The short version
- This is the complete current list. It is the same list the privacy policy and the DPA refer to.
- We give 30 days' notice before adding or replacing one, and hosts can object.
- Several are optional: a deployment that never configures the integration never engages that provider.
This summary is a reading aid and is not part of the agreement. Where it differs from the text below, the text below is what applies.
Contents+
A sub-processor is a company we use to run Hostbnb that may handle personal data in the process. Each one works on our instructions, under a contract with data protection obligations at least as strict as those in our Data Processing Addendum, and we stay responsible to you for what they do.
Current sub-processors
| Provider | What it does for us | Data it can see | Location |
|---|---|---|---|
| Application hosting provider (Vercel Inc.) | Runs the Hostbnb web application and serves every page and API request. | All data in transit, request metadata, IP addresses, server logs | United States, with a global edge network |
| Managed PostgreSQL database provider | Stores the production database: host accounts, property content, guest tips, chat transcripts. | All stored account, property and guest-page data | Configured deployment region |
| Object storage provider (Amazon S3 or an S3-compatible service) | Stores images and files hosts upload for their guest pages. | Uploaded images and documents and their metadata | Configured storage region |
| AI provider (OpenAI, L.L.C. or a configured OpenAI-compatible provider) (if configured) | Generates AI concierge answers, translations and writing suggestions, and computes the embeddings behind the search index. | Guest questions, the host guide passages retrieved to answer them, host-authored text submitted for polishing | United States, or the configured provider's region |
| Stripe, Inc. (if configured) | Takes subscription payments and stores the card details we deliberately never see. | Host billing name and email, payment card data (held by Stripe, not by us), invoices, subscription state | United States and Ireland |
| Google LLC (Places and Maps APIs) (if configured) | Looks up places a host adds as a recommendation, and renders maps on guest pages. | Search terms a host types, coordinates of the places shown; map tile requests carry the viewer's IP address | United States and globally |
| PostHog, Inc. (if configured) | Product analytics: which features get used, where people get stuck. Runs only after a visitor accepts analytics cookies. | Pseudonymous device identifier, pages viewed, feature events; host account id and email once signed in | United States or European Union, depending on the configured region |
| Viator (Tripadvisor LLC) (if configured) | Supplies the tours and activities hosts can add to a guest page, and takes the booking when a guest books one. | Referral click identifiers and booking references. Guests who book do so on Viator and give their details to Viator, not to us. | United States |
| Transactional email provider (if configured) | Sends account email: sign-in, billing receipts, and service notices. | Host name, email address, message contents | Configured provider's region |
Entries marked (if configured) correspond to optional integrations. Hostbnb runs with no AI, maps, payment or analytics keys at all; where a deployment has not configured one, that provider receives nothing.
Changes and how to object
We publish a new or replacement sub-processor here, and email hosts on a paid plan, at least 30 days before it starts processing anything. To be added to that notification list, or to raise a reasonable data protection objection to one, write to privacy@hostbnb.example.com.
If we can't resolve an objection, you may terminate the affected part of your subscription and we will refund the unused period. Section 6 of the Data Processing Addendum sets out the full process.
Not sub-processors
Some companies appear on a Hostbnb page without processing data for us. When a guest clicks through to book a tour, they leave our site and deal with Viator directly under Viator's own terms and privacy policy; the same is true of any partner business whose offer a host displays. Those companies are independent controllers of whatever a guest gives them, not our sub-processors.