Legal
Sub-processors.
Last updated 27 October 2026
These are the providers that handle data for Hostomat, each for one job. For a host's guests and homes they work under our data processing agreement, on the same terms we do.
Supabase
Database, sign-in and file storage
Everything Hostomat holds · United States
Vercel
Runs the app and hosts' websites, scheduled jobs, visit counts, hosts' own domains
What passes through the app; hosts' domain names · United States
Channex
The connection to Airbnb and Booking.com
Listings, prices and availability, bookings with guests' details, guest messages · European Union
Stripe
Hostomat's own billing and tax; payments on hosts' websites, on each host's own Stripe account
Card and billing details, which only Stripe holds; website guests' email and payments · United States
OpenRouter
Routes each AI request to one of the two providers below, keeping none of it
The text, and for the listing audit the photos, an AI feature needs · United States
Google Vertex AI
AI models, with zero data retention
The same, through OpenRouter · United States
Amazon Bedrock
AI models, with zero data retention
The same, through OpenRouter · United States
Exa
Web search for local events, through OpenRouter
A city and a range of dates, nothing personal · United States
Resend
Email: notifications, and website guests' emails and their replies
Addresses and the email's content · United States
Cloudflare
Spam checks on website forms; looking up hosts' own domains
A visitor's IP address and browser; domain names · Worldwide
PostHog
Usage, session replays and errors, for signed-in users
An account id (never an email), pages and clicks, replays with typing masked · United States
Meta (WhatsApp)
The WhatsApp assistant and alerts, for people who connect it
Phone numbers and messages · Worldwide
Google (Gmail)
Our support inbox
What you send us through the contact form · United States
Before we add one
We email every account's admins and update this page at least 14 days before a new provider starts handling customer data. If you object for a reason to do with data protection, tell us within those 14 days; if we can't meet the objection, you can close your account and we refund the part of the period you paid for and won't use.
Services you connect yourself
Airbnb, Booking.com and your own Stripe account aren't our sub-processors: you connect them, and they get what the connection sends under their own terms. To find comparable listings, a market data provider sees your homes' locations, never anyone's personal details.