Core infrastructure
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Cloudflare, Inc. | CDN, WAF, Workers, R2 object storage, Hyperdrive DB pooling | All inbound traffic — IP, headers, request bodies | US + global edge | EU SCCs + EU-US DPF |
| PlanetScale, Inc. | Primary PostgreSQL database | All persistent personal data | US (multi-region) | EU SCCs + EU-US DPF |
| Upstash, Inc. | Redis cache, queues, KV | Cache keys (user id, session id, rate-limit buckets) | US / global edge | EU SCCs |
Payments
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Stripe, Inc. | Card processing — all regions | Card token, last 4, country, 3DS / SCA artefacts, transaction metadata, chargebacks | US | EU SCCs + EU-US DPF |
Email & messaging
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Resend (Resend, Inc.) | Transactional email | Email address, name, message body, unsubscribe token | US (EU region optional) | EU SCCs + EU-US DPF |
| Telnyx, LLC | SMS OTP + booking notifications | E.164 phone number, SMS body, country routing | US (global routing) | EU SCCs |
| Apple Push Notification Service | Push delivery (iOS) | Device token, notification payload | US | EU SCCs + EU-US DPF |
| Firebase Cloud Messaging (Google) | Push delivery (Android) | Device token, notification payload | US | EU SCCs + EU-US DPF |
AI providers
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Anthropic, PBC | Conversational AI (chat) | Chat prompts, tool args, tool results | US | EU SCCs + EU-US DPF (zero-retention API) |
| OpenAI, LLC | Conversational AI + structured outputs | Chat prompts, transient transcription audio, tool args | US | EU SCCs + EU-US DPF |
| Groq, Inc. | Low-latency model inference | Chat prompts, tool args | US | EU SCCs |
| Baseten Labs, Inc. | Open-weight model hosting (Moonshot, Z.ai, DeepSeek, NVIDIA Nemotron) | Chat prompts, tool args | US | EU SCCs + documented onward-transfer chain |
| Braintrust Data, Inc. | AI evals + observability | Prompt + completion pairs, latency, cost | US | EU SCCs + EU-US DPF |
Travel suppliers
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| HotelTrader | Hotel inventory + bookings | Guest name, email, phone, stay dates, room counts, special requests | US | EU SCCs + EU-US DPF |
| Xeni | Hotel + flight inventory | Passenger name, contact, itinerary | US | EU SCCs |
| TBO (Travel Boutique Online) | International hotel + flight inventory | Passenger name, DOB, passport, nationality, contact, itinerary | India | EU SCCs + India SCC where notified |
| Uber Technologies, Inc. | Airport / hotel transfers | Pickup + drop-off, rider name, contact phone | US | EU SCCs + EU-US DPF |
Geo / mapping / search
| Vendor | Purpose | Data shared | Location | Transfer |
|---|---|---|---|---|
| Mapbox, Inc. | Geocoding + maps rendering | Address strings, IP | US | EU SCCs + EU-US DPF |
| Google Places (Google LLC) | Place autocomplete | Place query strings, session id | US | EU SCCs + EU-US DPF |
| Tavily AI, Inc. | Web search for the AI agent | Search query strings | US | EU SCCs |
Questions?
Want the underlying contracts (DPAs, SCCs, transfer impact assessments)? privacy@getmyhotels.com.
Business customers can request our standard Data Processing Agreement.
