GDPR
Last updated: 26 October 2026
For hostels and hotels: we act as your data processor. A data processing agreement (Article 28 GDPR) is part of every StayAutomate contract.
1. Our commitments
- We process your data only on your instructions, and only to deliver the service.
- Data is hosted and processed in the EU. No transfer outside the EU/EEA without your instruction.
- No card data, and no more guest data than the service needs. Guest names are not stored.
- Encryption, personal accounts with least-privilege access, two-factor authentication and an audit trail.
- We notify you without undue delay of any personal data breach affecting your data.
- We help you answer data subject requests. Audits: once per contract year, on 30 days' notice.
- At the end of the contract: export available for 30 days, then deletion.
2. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Neon Inc. | Database hosting | Frankfurt, Germany |
| Vercel Inc. | Application hosting | Frankfurt, Germany |
| Clever Cloud SAS | Background processing | Paris, France |
| Scaleway SAS | Service emails | Paris, France |
We inform customers at least 30 days before adding or replacing a sub-processor.
3. Questions and requests
For your own rights as an individual, see our Privacy Policy. For anything else, or a copy of our data processing agreement: contact@hostelanalytics.fr.