Annex 1. Data Processing Agreement · Schedule 3. Sub-processors
Sub-processors
Part B. Sub-processors engaged
Version 1. Date of this version: 14 October 2026.
The sub-processors engaged at the date of this version, under Article 7.1. A sub-processor's own sub-processor, where stayi relies on it for the Services, is shown with "→" directly under the sub-processor that engages it.
| Sub-processor | Address | Processing | Location of processing | Transfer mechanism (Article 8) |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL | 38 Avenue John F. Kennedy, L-1855 Luxembourg | Hosting of the Services: application servers, databases, storage, logs and backups | European Economic Area: AWS region eu-central-1 (Frankfurt, Germany) | None required for processing in the European Economic Area. For any transfer outside it: standard contractual clauses (Commission Implementing Decision (EU) 2021/914), as stated in the AWS data processing addendum; Amazon Web Services, Inc., a party to that addendum, is covered by Amazon.com, Inc.'s certification under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) |
| Cloudflare, Inc. | 101 Townsend St., San Francisco, CA 94107, USA | Hosting and delivery of the web applications of the Services, DNS, the media relay (TURN) for voice sessions, secure network tunnels, and backup storage (R2) | Cloudflare's global network, including the R2 backup storage; the transfer mechanism in the next column covers any processing outside the European Economic Area | EU-US Data Privacy Framework (adequacy decision of 10 July 2023); standard contractual clauses (Commission Implementing Decision (EU) 2021/914) if Cloudflare's certification lapses, as stated in Cloudflare's data processing addendum |
| Clerk, Inc. | 660 King Street Unit 345, San Francisco, CA 94107, USA | Authentication, accounts and sessions of Authorised Users and room accounts, including IP address and device data | United States and wherever Clerk or its sub-processors maintain facilities; Clerk hosts personal data primarily in Google Cloud data centers and on Cloudflare, as stated in Clerk's data processing addendum | EU-US Data Privacy Framework (adequacy decision of 10 July 2023); otherwise standard contractual clauses (Commission Implementing Decision (EU) 2021/914), as stated in Clerk's data processing addendum |
| OpenAI Ireland Ltd | 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland | Real-time voice conversations of the AI concierge (Guest audio and transcripts) and speech synthesis | Not limited to the European Economic Area: stayi uses OpenAI's global API endpoint (api.openai.com), not OpenAI's European data residency endpoint (eu.api.openai.com), and OpenAI Ireland Ltd may transfer the data to OpenAI affiliates or third parties outside the EEA, as stated in OpenAI's data processing addendum | None required between stayi and OpenAI Ireland Ltd (European Economic Area). For OpenAI Ireland Ltd's onward transfers outside the EEA: standard contractual clauses (Commission Implementing Decision (EU) 2021/914) or an adequacy decision, as stated in OpenAI's data processing addendum |
| OpenRouter, Inc. | 169 Madison Ave #2404, New York, NY 10016, USA | Routing of the AI concierge's text requests to the model providers listed below: Guest chat, translation, suggested replies, reports, revenue scoring and web search. Zero data retention is set on stayi's account | United States (Google Cloud Platform, US regions, as stated in OpenRouter's data processing agreement); stayi uses OpenRouter's global API (openrouter.ai/api/v1), not its EU endpoint | Standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), incorporated in OpenRouter's data processing agreement |
| → Anthropic (Claude models). With OpenRouter's zero data retention routing, the Claude models run on Amazon Bedrock, operated by Amazon Web Services, Inc., and on Google Cloud Vertex AI, operated by Google LLC (see → Google LLC), not on Anthropic's own API | Amazon Web Services, Inc.: 410 Terry Avenue North, Seattle, WA 98109-5210, USA; Google LLC: as in the → Google LLC row | Language model processing of those requests | With OpenRouter's zero data retention routing: Amazon Bedrock, at its global endpoint or in the AWS regions us-east-1 (United States) and eu-west-1 (Ireland), or with no region stated by OpenRouter, as selected by OpenRouter; Google Cloud Vertex AI global, United States or Europe endpoints (see → Google LLC) | Amazon Web Services, Inc. is covered by Amazon.com, Inc.'s certification under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023); on Amazon Bedrock, model providers, including Anthropic, have no access to prompts and completions, as stated in AWS's Amazon Bedrock documentation. For Google LLC, see → Google LLC. Anthropic is not on the Data Privacy Framework List |
| → OpenAI (OpenAI models). With OpenRouter's zero data retention routing, stayi's OpenAI models run only on Microsoft Azure, operated by Microsoft Corporation, not on OpenAI's own API | Microsoft Corporation: One Microsoft Way, Redmond, WA 98052, USA | Language model processing of those requests | With OpenRouter's zero data retention routing: Microsoft Azure, in the United States or the European Union (including Azure Sweden Central), or at endpoints for which OpenRouter states no region, as selected by OpenRouter; for Azure global deployments, prompts and responses may be processed in any geography where the model is deployed, as stated in Microsoft's documentation | Microsoft Corporation is an active participant in the EU-US Data Privacy Framework (adequacy decision of 10 July 2023); on Microsoft Azure, prompts and completions are not available to OpenAI, as stated in Microsoft's documentation. No OpenAI entity is on the Data Privacy Framework List |
| → Google LLC | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | Language model processing of those requests | With OpenRouter's zero data retention routing: Google Cloud Vertex AI global endpoint (no fixed region) for Gemini; global, United States or Europe endpoints for Claude models routed to Vertex, as selected by OpenRouter | Google LLC is an active participant in the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) |
| → Groq LLC | P.O. Box 1778, Mountain View, CA 94042, USA | Language model processing of those requests | United States and other jurisdictions where Groq maintains processing operations, as stated in Groq's privacy policy | Standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor) where Groq's customer is a controller and Module 3 (processor to processor) where it is a processor, as OpenRouter is, as stated in Groq's data processing addendum, which forms part of Groq's services agreement; Groq LLC is not on the Data Privacy Framework List |
| → Exa Labs Inc. | 430 Shotwell Street, San Francisco, CA 94110, USA | Web search for the AI concierge's answers; OpenRouter's zero data retention does not cover this web search | Not stated by Exa: its privacy policy and data processing addendum name no location of processing, and its list of subcontractors is available only on request in Exa's trust center; Exa Labs Inc. is established in the United States | Standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), incorporated in Exa's data processing addendum, which treats Exa's business customer as controller; Exa signs Module 3 (processor to processor) with its own subcontractors. Exa Labs Inc. is not on the Data Privacy Framework List |
| Eleven Labs Inc. | 169 Madison Ave #2484, New York, NY 10016, USA | Voice agent of the AI concierge on Devices (Guest audio and transcripts) and speech synthesis | United States, European Union or Singapore, as stated in ElevenLabs' sub-processor list for customers not on an Enterprise plan (stayi uses the global endpoint api.elevenlabs.io, not ElevenLabs' EU data residency) | EU-US Data Privacy Framework (adequacy decision of 10 July 2023), and standard contractual clauses (Commission Implementing Decision (EU) 2021/914, processor-to-processor module), as provided in ElevenLabs' data processing addendum |
| → Google Cloud Platform (Vertex AI), as named in ElevenLabs' sub-processor list, which names no Google legal entity | Not stated by ElevenLabs | Language model (Gemini) inside the ElevenLabs voice agent | United States, European Union or Singapore, for latency and service performance, as stated in ElevenLabs' sub-processor list for customers not on an Enterprise plan | ElevenLabs' onward transfers to its sub-processors: an adequacy decision, including the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), or standard contractual clauses (Commission Implementing Decision (EU) 2021/914), as provided in Section 11 of ElevenLabs' data processing addendum |
| Voice Logica I.K.E. | Katsantoni & Olympias 2, 144 52 Metamorfosi, Athens, Greece (G.E.MI. 183940301000) | Telephone calls conducted by artificial intelligence to the Customer's partners and Local Providers for Guests: the call details (hotel name, room number, the request, offer, date, time and party size, for transfers the pickup point and destination, session language, callback number) and the callee's telephone number; recording of the call, with the recording, transcript and analysis kept for up to thirty (30) days; the last call's details kept on the callee's contact record | European Union: Hetzner dedicated servers in Nuremberg (Germany) and in Finland; call recordings, transcriptions and attachments in AWS region eu-north-1 (Stockholm, Sweden), as stated in Voice Logica's compliance page | An adequacy decision or, failing one, appropriate safeguards such as the European Commission's standard contractual clauses, for any transfer outside the European Economic Area, as stated in Voice Logica's data processing agreement, which forms an integral part of its terms of service. Voice Logica's own sub-processors that serve stayi's calls, as listed in its sub-processor register (legal.voicelogica.ai/compliance), which forms part of Annex IV of that agreement: Hetzner Online GmbH (servers; Germany and Finland, EEA); Amazon Web Services EMEA SARL (storage of recordings and transcriptions; eu-north-1, Stockholm, EEA; AWS's standard contractual clauses for any access from outside the EEA); OpenAI Ireland Ltd (language model of the call and its analysis; processing may occur in the United States; standard contractual clauses in OpenAI's data processing addendum); Soniox Inc. (speech-to-text; EU data residency); ElevenLabs Inc. (speech synthesis; EU data residency); and, as fallbacks, Google Ireland Ltd (speech-to-text; Google Cloud EU regions) and Microsoft Ireland Operations Ltd (speech synthesis; Azure EU regions), each under its own data processing addendum. Voice Logica's core-providers mode is off for stayi's agent, so Groq Inc. (United States) also handles auxiliary in-call processing, and Google's Gemini API (Google global infrastructure) is Voice Logica's default for image analysis, under the Data Privacy Framework or standard contractual clauses as stated by Voice Logica. The calls are carried by modulus S.A.'s SIP trunk, not by Voice Logica's telephony provider Yuboto. |
| modulus S.A. | Leoforos Mesogeion 311, 152 31 Chalandri, Athens, Greece | Telephony: the SIP trunk and telephone number that carry the calls placed through Voice Logica | European Economic Area (servers in the EEA, as stated in modulus's privacy policy) | None required for processing in the European Economic Area. |
| Mailgun Technologies, Inc. (Sinch group) | One North Wacker Drive, Suite 2500, Chicago, IL 60606, USA | Email delivery: Guest requests to the Customer's staff; booking requests and reminders to Local Providers; booking-outcome emails to Guests, at the address they enter | European Economic Area (Mailgun EU region): Germany and Belgium, as stated in the sub-processor list of Sinch's data processing agreement | For any access from outside the EEA: EU-US Data Privacy Framework and standard contractual clauses, as stated in Mailgun's privacy policy |
| Yuboto Limited | Katsantoni & Olympias 2, 144 52 Metamorfosi, Attica, Greece (G.E.MI. 7334701000) | Messaging by Viber, with SMS fallback: Guest requests to the Customer's staff; booking requests to Local Providers | Not stated by Yuboto; its privacy policy, its Octapush terms and its information-security page name only its seat in Metamorfosi, Attica, Greece | Yuboto states no transfer mechanism for its own processing; none is required if that processing is in the European Economic Area. Yuboto publishes no list of its sub-processors; its privacy policy states that its subcontractors and the providers it is interconnected with to serve the traffic are bound to comply with the GDPR as processors. Viber messages are delivered through Viber Media S.à r.l., 2, rue du Fossé, L-1536 Luxembourg (European Economic Area), which stores data on servers in the United States and operates communications servers globally, and transfers personal data outside the EEA under the Rakuten Group Binding Corporate Rules (within its group) and standard contractual clauses (with its service providers), as stated in Viber's EU Region Privacy Notice. SMS fallback is delivered through the mobile networks with which Yuboto is interconnected. |
| Fully Factory GmbH | Von-Witzleben-Str. 12, 41540 Dormagen, Germany (Commercial Register Neuss HRB 19436) | Management of Devices: device data, and remote commands to Devices, including a single-use sign-in ticket valid for five minutes | Germany (EU): Fully Cloud is hosted at Hetzner Online, as stated in Fully Kiosk's privacy notes | None required for processing in the European Economic Area. |
| InfluxData Inc. | 548 Market St, PMB 77953, San Francisco, CA 94104, USA | Metrics on the use of the Services, including Guest request text | European Economic Area: AWS region eu-central-1 (Frankfurt, Germany), InfluxDB Cloud | None required for processing in the European Economic Area. For any transfer outside it: standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 3 (processor to processor), incorporated in InfluxData's data processing addendum; InfluxData Inc. also holds a certification under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) |
| Anam.AI Ltd (only where the Customer enables the AI avatar) | Fora, White Collar Factory, Old Street Yard, London EC1Y 8AF, United Kingdom (company number 15214363) | AI avatar: session tokens, and the assistant's reply audio or reply text; never the Guest's audio | Spain (EU) or United States (US East), hosted on CoreWeave, as stated in Anam's privacy policy and sub-processor list. The region is assigned to each session: Anam selects it from the request location and its current routing policy, and capacity and failover can change it. Choosing a region is available only on Anam's Enterprise plans, and stayi's configuration does not request one, as stated in Anam's session-regions documentation | Adequacy decision for the United Kingdom (28 June 2021, renewed on 19 December 2025); for any onward transfer outside the United Kingdom, a transfer mechanism under Chapter V of the UK GDPR, such as the UK International Data Transfer Agreement or Addendum, as provided in Anam's data processing addendum |
| → ElevenLabs (engaged by Anam), as named in Anam's sub-processor list, which names no ElevenLabs legal entity | Not stated by Anam; Eleven Labs Inc., the ElevenLabs entity stayi contracts with, is at 169 Madison Ave #2484, New York, NY 10016, USA | Speech synthesis of the reply text, where the avatar speaks with Anam's own voice | United States, the Netherlands and Singapore, as stated in Anam's sub-processor list, which offers an EU-only ElevenLabs environment only where separately configured; neither Anam's list nor its data processing addendum states that it is configured for stayi's sessions | A transfer mechanism under Chapter V of the UK GDPR, such as the UK International Data Transfer Agreement or Addendum, as provided in Anam's data processing addendum; Eleven Labs Inc. also participates in the UK Extension to the EU-US Data Privacy Framework |
| Mapbox, Inc. | 1133 15th St NW, Suite 825, Washington, DC 20005, USA | Maps shown in the Services; receives the IP addresses of the devices that load them | United States (Amazon Web Services), with content cached on Mapbox's content delivery network in various regions, as stated in Mapbox's Privacy & Security FAQ | EU-US Data Privacy Framework (adequacy decision of 10 July 2023) and standard contractual clauses (Commission Implementing Decision (EU) 2021/914), as stated in Mapbox's data processing addendum |
| Volentio JSD Limited (trading as jsDelivr) | Suite 2a1, Northside House, Mount Pleasant, Barnet EN4 9EB, England, United Kingdom (company number 14984373) | Delivery of the web font used in emails to the Customer's staff; receives the IP addresses of recipients who open them | Not stated by jsDelivr. Its CDN traffic is served by the providers on its sub-processor list (Cloudflare, Fastly and Gcore); the operator, Volentio JSD Limited, is registered in England and Wales | Adequacy decision for the United Kingdom (28 June 2021, renewed on 19 December 2025); for onward transfers to jsDelivr's CDN providers, standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 3 (processor to processor) where the subscriber is a processor, and, where the UK GDPR applies, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner, as stated in jsDelivr's data processing agreement |