Sub-processors
Last updated: 2026-10-07
Rentibly uses the following third-party service providers ("sub-processors") to deliver the platform. Each sub-processor may process personal data on Rentibly's behalf strictly for the purpose stated. Rentibly maintains data processing agreements (DPAs) or executed Standard Contractual Clauses (SCCs) with each sub-processor where personal data is transferred outside the EEA / UK.
Rentibly gives notice of a new or replacement sub-processor by updating this list. Operators who want to be told of each change by email can ask at legal@rentibly.com. Where a change involves a transfer of personal data outside the EEA / UK that is covered by the Standard Contractual Clauses, Rentibly updates this list at least 10 days before the new sub-processor starts processing that data. Operators may object on reasonable data-protection grounds — see "Objection procedure" below.
Core sub-processors
Used for every Rentibly workspace.
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting, databases, file storage, caching and queues, backups and disaster recovery, email delivery (Amazon SES), logs and monitoring (Amazon CloudWatch), and the AI models behind Rentibly AI (Amazon Bedrock) | All operator, guest, owner and vendor data held in the platform | EU — Frankfurt (primary); Ireland (email sending, backups and disaster recovery). AI requests to Amazon Bedrock use cross-region inference and may be processed in any AWS commercial region, including outside the EU; Bedrock does not store them |
| Cloudflare, Inc. | DNS, content delivery, DDoS protection, TLS, bot checks (Turnstile), hosting of the Rentibly web apps, file and image delivery, real-time message relay, and video calls when the fallback call provider is used | IP addresses and request metadata; files and images delivered through it; message content relayed in real time; call audio and video on the fallback call provider | Global edge network |
| LiveKit | Voice and video calls in Rentibly Connect | Real-time call audio and video. Recordings and transcripts are stored in Rentibly's own AWS storage | LiveKit Cloud |
| Gupshup | WhatsApp Business messaging — Rentibly's own messages (sign-in codes, signing invitations) and operators' WhatsApp conversations | Phone numbers, names, message content | India, with delivery through Meta's WhatsApp platform |
| Meta Platforms (WhatsApp Business Platform) | Delivery of WhatsApp messages sent and received through Gupshup | Phone numbers, message content | Meta's global infrastructure |
| Twilio | SMS one-time codes for sign-in verification | Phone numbers, verification messages | United States |
| Expo (650 Industries, Inc.) | Push notifications to the Rentibly mobile apps | Device tokens; notification text, which may include guest names and message previews | United States |
| Apple Inc. (Apple Push Notification service) | Push notifications to iPhone and iPad | Device tokens; notification text, which may include guest names and message previews | United States |
| Stripe, Inc. | Rentibly subscription billing and messaging-credit top-ups | Billing contact details; card data, tokenised by Stripe | United States; EU processing through Stripe Payments Europe |
| AssemblyAI | Speech-to-text for opt-in call transcription and voice dictation | Call audio, dictated speech, transcripts | EU (Ireland) |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring | User ID, workspace ID, user role, request URL and technical traces. No email addresses, IP addresses, cookies or request contents | EU (Frankfurt) |
| Google LLC (Google Maps Platform) | Maps in the Rentibly apps and on hosted booking websites | Viewer IP addresses; property addresses | Global |
Support and operations tooling
Used by Rentibly's own team to run the service and support operators.
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| Anthropic PBC | AI models used in Rentibly's internal support, administration and security tooling. Customer-facing Rentibly AI runs on AWS (above) | Content of support requests and conversations; account and workspace records looked up while resolving a support issue; security events, including IP addresses | United States |
| Google LLC (Google Workspace) | Rentibly's support mailbox and internal alerting | Support emails and attachments from operators; alert details | Global |
| Slack | Internal incident alerts | Technical alert details, which can occasionally include account identifiers | United States |
| GitHub | Tracking support issues escalated to engineering | Support request summaries | United States |
Integrations an operator turns on
These receive data only when an operator connects them in their Rentibly workspace, and only the data that connection needs.
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| NextPax | Channel connection to Airbnb, Booking.com, Vrbo and other booking sites | Properties, rates and availability; reservations with guest details; guest messages; guest payment card data, handled by NextPax's PCI-compliant service | Netherlands |
| Emerging Travel Group (Ostrovok, RateHawk) | Direct channel connection | Rates and availability; reservations with guest names | Vendor-hosted |
| Bayut, Dubizzle and Property Finder | Listing syndication and lead capture | Lead names and phone numbers; listings with agent contact details | United Arab Emirates |
| Seam | Smart-lock connections (including Nuki, Yale, August, Schlage, igloohome and Salto KS) | Access codes and their validity windows, lock activity | United States |
| TTLock | Smart-lock connection | Access codes and their validity windows, lock activity | EU |
| Keyless | Smart-access connection | Names, email addresses and phone numbers of guests, staff and vendors; access codes | United Arab Emirates |
| PriceLabs | Dynamic pricing | Listings, calendars and booking data; the operator's PriceLabs account email | Vendor-hosted |
| Google LLC (Google Calendar) | Calendar connection for scheduled calls | Meeting titles, attendee email addresses and links; free/busy times | Global |
| Google LLC (Google Business Profile) | Showing and replying to Google reviews | Reviews and reviewers' public display names | Global |
| Meta Platforms (Conversions API) and Google LLC (Google Analytics, Tag Manager) | Conversion tracking on hosted booking websites and click-to-WhatsApp ads, when the operator sets it up | Hashed guest email addresses, phone numbers and names; ad click identifiers; visitor IP addresses | Global |
| Zapier | Automations the operator builds in Zapier | Whatever data the operator's Zaps request through the Rentibly API | United States |
| Stripe, Inc. (operator's own account) | Guest payments into the operator's own Stripe account | Guest payment details | United States; EU processing through Stripe Payments Europe |
| The operator's own email provider | Sending and receiving guest email from a connected mailbox (Google Workspace, Microsoft 365, Zoho and others, over IMAP/SMTP) | Content of the connected mailbox | As set by the operator's provider |
Standard Contractual Clauses (SCCs)
For all sub-processors headquartered outside the EEA / UK, Rentibly relies on the 2021 EU Commission Standard Contractual Clauses (Modules 2 or 3 as applicable) executed with each vendor. The UK Addendum is applied where data pertains to UK residents.
Objection procedure
Operators may object to a new or replacement sub-processor by notifying Rentibly in writing, on reasonable data-protection grounds, within 10 days of the change being published on this page. Rentibly will work with the operator in good faith to make available a commercially reasonable change to the Services, or to the operator's configuration, that avoids use of that sub-processor for the operator's data.
Change history
| Date | Change |
|---|---|
| 2026-07-04 | First version |
| 2026-10-06 | List corrected against the platform: providers not in use removed, providers in use added, and purposes and locations updated |
| 2026-10-07 | Change-notice terms updated (notice by updating this list, email notification on request, 10 days for changes involving SCC-covered transfers; objections handled by a good-faith alternative). Amazon Bedrock AI requests may now be processed in any AWS commercial region |