Stay Now

Sub-processors

The third parties that process personal data on our behalf, with the data they handle and where they operate. We announce new sub-processors at least 30 days before they go live.

This register is a working draft pending legal review. Entities, locations, and transfer mechanisms will be confirmed at sign-off.

Controller
Stay Now (operator entity — confirm legal name)
Last reviewed
Pending legal review

  • Stripe

    Host Plan subscription billing and payment facilitation; VAT is added at checkout (§6, §19).

    Data
    • billing contact (name, email)
    • payment metadata (Stripe customer/subscription ids; card data handled by Stripe, never stored by Stay Now)
    Location
    EU/US
    Transfer mechanism
    SCCs (confirm)

    Webhook and nightly reconciliation re-fetch from Stripe (§19). Stay Now stores only Stripe ids and subscription status, not card data.

  • Resend

    Transactional email delivery (OTP, Action Links, host inquiry and retention notices, §16).

    Data
    • recipient email address
    • email subject/body (may reference a guest first name in localized copy)
    Location
    US (confirm region options)
    Transfer mechanism
    SCCs (confirm)

  • Cloudflare

    DNS for custom domains and ACME DNS-01 delegation (§9.1); CDN/edge for the status page (§23.4).

    Data
    • DNS records (apartment domain names; no guest PII)
    • request metadata (IP, user agent) at the edge
    Location
    Global edge
    Transfer mechanism
    SCCs (confirm)

  • Hetzner

    Compute and managed Kubernetes hosting the application, worker, Postgres (CNPG), KeyDB, Garage, and OCR.

    Data
    • all categories at rest/in transit within the cluster (encrypted PII vault; see ROPA)
    Location
    EU region (confirm)
    Transfer mechanism
    intra-EU (confirm)

    CNPG, cert-manager, Garage object storage, and the OCR service run inside this cluster as self-hosted components, listed in the ROPA as internal processing systems. The stay-now-backups bucket holds only BMK-encrypted data.

  • Google (OAuth)

    Optional Sign-in with Google for hosts and guests (§5).

    Data
    • authentication identifier (email, subject id) when a user chooses Google sign-in
    Location
    EU/US
    Transfer mechanism
    SCCs (confirm)

    Only engaged when a user elects OAuth; OTP/password users are unaffected.

  • Meta (Facebook Login)

    Optional Sign-in with Facebook for hosts and guests (§5).

    Data
    • authentication identifier (email, subject id) when a user chooses Facebook sign-in
    Location
    EU/US
    Transfer mechanism
    SCCs (confirm)

    Only engaged when a user elects OAuth; OTP/password users are unaffected.

Stay Now