Working version, drafted from a review of Romanian and EU law. The text must be reviewed by a lawyer before it is relied on; details marked “[to be completed]” are for the platform's operator to fill in.
Sub-processors
In force from 01/07/2026
The providers below process personal data to make the platform work (GDPR art. 28(2) and (4)). Some are used only if the hub switches the feature on (online payments, invoicing, locks, a PMS integration). We tell clients before adding or replacing a sub-processor, so they can object.
Where the data is
The locations below are read from this deployment's own configuration (the region the server runs in, the database's, the file storage's and the backup's, the email provider), so they show where the data is actually hosted and stored, not a general promise.
- The app's functions (the server): Vercel, region fra1 — Frankfurt, Germany (EU); static pages go through Vercel's global network, and the Vercel account data and technical logs are in the US
- The database (all stored data): Nile, eu-central-1 — Frankfurt, Germany (EU)
- Files (photos, documents): Neon Object Storage, eu-central-1 — Frankfurt, Germany (EU)
- The database backup: Neon, eu-central-1 — Frankfurt, Germany (EU)
- Emails: Brevo — servers in the EU (its own, at OVH, in France and Germany, and Google Cloud in Belgium; every item copied to at least two EU locations)
- Locks (only when the hub connects them): TTLock's European platform — the API server euapi.ttlock.com, in Frankfurt, Germany (EU), on Alibaba Cloud; TTLock is a company in China
The list
| Provider | What for | Data | Where | Transfer safeguards |
|---|---|---|---|---|
| Vercel Inc. (SUA) | Hosting the application, serverless functions, technical logs | All data passing through the app (in transit), logs with IP addresses | The app's functions (the server): Vercel, region fra1 — Frankfurt, Germany (EU); static pages go through Vercel's global network, and the Vercel account data and technical logs are in the US | EU–US Data Privacy Framework + standard contractual clauses (Vercel DPA) |
| Nile Platform, Inc. (SUA) | Production database (Postgres) | All of the application's stored data | Region eu-central-1 — Frankfurt, Germany (EU), on AWS; the stored data stays in the EU | The data stays in the EU; Nile is a US company, so remote access (support, administration) is a transfer: standard contractual clauses, with the data processing agreement (DPA) obtained from Nile |
| Databricks, Inc. / Neon, LLC (SUA) | File storage (photos, documents), the database backup | Unit photos, offer documents, meter and cleaning photos; the database copy | This deployment's AWS regions — files: eu-central-1 — Frankfurt, Germany (EU); backup: eu-central-1 — Frankfurt, Germany (EU) | EU–US Data Privacy Framework + standard contractual clauses (Neon / Databricks DPA) |
| Stripe Payments Europe, Ltd. (Irlanda) | Online card payments (Stripe Checkout), through the hub's own Stripe account | Amount, payment description, payer's email; card data goes to Stripe only | EU (Ireland), with transfers to Stripe, LLC (US) | Processor for the payment; independent controller for fraud prevention and anti-money-laundering duties (Stripe DPA); DPF + standard clauses |
| S.C. Intelligent IT S.R.L. — SmartBill (România, CUI RO18990059) | Issuing invoices in the hub's SmartBill account | Tenant's name and billing details, invoiced amounts | Romania / EU (exact location — per SmartBill) | Not applicable (EU) |
| S.C. i-Tom Solutions S.R.L. — FGO (România, CUI RO18430442) | Issuing invoices in the hub's FGO account (instead of SmartBill, when the hub uses FGO) | Tenant's name and billing details (CNP/CUI, address, county, city, email, phone), invoiced amounts | EU — Amazon Web Services, Frankfurt, Germany (per FGO) | Not applicable (EU) |
| Hangzhou Sciener Intelligent Control Technology Co., Ltd. — TTLock (China) | Smart locks: passcodes, eKeys, cards, the doors' log | The code's name (usually the tenant's or the cleaner's name), its digits, its validity, the opening history | The platform uses TTLock's European platform: the app is registered on the European portal (euopen.ttlock.com) and sends its requests to the European API server (euapi.ttlock.com), hosted in Frankfurt, Germany (EU), on Alibaba Cloud. TTLock is a company in China, and its policy says data may also reach other countries | The API server is in the EU, but TTLock is a company in China (a country without an adequacy decision) that can access the data remotely and makes no public GDPR commitment: standard contractual clauses and a transfer impact assessment — for the hub to obtain before use |
| Guesty, Inc. (US) / Hostaway Opco Oy (Finland) | Syncing bookings from the manager's PMS (only when the hub has an integration) | Bookings, guests, units, owners as held in the PMS | Guesty: US, Israel and other locations; Hostaway: EU and its affiliates | The PMS is the manager's processor (under the manager's contract with it), not ours; we only read the data with the manager's authorisation |
| Sendinblue SAS — Brevo (France) | Sending emails (SMTP): sign-in, offers, codes, messages to tenants | Recipient's address, message content, delivery log | EU: its own servers at OVH in France and Germany, and Google Cloud in Belgium; every item copied to at least two EU locations | Not applicable for storage (EU); the Brevo data processing agreement (DPA) |
Exchange rates are taken from the National Bank of Romania (curs.bnr.ro) — public data; no personal data is sent. The “WhatsApp” button opens the sender's own WhatsApp app on their phone; the platform sends no data to WhatsApp.