Sub-processors
Last updated: 2026-08-25
To run Stayolo we rely on a small number of providers who process data on our behalf. This page lists what each category receives, where it is processed, and the safeguard that applies. It forms part of the Data Processing Agreement and the Privacy Policy.
| Category | Purpose | Data processed | Region | Safeguard |
|---|---|---|---|---|
| Stripe (Payment processing) | Guest payments to hosts (Stripe Connect) and host subscription billing | Name, email, payment details, transaction records | EU / US | Standard Contractual Clauses; PCI-DSS Level 1 |
| Resend (Transactional email) | Booking confirmations, stay emails, account email | Recipient name and email address, message content | EU / US | Standard Contractual Clauses |
| Firecrawl (Listing import) | One-time retrieval of a public listing page the host asks us to import | The listing URL submitted by the host. No guest data. | EU / US | Standard Contractual Clauses |
| AI service providers | Optional on-site booking assistant | Property details and the guest's typed question. No guest contact details. | Outside EEA | Standard Contractual Clauses |
| Google Analytics 4 (Google Ireland Ltd.) (Website analytics) | Understanding which pages of our own marketing site and dashboard are used. Loaded only after consent, and never on a host's property site. | Pseudonymous usage events, approximate location, device and browser | EU / US | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Application hosting & database | Running the service and storing its data | All service data | EU | Processed within the EEA |
Changes and objections
We give hosts at least 30 days' notice before adding or replacing a sub-processor that handles personal data. To receive those notices, email [email protected] asking to be added to the list.
If you object to a new sub-processor on reasonable data-protection grounds, tell us within those 30 days. We will work with you to find an alternative; where none is available you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees.
Every sub-processor is bound by a written contract imposing protections no less strict than those in our DPA. We remain liable to you for their performance.
Need the named provider for a category, or a copy of the Standard Contractual Clauses we rely on? Email [email protected] and we will send them.