1. Purpose of This List
This page is the authoritative, versioned list of the sub-processors that Hoodbnb B.V., trading as 'Tribii' ('Tribii', 'we', 'our', 'us'), engages to help deliver its platform. It is referenced from Section 7.B of our Privacy Policy and from our Data Processing Agreement, and it satisfies the disclosure and notification commitments made in both documents.
Each sub-processor is engaged under a written data-processing agreement. Where a transfer leaves the European Economic Area, it is covered by the European Commission Standard Contractual Clauses (Commission Decision (EU) 2021/914), with the UK International Data Transfer Addendum and the Swiss-recognised adjustments applied where relevant, and by the EU-US Data Privacy Framework where the recipient is independently certified.
2. Change Notification
We will give hoteliers at least fifteen (15) days' notice by email before adding, replacing, or materially changing a sub-processor, so that a hotel has the opportunity to object on reasonable data-protection grounds before the change takes effect. The objection and resolution procedure is set out in Section 4.4 of our Data Processing Agreement. The version and date of this list are recorded at the foot of this page.
3. Current Sub-processors
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd | Payment infrastructure | Ireland (EU); global infra | Intra-EEA + SCCs |
| Amazon Web Services EMEA SARL | Cloud hosting infrastructure (EU region) | EU (Ireland) | Intra-EEA |
| Anthropic, PBC | AI service provider (content, revenue and workflow features; AI Connections context) | USA | EU SCCs 2021; DPF where certified |
| OpenAI, L.L.C. | AI service provider; AI Visibility probing | USA | EU SCCs 2021; DPF where certified |
| Google LLC | Cloud services, Gemini AI service provider (incl. the Hotel AI Assistant), AI Visibility probing, mapping | USA | EU SCCs 2021; DPF where certified |
| Perplexity AI, Inc. | AI Visibility probing | USA | EU SCCs 2021 |
| Resend, Inc. | Transactional and abandonment-recovery email delivery; newsletter audience | EU / USA | EU SCCs 2021 |
| Microsoft Corporation | Integration APIs | EU / USA | EU SCCs 2021 |
| Postmark / AWS SES | Email delivery infrastructure | USA | EU SCCs 2021 |
| Expedia Group | Distribution channel integration | USA / EU | EU SCCs 2021 |
| Functional Software, Inc. (Sentry) | Error monitoring (configured without PII) | EU / USA | EU SCCs 2021 |
4. Notes on Specific Processing
AI Visibility. Where a hotel enables the AI Visibility Booster, Tribii transmits the hotel's public name and city to the US-based large-language-model providers listed above to probe how those models describe the hotel. This data is not guest personal data. Tribii relies on the Standard Contractual Clauses 2021 (Module 2, controller-to-processor) and, where the recipient is certified, the EU-US Data Privacy Framework.
AI Connections (MCP). The Model Context Protocol endpoint exposes a hotel's published inventory, rate and policy data to third-party AI agents on a public, read-only basis. It carries no guest personal data. Calls to the endpoint are logged for operational and abuse-investigation purposes.
Guest data features. For features that process guest personal data on a hotel's behalf (for example AI-assisted content, transactional email, and abandonment recovery), the relevant sub-processor acts as Tribii's sub-processor and the Standard Contractual Clauses 2021 are applied on a Module 3 (processor-to-processor) basis where the transfer leaves the EEA.
Hotel AI Assistant. Where a hotel uses the Max-tier Hotel AI Assistant, Tribii sends aggregated, non-identifying operational figures to Google Gemini to generate answers. This is not guest personal data and no individual guest profile is transmitted.
Public data sources (not sub-processors). The Revenue Intelligence tools call public APIs for public-holiday calendars (Nager.Date) and weather outlooks (Open-Meteo). These receive only non-personal inputs (a country code, or the hotel's location and dates) and process no personal data; they are third-party data sources, not sub-processors.
5. Contact
For questions about this list or to register an objection to a planned change, contact us at contact [at] tribii [dot] com.