Sub-processors

Summary

This summary helps you find your way. It does not replace the full list below.

• This page lists every company that processes personal data for Stayantra: our sub-processors under the hotel Data Processing Addendum, and the service providers named in our Privacy Policy.
• Each entry shows what the company does, what data it handles, where, and how international transfers are protected.
• Hotels get at least 30 days' notice before we add or replace a sub-processor, by email and in the dashboard, and may object under the Data Processing Addendum.
• To receive update notices even if you are not a hotel, email info@stayantra.com.

1. About this list

The Stayantra companies, [Pending: UK company legal name] and [Pending: Nepal Stayantra company legal name], use other companies to help run Stayantra. When a hotel uses the Stayantra hotel system, the hotel is the controller of its guest and staff data and we are its processor. The companies we engage to help process that data are our sub-processors. The same companies also help us with data we control ourselves, such as marketplace accounts.

Every sub-processor is bound by a written contract that requires it to process personal data only on our instructions, keep it confidential and secure, and offer protections at least as strong as those in our Data Processing Addendum. We check each one before we use it, and we remain responsible to hotels for their work.

"Location" below means where the company processes the data, as far as it is under our control or disclosed by the provider. Some providers also use global networks to deliver content, so data can pass through other countries in transit.

Transfer safeguards used below:

• IDTA / Addendum: the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, for data from the UK.
• SCCs: the EU Standard Contractual Clauses, for data from the European Economic Area.
• DPF: the EU-US Data Privacy Framework and its UK Extension, where the US provider is certified.
• Provider DPA: the provider's data processing terms, which incorporate the safeguards above.

Some of the countries below, including Nepal, do not have a UK or EU adequacy decision. Transfers there rely on the contractual safeguards shown.

2. Stayantra group and developer

3. Infrastructure and hosting

4. Artificial intelligence

All AI model requests go through OpenRouter, which sends each request to a hosting provider: a company that runs the model. The company that developed a model and the company that runs it are often different, so the table names both. We use paid API access. With every request, we instruct OpenRouter to use only hosting providers it lists as zero data retention (they do not store requests or answers and do not train on them), to skip any provider that may collect or store data, and never to use a provider based in China, including the developers' own services from DeepSeek, Moonshot AI and Alibaba. If no hosting provider meets these rules, the request moves to our next model or fails; it is never sent elsewhere. OpenRouter's speech-to-text service does not accept these instructions, so for voice we use a model whose only hosting providers are on OpenRouter's zero data retention list. The hosting providers are OpenRouter's sub-processors, and OpenRouter chooses among them for each request; the ones named below are those eligible today.

5. Communications

6. Payments

Payment providers process card and wallet payments on their own secure pages. Stayantra never sees or stores full card numbers. For their own legal duties, such as fraud and anti-money-laundering checks, payment providers act as independent controllers.

7. Distribution

When a hotel connects to online travel agencies through Channex, such as Booking.com, Agoda, Expedia, Airbnb and Trip.com, those agencies send and receive booking data. They are independent controllers of bookings made on their sites, not our sub-processors, and their own privacy policies apply.

8. Apps, sign-in, maps and monitoring

9. Other recipients that are not sub-processors

These organisations receive data but are not our sub-processors. They act under their own terms and privacy policies:

• Hotels, who receive booking and guest data as controllers for your stay.
• Online travel agencies, as described in section 7.
• Outside AI assistants that a user or hotel chooses to connect, such as ChatGPT or Claude.
• LinkedIn, where we run Stayantra's own company page; it processes data about people who interact with that page.
• Authorities, only when the law requires it. See our Law Enforcement Guidelines.

10. Changes and your right to object

We will give hotels at least 30 days' notice before we add or replace a sub-processor that processes hotel data. We send the notice by email to the hotel's owner and show it in the hotel dashboard, and we update this page with the new version date.

A hotel may object to a new sub-processor on reasonable data protection grounds within that notice period, by emailing info@stayantra.com. We will then work with the hotel in good faith to find a solution, such as not using the new sub-processor for that hotel's data. If we cannot, the hotel may end the affected service as set out in the Data Processing Addendum.

In an emergency, such as a provider suddenly failing or a security risk, we may need to replace a sub-processor with less notice. We will tell hotels as soon as we can and the right to object still applies.

Subscribe to updates. Anyone can receive notice of changes to this list by emailing info@stayantra.com with the subject "Sub-processor updates".

11. Contact

Questions about this list: email info@stayantra.com.

Related documents: Privacy Policy, Data Processing Addendum, Cookie Policy, Security.