles

This policy applies to Varajen websites and platform services. Varajen LLC ("Varajen") is the controller for marketing-site and account administration data. For workforce, candidate, vendor, payroll, and customer-configured platform data, the customer generally acts as controller and Varajen LLC acts as processor under the customer agreement and DPA.

Information we process

Depending on the services used, Varajen processes business contact and account details, tenant and role identifiers, authentication and security events, recruiting and applicant records, resumes, employee and vendor records, time and attendance data, payroll-operational data, support communications, billing records, device and usage information, and customer-provided configurations.

Purposes and legal bases

We process data to deliver contracted services, authenticate users, enforce tenant and role boundaries, execute requested workflows, provide support, secure and monitor the service, bill customers, comply with law, and communicate about the service. Where applicable, processing relies on contract performance, legitimate interests, legal obligations, consent, or the customer controller's documented instructions.

Google user data accessed

When an authorized user connects Google Workspace, Varajen may access the Google account identity selected by the user; Gmail messages, metadata, labels, and mailbox history; Google Calendar events and free/busy information; Google Drive file metadata and user-selected file content; and Google Contacts data. Access is limited to the scopes approved by the user and enabled by the tenant administrator.

How Google user data is used

Google user data is used only to provide or improve the user-facing Google Workspace features requested by the user or tenant, including displaying and synchronizing mail, sending messages, managing message state, scheduling interviews and meetings, showing availability, and locating authorized Drive files and contacts.

• Varajen does not sell Google user data.
• Varajen does not use Google user data for advertising or advertising profiles.
• Varajen does not use Google user data to train general-purpose AI or machine-learning models.
• Varajen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Sharing and subprocessors

Data is disclosed only to authorized tenant users, Varajen personnel with a business need, and contracted subprocessors that provide hosting, storage, communications, security, monitoring, support, and payment services. We require appropriate confidentiality and data-protection obligations. We may disclose data when legally required or necessary to protect users and the service. We do not disclose Google user data to data brokers or unrelated third parties.

Tenant isolation and security

Varajen binds records to the authenticated tenant and user, applies role-based and least-privilege access, encrypts transport, protects delegated credentials in restricted secret storage, maintains audit records, and uses tenant-scoped authorization controls. No security program eliminates all risk; customers must protect credentials, configure roles correctly, and notify Varajen of suspected compromise.

Google data retention and deletion

Synchronized Gmail content is retained for no more than 90 days. When a user disconnects Google Workspace, Varajen revokes the token, removes the connection, mailbox binding, synchronization state, and synchronized message copies, and schedules the encrypted OAuth secret for permanent deletion after a seven-day recovery window. Limited audit events may remain under contractual or legal retention requirements, but do not contain Gmail bodies or OAuth tokens.

Other retention

Customer data is retained for the service term and the deletion or return period in the applicable agreement or DPA, unless law requires longer retention. Marketing and support records are retained only as reasonably necessary for the disclosed purpose, security, dispute resolution, and legal obligations. Backups are removed through controlled rotation and are not restored for ordinary business use after a valid deletion request.

Self-avatar data and express consent

If Varajen makes self-avatar enrollment available, an adult user may choose to provide photographs, video, audio, voice recordings, and related instructions to create a personalized digital avatar. This media may contain face geometry, voice characteristics, movements, or other identifiers that may be treated as biometric or sensitive personal data under applicable law. Before collection or generation begins, Varajen will present a separate notice and obtain the user's express consent. Self-avatar enrollment is optional and is not required to use Varajen's core workforce services.

• Varajen will not use self-avatar data to identify or authenticate a person unless a separate notice and legally valid consent expressly authorize that use.
• Varajen will not sell self-avatar data or use it for advertising.
• A user may withdraw consent and request deletion by contacting privacy@varajen.com.

Runway processing for self-avatar generation

Varajen may transmit user-provided reference images, video, audio, prompts, and related generation inputs to Runway AI, Inc. ("Runway") as a service provider to generate or animate self-avatar content, including facial movement and lip synchronization. Runway processes that content under its applicable contractual and privacy terms. Varajen will disclose this transfer in the enrollment consent flow before any self-avatar media is submitted. Users should not upload another person's likeness or voice without that person's authorization.

Self-avatar retention and deletion

Varajen retains self-avatar source media and generated outputs only while needed to provide the requested feature or until consent is withdrawn. Following a verified deletion request, withdrawal of consent, or deletion of the self-avatar, Varajen will delete or de-identify the associated self-avatar source media and generated assets from active Varajen systems and direct applicable processors to delete them within 30 days, unless retention is required by law. Residual encrypted backup copies may remain until routine backup rotation is completed and will not be restored for ordinary use.

Adult-only self-avatar enrollment

Self-avatar enrollment is available only to individuals who are at least 18 years old and have reached the age of majority in their jurisdiction. Varajen does not knowingly collect a minor's face, voice, or other biometric or sensitive data for self-avatar generation. If Varajen learns that such data was submitted by or for a minor, Varajen will disable the avatar and delete the data.

International transfers

Varajen and its subprocessors may process data in countries other than the user's location. Where required, transfers are protected through contractual safeguards, recognized transfer mechanisms, and supplementary security measures described in the applicable DPA.

Choices and rights

Users may disconnect Google Workspace within Varajen or revoke access through Google Account permissions. Depending on applicable law, individuals may request access, correction, deletion, restriction, portability, or objection. Workforce and candidate requests should ordinarily be directed to the relevant customer controller; Varajen will assist that customer as required by contract and law.

Children and automated decisions

Varajen is a business service and is not directed to children. Customers must not submit children's data unless lawful and contractually authorized. AI-assisted features support authorized users; customers remain responsible for consequential employment, payroll, and workforce decisions and must provide any legally required human review.

Contact and complaints

Privacy questions and deletion requests may be sent to privacy@varajen.com or submitted through the Varajen contact form. Include the relevant tenant and account email, but do not send passwords, OAuth tokens, government identifiers, bank details, or sensitive records by email. Individuals may also complain to an applicable data-protection authority.