A sub-processor is any third party we engage to process personal data on behalf of GetMyHotels or our customers. This list covers vendors that handle customer, guest, or partner personal data. Last updated 2026-05-27.
We give 30 days' notice (via in-product banner + email to verified DPA contacts) before adding or replacing a material sub-processor.
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN, WAF, Workers, R2 object storage, Hyperdrive DB pooling | All inbound traffic — IP, headers, request bodies | US + global edge | EU SCCs + EU-US DPF |
| PlanetScale, Inc. | Primary PostgreSQL database | All persistent personal data | US (multi-region) | EU SCCs + EU-US DPF |
| Upstash, Inc. | Redis cache, queues, KV | Cache keys (user id, session id, rate-limit buckets) | US / global edge | EU SCCs |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Stripe, Inc. | Card processing — all regions | Card token, last 4, country, 3DS / SCA artefacts, transaction metadata, chargebacks | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Resend (Resend, Inc.) | Transactional email | Email address, name, message body, unsubscribe token | US (EU region optional) | EU SCCs + EU-US DPF |
| Telnyx, LLC | SMS OTP + booking notifications | E.164 phone number, SMS body, country routing | US (global routing) | EU SCCs |
| Apple Push Notification Service | Push delivery (iOS) | Device token, notification payload | US | EU SCCs + EU-US DPF |
| Firebase Cloud Messaging (Google) | Push delivery (Android) | Device token, notification payload | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Anthropic, PBC | Conversational AI (chat) | Chat prompts, tool args, tool results | US | EU SCCs + EU-US DPF (zero-retention API) |
| OpenAI, LLC | Conversational AI + structured outputs | Chat prompts, transient transcription audio, tool args | US | EU SCCs + EU-US DPF |
| Groq, Inc. | Low-latency model inference | Chat prompts, tool args | US | EU SCCs |
| Baseten Labs, Inc. | Open-weight model hosting (Moonshot, Z.ai, DeepSeek, NVIDIA Nemotron) | Chat prompts, tool args | US | EU SCCs + documented onward-transfer chain |
| Braintrust Data, Inc. | AI evals + observability | Prompt + completion pairs, latency, cost | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| HotelTrader | Hotel inventory + bookings | Guest name, email, phone, stay dates, room counts, special requests | US | EU SCCs + EU-US DPF |
| Xeni | Hotel + flight inventory | Passenger name, contact, itinerary | US | EU SCCs |
| TBO (Travel Boutique Online) | International hotel + flight inventory | Passenger name, DOB, passport, nationality, contact, itinerary | India | EU SCCs + India SCC where notified |
| Uber Technologies, Inc. | Airport / hotel transfers | Pickup + drop-off, rider name, contact phone | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Mapbox, Inc. | Geocoding + maps rendering | Address strings, IP | US | EU SCCs + EU-US DPF |
| Google Places (Google LLC) | Place autocomplete | Place query strings, session id | US | EU SCCs + EU-US DPF |
| Tavily AI, Inc. | Web search for the AI agent | Search query strings | US | EU SCCs |
Want the underlying contracts (DPAs, SCCs, transfer impact assessments)? privacy@getmyhotels.com.
Business customers can request our standard Data Processing Agreement.