Subprocessors
Visby uses the following service providers to operate the Visby consumer app, marketing site, and hotel partner products. Providers process data under contract and only on our instructions (or as independent controllers where noted by law — e.g. app store billing, and Stripe and Wise for their own legal obligations as payment providers). Systems a hotel chooses to connect (its property management system, booking engine or channel manager) act for the hotel, not for Visby. See also the DPA and Privacy Policy.
| Provider | Purpose | Typical data | Location |
|---|---|---|---|
| Supabase | Database, authentication, storage, Edge Functions | Account, profile, app content, hotel operational data, stays, requests, rides, payment and payout records | US / provider regions |
| Vercel | Hosting the website, recap pages, hotel portal and driver pages | Request data (IP address, browser) and the content those pages show | US / global edge |
| Stripe | Card payments for what Visby sells at hotels; payouts to hotels’ partners through Stripe Connect; hotel plan billing | Payment details (card data is collected by Stripe, not Visby), payer name and email, amounts, merchant and payout account details | US / Stripe regions |
| Wise | Bank transfers to hotels (Visby Payouts) | Hotel business name, bank account details, payout amounts and references | UK / EU / Wise regions |
| Apple | App distribution, Sign in with Apple (if used), In-App Purchase | Entitlements, device / account identifiers as provided by Apple | Apple regions |
| Play distribution / billing (Android); Sign in with Google; Places and maps where used; Google Calendar when you connect an account to a trip (free/busy times and the “Visby trips” calendar Visby creates); Google Ads measurement and signup conversions on web | Entitlements; account sign-in; place and map queries as needed for features; calendar free/busy ranges, the trip events Visby writes and the OAuth tokens for that connection; advertising cookies / conversion signals for campaign measurement | Google regions | |
| OpenAI | AI features: Visby companion chat, voice talk and questions about photos (in the app, after the person allows AI answers), hotel concierge answers (in the app, WhatsApp and SMS), reading booking confirmations hotels forward, trip and travel suggestions | Prompts and conversation content, photos added to a chat, voice clips (turned into text), place or location context for the question, and the booking details in forwarded confirmations. Never health data. Under OpenAI’s API terms this data is not used to train its models | US / provider regions |
| Twilio | Text messages (SMS), WhatsApp messages for hotels, and connecting in-app calls to phones | Phone numbers, message content, delivery status, call routing data (no call recordings) | US / Twilio regions |
| Meta (WhatsApp Business) | Hotel guest messaging when a property connects WhatsApp (sent through Twilio) | Message content and phone numbers for that channel | Meta regions |
| LiveKit | In-app voice calls between guests, hotels, drivers and partners | Live call audio while a call is connected (not recorded) and call connection data | US / LiveKit regions |
| Resend | Sending email (sign-in, stay links, booking and team emails) and receiving email (hotel booking confirmations and replies) | Email addresses and email content | US |
| Expo | Delivering push notifications to the mobile app | Push tokens and notification content | US |
| Sentry | App crash and error reports, where enabled | Error details, device and app version, account identifier | US |
| GitHub | Running scheduled jobs that send stay emails, stay-link texts and booking imports | The guest and stay details those jobs process while they run | US |
| Slack | Alerts to the Visby team’s own workspace about new hotel bookings, sign-ups, guest requests and concierge hand-overs | Guest first name and initial, hotel, dates, party size, amounts, request type and short chat snippets with emails, phone numbers, links, codes and names removed; never a guest’s email, phone or notes | US |
| Jina AI (r.jina.ai) | Reading the public text of a hotel’s website or menu page when the hotel asks Visby for offer ideas | The public web address the hotel enters and that page’s text; no guest data | US / provider regions |
| goqr.me (api.qrserver.com) | Rendering QR code images for stay links, hotel team invites and office sign-in | The link or token encoded in the QR code; no account details | Germany |
| Hotel booking systems (Mews, Inn Style, Booking.com and Airbnb channel feeds) | Bringing a hotel’s reservations into Visby so guest stays can be made; connected by the hotel and acting for it, listed here so guests can see where booking details come from | The booking details the hotel’s system sends: guest name, email, phone, dates, room, party size, language | EU (Mews) / UK (Inn Style) / provider regions |
| Photo, music and open-data libraries | Unsplash, Pexels and Wikimedia Commons photos, Mixkit music, and Wikipedia / Wikidata facts shown in the app, on the site and in recaps | Your IP address and the photo, clip or article your device or our server requests; no account details | Provider regions |
| Map, place and weather providers | Map tiles, place search and geocoding (Esri, OpenFreeMap, CARTO, OpenStreetMap through Nominatim, Overpass and Photon), weather (Open-Meteo) | Your IP address and the map area or search text requested; no account details | Provider regions |
Updates
We may update this list when we add or remove providers. Material changes for hotel customers processing personal data under a DPA will be communicated as described in the DPA. Questions: hello@visbytravel.com