1. Purpose of This List
This page is the authoritative, versioned list of the sub-processors that Hoodbnb B.V., trading as 'Tribii' ('Tribii', 'we', 'our', 'us'), engages to help deliver its platform. It is referenced from Section 7.B of our Privacy Policy and from our Data Processing Agreement, and it satisfies the disclosure and notification commitments made in both documents.
Each sub-processor is engaged under a written data-processing agreement. Where a transfer leaves the European Economic Area, it is covered by the European Commission Standard Contractual Clauses (Commission Decision (EU) 2021/914), with the UK International Data Transfer Addendum and the Swiss-recognised adjustments applied where relevant, and by the EU-US Data Privacy Framework where the recipient is independently certified.
2. Change Notification
We will give hoteliers at least fifteen (15) days' notice by email before adding, replacing, or materially changing a sub-processor, so that a hotel has the opportunity to object on reasonable data-protection grounds before the change takes effect. The objection and resolution procedure is set out in Section 4.4 of our Data Processing Agreement. The version and date of this list are recorded at the foot of this page.
3. Current Sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd | Payment infrastructure | Ireland (EU); global infra | Intra-EEA + SCCs |
| Laravel Cloud, Inc. | Application hosting and platform operations, including custom-domain provisioning | USA; hosted infrastructure in the EU | EU SCCs 2021 |
| Amazon Web Services EMEA SARL | Underlying cloud infrastructure (EU region) | EU Central (Frankfurt) | Intra-EEA |
| Apple Inc. | App distribution (App Store) and push-notification transport (APNs) for the Guest App | USA | EU SCCs 2021; DPF where certified |
| Expo (650 Industries, Inc.) | Guest App push-notification delivery, over-the-air updates, and build service | USA | EU SCCs 2021 |
| Anthropic, PBC | AI service provider (content, revenue and workflow features; AI Connections context) | USA | EU SCCs 2021; DPF where certified |
| OpenAI, L.L.C. | AI service provider; AI Visibility probing | USA | EU SCCs 2021; DPF where certified |
| Google LLC | Cloud services, Gemini AI service provider (incl. the Hotel AI Assistant), AI Visibility probing, mapping | USA | EU SCCs 2021; DPF where certified |
| Perplexity AI, Inc. | AI Visibility probing | USA | EU SCCs 2021 |
| Resend, Inc. | Transactional and abandonment-recovery email delivery; newsletter audience | EU / USA | EU SCCs 2021 |
| Umami Software, Inc. | Cookieless page-view statistics on the hosted booking pages we operate for hotels (see Section 4) | USA | EU SCCs 2021 |
| Channex.io LTD | Channel manager connectivity: property and rate content, availability and restrictions, inbound reservations from booking sites, and, where the hotel enables it, guest messaging and reviews | United Kingdom; platform and databases hosted in EU regions | UK adequacy decision |
| Functional Software, Inc. (Sentry) | Error monitoring (configured without PII) | EU / USA | EU SCCs 2021 |
4. Website Analytics and Advertising: tribii.com Visitors Only
The services below process data about visitors to our public marketing website, tribii.com, where Hoodbnb B.V. acts as controller in its own right. They have no access to Property Owner data, Guest data, or any data processed through the Tribii platform or booking widget. They are listed here for transparency and are not sub-processors under the Data Processing Agreement, so the change-notification and objection rights in Section 2 do not apply to them.
They run only where a visitor has consented to the relevant category. See our Cookie Policy. The cookieless website-statistics tool is the exception to that sentence as well as to the one above it: it needs no consent, because it stores nothing on a visitor's device.
One service in this section has a second role. The website-statistics tool also runs on the booking pages we host on a hotel's behalf. The visitors there are the hotel's prospective guests rather than ours, so on that page alone it processes a hotel's data as our sub-processor, and it is listed as one in Section 3 with the change-notification and objection rights that go with it. It has no such role on this website, on the booking widget a hotel embeds in its own site, or on the websites we publish for hotels.
| Service | Provider | Role | Location | Safeguard |
|---|---|---|---|---|
| Google Analytics 4 | Google Ireland Limited | Processor | Ireland (EU); onward transfer to US | Google Ads Data Processing Terms; EU SCCs 2021; Data Privacy Framework |
| Google Ads: conversion measurement | Google Ireland Limited / Google LLC | Independent controller | Ireland (EU) / USA | Google Ads Controller-Controller Data Protection Terms; EU SCCs 2021; Data Privacy Framework |
| Meta Pixel: advertising measurement | Meta Platforms Ireland Limited | Joint controller for collection and transmission; independent controller thereafter | Ireland (EU); onward transfer to US | Meta Controller Addendum; EU SCCs 2021; Data Privacy Framework |
| Umami (website statistics) | Umami Software, Inc. (Umami Cloud) | Processor | USA | Cookieless; aggregate page-view counts only; nothing stored on your device; no cross-site identifiers |
We do not use a tag-management container: the Google tag is loaded directly by our own code, so no third party can introduce further tags without a code change on our side.
The Google LLC entry in the table above (cloud services, Gemini, the Hotel AI Assistant and mapping) is a separate engagement covering the Tribii platform, and is unrelated to the marketing-website services in this section.
5. Notes on Specific Processing
AI Visibility. Where a hotel enables the AI Visibility Booster, Tribii transmits the hotel's public name and city to the US-based large-language-model providers listed above to probe how those models describe the hotel. This data is not guest personal data. Tribii relies on the Standard Contractual Clauses 2021 (Module 2, controller-to-processor) and, where the recipient is certified, the EU-US Data Privacy Framework.
AI Connections (MCP). The Model Context Protocol endpoint exposes a hotel's published inventory, rate and policy data to third-party AI agents on a public, read-only basis. It carries no guest personal data. Calls to the endpoint are logged for operational and abuse-investigation purposes.
Guest data features. For features that process guest personal data on a hotel's behalf (for example AI-assisted content, transactional email, and abandonment recovery), the relevant sub-processor acts as Tribii's sub-processor and the Standard Contractual Clauses 2021 are applied on a Module 3 (processor-to-processor) basis where the transfer leaves the EEA.
Hotel AI Assistant. Where a hotel uses the Max-tier Hotel AI Assistant, Tribii sends aggregated, non-identifying operational figures to Google Gemini to generate answers. This is not guest personal data and no individual guest profile is transmitted.
Public data sources (not sub-processors). The Revenue Intelligence tools call public APIs for public-holiday calendars (Nager.Date) and weather outlooks (Open-Meteo). These receive only non-personal inputs (a country code, or the hotel's location and dates) and process no personal data; they are third-party data sources, not sub-processors.
6. Contact
For questions about this list or to register an objection to a planned change, contact us at contact [at] tribii [dot] com.