A sub-processor is any third party we engage to process personal data on behalf of GetMyHotels or our customers. This list covers vendors that handle customer, guest, or partner personal data. Last updated 2026-09-30.
We give 30 days' notice (via in-product banner + email to verified DPA contacts) before adding or replacing a material sub-processor.
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Vercel Inc. | Web app hosting: server rendering, AI chat streaming, same-origin proxy to our API | All web traffic — IP address, headers, cookies, request bodies | US (Washington, D.C. region) + global edge | EU SCCs + EU-US DPF |
| Cloudflare, Inc. | API hosting (Workers, Durable Objects), CDN, WAF, R2 object storage, KV cache, Hyperdrive DB pooling, Browser Rendering | All API traffic — IP, headers, request bodies; stored chat state, uploaded media, cached data | US + global edge | EU SCCs + EU-US DPF |
| PlanetScale, Inc. | Primary PostgreSQL database | All persistent personal data | US (multi-region) | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error reporting for the web app and API | Exception type, stack frames (file, function, line), release and environment. Error messages, request data, cookies, headers and user identifiers are stripped before sending | US | EU SCCs + EU-US DPF |
| Google LLC (Google Analytics) | Website analytics (Google Analytics, loaded through Google Tag Manager): which pages and features are used. In the EEA, UK, Canada and Brazil it runs only after you accept analytics cookies; elsewhere it runs by default and can be turned off in cookie settings; never when Global Privacy Control or Do Not Track is on | Page views, page path with IDs removed, events (search, checkout steps), approximate location, device and browser type, and a pseudonymous identifier from the _ga cookie. No ad networks and no sale of data | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Google LLC (Sign in with Google) | Sign in with Google (web and iOS/Android) | Authorization code or ID token, email address, name, profile picture, Google account ID | US (global) | EU SCCs + EU-US DPF |
| Apple Inc. (Sign in with Apple) | Sign in with Apple (web and iOS) | Authorization code or ID token, email address (or Apple private relay address), name on first sign-in, Apple account ID | US (global) | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Stripe, Inc. | Card and wallet processing | Card token, last 4, country, 3DS / SCA artefacts, transaction metadata, chargebacks | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Resend (Resend, Inc.) | Transactional email | Email address, name, message body, unsubscribe token | US (EU region optional) | EU SCCs + EU-US DPF |
| Telnyx, LLC | SMS OTP + booking notifications | E.164 phone number, SMS body, country routing | US (global routing) | EU SCCs |
| Apple Push Notification Service | Push delivery (iOS) | Device token, notification payload | US | EU SCCs + EU-US DPF |
| Firebase Cloud Messaging (Google) | Push delivery (Android) | Device token, notification payload | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Anthropic, PBC | Conversational AI (chat) | Chat prompts, tool args, tool results | US | EU SCCs + EU-US DPF (zero-retention API) |
| OpenAI, LLC | Conversational AI, structured outputs and Whisper voice transcription | Chat prompts, transient transcription audio, tool args | US | EU SCCs + EU-US DPF |
| Baseten Labs, Inc. | Open-weight model hosting (Moonshot, Z.ai, DeepSeek, NVIDIA Nemotron) | Chat prompts, tool args | US | EU SCCs + documented onward-transfer chain |
| TypeSafe AI | Intent and destination classification for the chat composer suggestion bar | Text typed in the chat composer before you send it, plus candidate place names | Not published by the vendor; covered by EU and UK SCCs | EU SCCs |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| HotelTrader | Hotel inventory + bookings | Guest name, email, phone, stay dates, room counts, special requests | US | EU SCCs + EU-US DPF |
| TBO (Travel Boutique Online) | International hotel + flight inventory | Passenger name, DOB, passport, nationality, contact, itinerary | India | EU SCCs + India SCC where notified |
| Uber Technologies, Inc. | Airport / hotel transfers | Pickup + drop-off, rider name, contact phone | US | EU SCCs + EU-US DPF |
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Komoot GmbH | Geocoding + address autocomplete | Address and place query strings, IP | EU (Germany) | EU SCCs |
| Google Places (Google LLC) | Place autocomplete | Place query strings, session id | US | EU SCCs + EU-US DPF |
| Tavily AI, Inc. | Web search for the AI agent | Search query strings | US | EU SCCs |
Want the underlying contracts (DPAs, SCCs, transfer impact assessments)? privacy@getmyhotels.com.
Business customers can request our standard Data Processing Agreement.