Execution-ready draft, prepared for review and execution. Prepared for legal review. Not effective until accepted/executed in accordance with the Terms. Not yet executed. Draft prepared 2026-09-26. Nothing in this document has been signed, accepted or backdated.
1. Parties
1.1 Answerbnb, based in Pakistan ("AnswerBnB"). Contact: info@answerbnb.com. Responsible person: Adnan Khan. [COUNSEL REVIEW REQUIRED: AnswerBnB's entity type, registered address and registration details are not stated in this draft and are to be completed before execution if required.]
1.2 The customer identified in the signature block below or in the AnswerBnB account or order to which this Addendum is attached ("Customer"): legal name, country and address of the Customer are completed at signature.
2. Relationship to the Terms of Service
2.1 This Addendum supplements the AnswerBnB Terms of Service (https://answerbnb.com/terms) and any other written agreement between AnswerBnB and the Customer for the AnswerBnB service (together, the "Terms"). Once effective it forms part of the Terms.
2.2 The AnswerBnB Privacy Policy (https://answerbnb.com/privacy) describes how AnswerBnB handles information and remains a separate document. It is not a data processing agreement. Where this Addendum is in effect it governs the processing of Customer Personal Data as between the parties.
2.3 This Addendum is AnswerBnB's own agreement with its customer. The data processing agreements published by AnswerBnB's service providers (for example Hostinger, Supabase, Groq and Resend) are those providers' agreements with their own customers. They are not this Addendum, are not part of it, and do not make any provider's agreement AnswerBnB's data processing addendum (section 13).
3. Definitions
- Applicable Data Protection Law — the data protection and privacy laws that apply to the processing of Customer Personal Data. [COUNSEL REVIEW REQUIRED: identify the applicable laws (for example the laws of Pakistan, the EU and UK GDPR, or others) and whether jurisdiction-specific terms are needed. None is assumed.]
- Customer Content — property, listing, knowledge, reservation, guest and conversation information that the Customer or its Connected Systems provide to the service.
- Customer Personal Data — personal data contained in Customer Content that AnswerBnB processes on the Customer's behalf, as described in Annex A.
- Connected System — a third-party property-management, channel-management or similar system that the Customer chooses to connect to AnswerBnB (listed by provider in Annex A, part 2).
- Subprocessor — a third party that AnswerBnB engages and that processes Customer Personal Data on AnswerBnB's behalf, as listed in Annex C.
- Security Incident — a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Admin View — the administrative viewing feature described in section 11 and Annex B.
- controller, processor, data subject, personal data, processing — as defined in Applicable Data Protection Law; where a law uses the terms "business" and "service provider", they are read accordingly.
4. Scope and applicability
4.1 This Addendum applies to the processing of Customer Personal Data by AnswerBnB on the Customer's behalf in providing the service.
4.2 It does not apply to information for which AnswerBnB decides why and how it is used and acts as controller: account-holder information (name, email, organization, sign-in), website-visitor information, and correspondence with AnswerBnB. The Privacy Policy describes that processing.
4.3 Connected Systems are independent services chosen and authorized by the Customer. They are not AnswerBnB's Subprocessors and act under their own terms. What AnswerBnB receives from or sends to a Connected System depends on that provider's interface and on the Customer's authorization, and differs by provider (Annex A, part 2).
4.4 Annex A describes the integrations as of the Effective Date. Some integrations exist in AnswerBnB's software but are not currently enabled for customers; while an integration is not enabled, AnswerBnB receives no Customer Personal Data through it. Before AnswerBnB begins processing through an integration that is not described as active in Annex A, or processes categories not listed there, it will update Annex A by written notice to the Customer. [COUNSEL REVIEW REQUIRED: whether the Customer may object to an Annex A update and with what consequence.]
5. Subject matter and duration
5.1 Subject matter: AnswerBnB's provision of an AI-assisted guest-communication and property-operations service that can connect to the Customer's Connected Systems.
5.2 Duration: from the Effective Date (section 24) until the Customer Personal Data has been deleted or returned under section 18, or, if later, until the end of the Terms.
6. Nature and purpose of processing
6.1 AnswerBnB processes Customer Personal Data only to provide, secure, maintain and support the service for the Customer: connecting to the Customer's Connected Systems; synchronizing properties and reservations; showing reservations and conversations; classifying guest messages and drafting, checking and, where the Customer has enabled it, sending replies from the property's own knowledge; escalating to the Customer's team; storing knowledge that the Customer provides or approves; sending the notifications the Customer enables; and keeping the service secure and diagnosing faults.
6.2 Processing consists of hosting, storage, retrieval, transmission, analysis by automated means (including by an AI provider, section 10.5) and deletion. AnswerBnB does not sell Customer Personal Data.
7. Categories of personal data
The categories are set out in Annex A, part 1. Guests can write anything in a message, so the categories depend in part on what individuals choose to send.
8. Categories of data subjects
8.1 The Customer's authorized users; the Customer's guests and prospective guests; and other individuals named in reservations, messages, knowledge content or property contact details (for example co-travellers or property contacts).
8.2 The service is not designed to collect special-category personal data or children's data, and the Customer should not ask guests to provide it. [COUNSEL REVIEW REQUIRED: whether to prohibit, restrict or specially address special-category and children's data.]
9. Controller (Customer) responsibilities
9.1 For Customer Personal Data the Customer is the controller (or business) and AnswerBnB is the processor (or service provider). [COUNSEL REVIEW REQUIRED: confirm this characterization, including where the Customer is itself a processor acting for a property owner.]
9.2 The Customer is responsible for: (a) having a lawful basis and any required authority to process and to give AnswerBnB access to Customer Personal Data, including connecting each Connected System; (b) giving guests and others the notices the law requires; (c) the lawfulness of its instructions; (d) configuring the service, including which Connected Systems it connects, which properties have AI messaging turned on, and the knowledge it provides (which should not contain secrets or information the AI should not repeat); (e) supervising automated communications, as the Terms provide; (f) the security of its own Connected Systems, credentials and users; and (g) making deletion and access requests through an authorized owner of its organization. If the Customer acts for a property owner, it is responsible for its own arrangements with that owner.
10. AnswerBnB processor obligations
10.1 Documented instructions. AnswerBnB processes Customer Personal Data only on the Customer's documented instructions, which are: this Addendum, the Terms, and the Customer's use and configuration of the service. AnswerBnB may also process where the law requires it, and will then inform the Customer unless the law prohibits that. AnswerBnB will inform the Customer if it considers that an instruction infringes Applicable Data Protection Law.
10.2 Customer controls. A property's AI messaging is off until the Customer's owner turns it on. The Customer can turn AI off for its organization or a property, or mute a single conversation; a mute is re-checked immediately before each send.
10.3 Use limits. AnswerBnB does not process Customer Personal Data for its own marketing, does not sell it, and does not use it to train or fine-tune AI models. The service includes features that store answers the Customer approves as knowledge for the Customer's own properties; that is not model training.
10.4 Assistance and cooperation. AnswerBnB assists the Customer as set out in sections 16 to 19.
10.5 AI processing. Where AI messaging is enabled for a property, AnswerBnB sends the following to its AI inference provider (Groq, Annex C): the guest's message and the recent messages of the conversation; the passages of the property's own knowledge selected for the question; property location text for distance questions; and the guest's first name when a personalized closing or polished reply is generated. AnswerBnB does not add a guest's email address or phone number to AI requests; content that a guest or the Customer writes is included as written.
10.6 AI provider terms. The AI provider's published documentation states that it does not retain inference data by default, keeps system-reliability logs for up to 30 days, offers a zero-data-retention setting, and stores retained customer data in the United States; its published data processing addendum limits its processing to providing, maintaining and supporting its service on customer instructions and as law requires. AnswerBnB has not verified whether zero data retention is enabled on its account and does not represent that it is. The provider's documentation does not expressly address model training, and AnswerBnB does not authorize training. [COUNSEL REVIEW REQUIRED: whether to seek an express training prohibition from the provider or enable zero data retention before giving a stronger contractual assurance.]
10.7 AI accuracy. AI output can be inaccurate. The AI is built to hand over to a person when the property's knowledge does not support an answer, and the Customer's team can always reply.
11. Confidentiality and personnel access
11.1 AnswerBnB requires the people it authorizes to process Customer Personal Data to keep it confidential. [COUNSEL REVIEW REQUIRED: how the duty is documented (contract or law); the number of people with access and the terms on which they have it have not been verified.]
11.2 Authorized AnswerBnB personnel may access guest conversations and other Customer Personal Data when needed for support the Customer asks for, security and abuse investigation, debugging and fixing faults, and legal obligations. AnswerBnB does not use that access to read guest conversations for marketing or to build AI models.
11.3 Two different kinds of access exist, and only the first is controlled inside the application:
- Application-level (Admin View). The platform administrator can open a customer's account in a clearly marked administrative view. Each session requires a written reason of at least 10 characters (enforced by the server), lasts at most two hours, and its start and end are recorded in the audit log together with the reason. Individual pages viewed are not logged separately. A Customer's owner or administrator can also view the product as one of their own non-owner team members for testing; these sessions are recorded.
- Infrastructure-level (operator access). The people who operate AnswerBnB can access the production database, the hosting account and its runtime logs, and the authentication provider's dashboard, independently of Admin View. This access is not recorded by the AnswerBnB application and is not controlled by Admin View. Whether AnswerBnB's database and hosting providers keep access logs for AnswerBnB's accounts has not been verified.
12. Security measures
12.1 AnswerBnB implements the measures in Annex B, which lists only controls that are in place and verified. The Customer acknowledges that no system is completely secure.
12.2 AnswerBnB does not hold SOC 2, ISO 27001, HIPAA, PCI or other security certifications, has not commissioned an independent penetration test, and makes no representation of multi-factor-authentication enforcement (Annex B).
13. Subprocessors
13.1 The Subprocessors that AnswerBnB uses as of the Effective Date, what each does, the data it can receive and where, are listed in Annex C.
13.2 AnswerBnB relies on each Subprocessor's published data processing terms, which are that Subprocessor's agreements with its customers. AnswerBnB has not negotiated bespoke terms with any Subprocessor. Where Annex C says that a provider's account-specific acceptance, version or setting has not been verified, AnswerBnB does not represent it. A provider's addendum is not this Addendum. [COUNSEL REVIEW REQUIRED: how "equivalent" data protection obligations on Subprocessors are to be described when AnswerBnB relies on the providers' standard terms, and the allocation of responsibility for Subprocessors.]
13.3 Slack and Meta (WhatsApp Business, Messenger) receive escalation content only if the Customer configures them with the Customer's own credentials; they are then chosen and controlled by the Customer. [COUNSEL REVIEW REQUIRED: whether they are listed as Subprocessors or as Customer-selected services.]
13.4 The Customer's Connected Systems and Google Fonts (which serves fonts to visitors of AnswerBnB's website and receives no Customer Personal Data) are not Subprocessors of Customer Personal Data.
14. Subprocessor authorization
14.1 The Customer gives a general authorization for the Subprocessors listed in Annex C for the purposes stated there.
14.2 AnswerBnB will give the Customer notice of a new or replacement Subprocessor before it begins processing Customer Personal Data, by email to the Customer's account owner or by update to Annex C. The Customer may object on reasonable data-protection grounds. [COUNSEL REVIEW REQUIRED: the notice period (__ days), the objection window and procedure, and the remedy if the objection is not resolved. No period is stated because none has been decided.]
15. International data transfers
15.1 AnswerBnB is based in Pakistan. Customer Personal Data is processed in the locations in Annex C: Malaysia and Singapore (hosting and file backups), South Korea (database and sign-in), the United States (AI inference retained data and email, as those providers state), and the locations of the Customer's Connected Systems. AnswerBnB does not currently offer a choice of processing region.
15.2 Transfer mechanism. Where Applicable Data Protection Law requires a transfer mechanism for Customer Personal Data transferred to AnswerBnB or onward to Subprocessors, the parties will put in place and comply with the mechanism that law requires. [COUNSEL REVIEW REQUIRED: select and complete the applicable mechanism for each governing law (for example standard contractual clauses, a UK or Swiss addendum, or another recognized mechanism). None has been selected. AnswerBnB has not itself concluded any transfer instrument; the Subprocessors' published terms describe the safeguards they apply, and those are their terms.]
16. Assistance with data-subject rights
16.1 Taking into account the nature of the processing, AnswerBnB assists the Customer in responding to requests from data subjects by providing information from the service, by deleting a guest's records on the Customer's verified request, and by referring to the Customer any request AnswerBnB receives directly about Customer Personal Data.
16.2 Requests are handled by email to info@answerbnb.com and carried out by AnswerBnB manually; there is no self-service tool today. Deleting a guest removes that guest's reservations, conversations, messages, and the escalations, action items and individual learning events that referred to them. It does not remove the wording of an unanswered question that has been collected into a combined "knowledge gap" record, which is stored without the guest's identity and is removed when the organization is deleted.
16.3 [COUNSEL REVIEW REQUIRED: response time for assistance (__ days); whether assistance is charged.]
17. Security Incident and breach assistance
17.1 AnswerBnB will notify the Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data, and will provide the information reasonably available to it to help the Customer meet its own legal obligations, and will take reasonable steps to contain and mitigate the incident.
17.2 [COUNSEL REVIEW REQUIRED: a specific contractual notification period (__ hours) and minimum content. None is stated because none has been decided or is operationally guaranteed.] AnswerBnB does not currently operate a monitoring or alerting service and has no documented incident-response procedure (Annex B); the Customer should weigh that in agreeing any period.
18. Deletion and return of data
18.1 No automatic schedule. AnswerBnB has not adopted automatic deletion periods for Customer Personal Data. Reservations, guests, conversations, messages, raw notifications received from Connected Systems, synchronization, audit and email-delivery records are kept until the Customer's organization is deleted. Disconnecting a Connected System stops synchronization and notifications, asks the provider to revoke access where the provider supports it, and deletes the stored credentials; information already received stays until deleted.
18.2 Deletion on request. On the verified written request of an owner of the Customer's organization, made during the term or after termination, AnswerBnB will delete the organization from its database: properties, knowledge, reservations, guests, conversations, messages, escalations, connections and stored credentials, raw notifications, audit, synchronization and email-delivery records, and user accounts that belong to no other organization (including the authentication account, when requested). AnswerBnB does this itself with an operator tool that has been tested; AnswerBnB confirms completion in writing. There is no fixed completion time. Deleting an organization also deletes its subscription and onboarding-fee records. [COUNSEL REVIEW REQUIRED: a completion period (__ days); whether financial records must be kept separately; the default treatment if the Customer makes no request after termination (today nothing is deleted automatically).]
18.3 Return. On the Customer's verified request AnswerBnB will give the Customer a copy of its organization's information. [COUNSEL REVIEW REQUIRED: format and period. No self-service or automated export exists today.]
18.4 What deletion does not reach. (a) Backups of the database kept by the database provider, which states that it makes daily backups by default; deleted information can remain in them until they expire, and the retention period for AnswerBnB's project has not been verified. (b) The AI provider's limited retention described in section 10.6. (c) Emails already delivered to recipients. (d) Information in the Customer's own Connected Systems or on booking channels. (e) Information AnswerBnB must keep to meet a legal obligation or to establish or defend a claim. AnswerBnB does not promise that deletion instantly removes every copy from every provider's backups.
18.5 The hosting provider's backups are of the application's files and do not contain Customer Personal Data (the application writes none to disk). Customer records are held in the database provider's service, not on the hosting server.
19. Audits and compliance information
19.1 AnswerBnB will make available the information reasonably necessary to demonstrate its compliance with this Addendum, principally Annexes A to C and the evidence behind them.
19.2 [COUNSEL REVIEW REQUIRED: audit and inspection rights — whether any, frequency, notice, scope, confidentiality, who bears the cost, and whether independent reports are offered. AnswerBnB holds no third-party audit report or certification; its Subprocessors publish their own, which are not AnswerBnB's.]
20. Government and legal requests
If AnswerBnB receives a legally binding request from a public authority for Customer Personal Data, it will, where lawful, notify the Customer and refer the authority to the Customer, and will disclose only what it is legally required to disclose. [COUNSEL REVIEW REQUIRED: confirm and align with the law of Pakistan and any other applicable law.]
21. Liability relationship with the Terms
21.1 The limitation-of-liability provisions of the Terms apply to this Addendum. As of this draft the Terms limit AnswerBnB's total liability to the amount the Customer paid for the service in respect of the period in which the event giving rise to the claim occurred.
21.2 [COUNSEL REVIEW REQUIRED: whether data-protection liability is separately capped or excluded from the cap, how regulatory penalties and Subprocessor failures are treated, and any mandatory-law carve-outs.]
22. Conflict and order of precedence
22.1 If this Addendum conflicts with the Terms about the processing of Customer Personal Data, this Addendum prevails on that subject. The Privacy Policy is a description of practices and does not override this Addendum.
22.2 If the parties incorporate transfer clauses under section 15.2, those clauses prevail over this Addendum and the Terms to the extent of any conflict. [COUNSEL REVIEW REQUIRED: confirm the order of precedence.]
23. Termination
23.1 This Addendum ends when the Terms end, or, if later, when AnswerBnB has deleted or returned Customer Personal Data under section 18.
23.2 Sections 11, 18, 21 and 22 survive.
23.3 Governing law and disputes follow the Terms (currently the laws of Pakistan, without a designated court). [COUNSEL REVIEW REQUIRED: any jurisdiction-specific provisions, and whether a different governing law is required for a particular Customer.]
24. Effective date
24.1 This Addendum takes effect on the date on which the last party signs it or, if AnswerBnB has made an electronic acceptance process available for it, the date on which the Customer completes that process (the "Effective Date"). It is not effective before then and is not backdated.
24.2 It applies to processing from the Effective Date. [COUNSEL REVIEW REQUIRED: whether and how to address processing that took place before the Effective Date.]
25. Signature and electronic acceptance
25.1 Signature. The parties execute this Addendum by signing below through authorized representatives. Signed copies may be exchanged by email. Nothing is signed by, or accepted on behalf of, either party unless and until that party actually does so.
25.2 Electronic acceptance. AnswerBnB does not currently provide an electronic acceptance mechanism for this Addendum, and the Terms do not provide one. If AnswerBnB later provides one, this Addendum is accepted only when the Customer completes it, and AnswerBnB will record the date and the person who accepted. [COUNSEL REVIEW REQUIRED: whether to provide electronic acceptance and the corresponding Terms clause.]
| AnswerBnB | Customer | |
|---|---|---|
| Legal name | Answerbnb | ______________________ |
| Country | Pakistan | ______________________ |
| Authorized signatory (name) | ______________________ [COUNSEL REVIEW REQUIRED: AnswerBnB's authorized signatory and title] | ______________________ |
| Title | ______________________ | ______________________ |
| Signature | ______________________ | ______________________ |
| Date | ______________________ | ______________________ |
Annex A — Processing details
Part 1 — Categories of Customer Personal Data and data subjects
| Category | Personal data | Data subjects | Source |
|---|---|---|---|
| Account and organization | Name, email, organization name, role, membership, sign-in status. (Passwords are held by the authentication provider; AnswerBnB stores none.) | Customer's authorized users | Customer |
| Property and listing | Property names, addresses, details, house rules, listing information, contact details the Customer includes | Customer; property contacts | Customer; Connected Systems |
| Reservation | Booking status, check-in and check-out dates, guest counts, channel, confirmation codes; for some Connected Systems amounts and payment status | Guests | Connected Systems |
| Guest | Name; where the Connected System provides them, first name, email, phone and country | Guests, prospective guests | Connected Systems; guest messages |
| Guest conversations | Message content, sender, timestamps, channel, message history where provided; AI replies and human replies | Guests; Customer's staff | Connected Systems; the service |
| Knowledge base | Property knowledge, facts, FAQs and entries the Customer writes or approves; text extracted from uploaded PDF documents (the original file is discarded); text from public web pages the Customer asks AnswerBnB to read | Customer; any person named in the content | Customer; public web pages |
| AI prompts and context | Guest message and recent turns; selected knowledge passages; property location text; guest first name (polish and closing calls); instructions | Guests; Customer | Constructed by the service |
| AI records | Question, knowledge used, answer, confidence, escalation, unanswered-question ("knowledge gap") wording and approved answers | Guests (wording); Customer | The service |
| Escalation data | Property, guest name, guest question, reason, AI finding, severity, link; sent by email and, if the Customer configures them, Slack, WhatsApp or Messenger | Guests; recipients the Customer names | The service |
| Connection data | Provider credentials (API keys, OAuth tokens; stored encrypted with AES-256-GCM), connection status, synchronization history | Customer | Customer; Connected Systems |
| Technical and log data | Raw notifications received from Connected Systems (which can contain guest details); audit records (including Admin View start and end with reason); synchronization records; email-delivery records (recipient, type, status); request metadata and IP addresses handled by the hosting infrastructure; application runtime logs (errors, timings and counts; not designed to include message text) | All of the above | The service; hosting |
Part 2 — By Connected System
- GROUP 1 — Available to customers now. Properties, reservations, guest details, message history and live messages, and replies sent back through the provider: Hospitable, Hostaway, Lodgify, Beds24, Channex, Guesty, Smoobu, OwnerRez, Track, Rentals United.
- GROUP 2 — Integration built but not currently enabled for customers. No Customer Personal Data is received through these until the provider enables AnswerBnB's access; they are not represented as active processors of Customer Personal Data: iGMS, Hostfully, Octorate.
- GROUP 3 — Available to customers now. Properties, reservations and guest details, but no messages and no replies (the provider's interface does not offer them): Cloudbeds, Uplisting.
- GROUP 4 — Property details only (no guest details, no messages). Tokeet is available to customers now; Escapia is not currently enabled for customers until the provider enables AnswerBnB's access: Tokeet, Escapia.
- GROUP 5 — No integration exists; no data is received: Avantio, Hostify, Streamline.
Guest fields the integrations map (Group 1 unless noted): name, email and phone by all; first name by Hostaway, Channex, OwnerRez, Track, Rentals United (and by Cloudbeds in Group 3); country by Lodgify (and by Cloudbeds in Group 3); financial fields by Hostaway, Lodgify, Rentals United (and by Cloudbeds in Group 3). Uplisting (Group 3) maps name, email and phone. AnswerBnB sends a booking-inquiry approval or pre-approval to Guesty only. AnswerBnB does not create bookings, take guest payments or change rates through any integration.
Part 3 — Duration and frequency. From the Effective Date for the term of the Terms; continuous. AnswerBnB checks connected accounts for new messages every 5 minutes and also receives provider notifications where the integration supports them. Retention: until deletion under section 18; there is no automatic deletion schedule.
Annex B — Technical and organizational security measures
Only controls that exist and are verified.
| Area | Measure |
|---|---|
| Encryption in transit | HTTPS for the website and application; HTTP requests redirect to HTTPS |
| Encryption of credentials | Provider credentials (API keys, OAuth tokens) are encrypted with AES-256-GCM before storage; the key is held in server-side configuration and never sent to browsers |
| Authentication | Supabase Auth, a maintained authentication provider. AnswerBnB stores no passwords (at signup a password passes through the server in memory and is not stored or logged) |
| Authorization | Every signed-in request is checked on the server against the caller's organization membership and role; a browser-supplied organization identifier is never trusted alone; requests for another organization return 403 |
| Organization isolation | Queries for customer data are scoped by organization in application code. Database row-level security policies also exist as an additional layer for other ways of reaching the database, but the application's own database connection uses a role that bypasses them, so AnswerBnB does not rely on them as its tenant protection; the application-level checks above are the primary control |
| Secrets | AI, database, service-role and encryption keys are held in server-side configuration and are never sent to browsers |
| Connection safety | OAuth state is HMAC-signed with a server-only key with a 10-minute expiry, per provider and organization; provider webhook signatures are verified where the provider documents a scheme; a revoked or rejected credential moves that one organization's connection to "needs attention" and stops polling with it |
| Outbound fetch safety | Public web pages the Customer asks AnswerBnB to read are fetched over HTTPS only, refusing private or internal addresses and credentials in URLs, with size and time limits, honouring robots.txt |
| AI controls | AI is off by default per property; organization-level switch; per-conversation mute re-checked before every send; escalation to a person when knowledge does not support an answer; duplicate-message suppression |
| Personnel access — application | Admin View: platform administrator only; a written reason of at least 10 characters enforced by the server; a maximum two-hour session; start and end recorded in the audit log with the reason. Customer owners and administrators can test-as a non-owner member; recorded |
| Personnel access — infrastructure | People who operate AnswerBnB can access the production database, hosting account, runtime logs and the authentication provider's dashboard. Not recorded by the application and not controlled by Admin View. Provider-side access logging has not been verified |
| Logging and audit | Audit records of escalations, AI decisions, integration events and Admin View; application logs record errors, timings and counts |
| Deletion | Tested operator tool for organization and guest deletion (section 18) |
| Backups | Database: provider-managed; daily by default per the provider, retention for AnswerBnB's project has not been verified. Hosting: daily file backups kept for the last 7 days per the hosting provider's documentation; files only, no customer records |
| Availability | Background polling starts when the server starts and recovers itself; no uptime commitment is made |
| Not held / not represented | SOC 2, ISO 27001, HIPAA, PCI or GDPR certification; an independent penetration test; enforced multi-factor authentication; a formal incident-response plan; a monitoring or alerting service |
Annex C — Subprocessors and other providers
Status wording: "documented" means AnswerBnB has read the provider's published terms. "Not verified" means AnswerBnB has not confirmed that setting, version or acceptance for its own account and does not represent it.
| Provider | Service | Data processed | Location | DPA / agreement status |
|---|---|---|---|---|
| Hostinger | Infrastructure and web hosting of the application and website; edge network; daily file backups; runtime logs | Data passing through the application server while a request is processed (in transit and in memory); visitors' IP addresses; runtime logs. The customer database is not on Hostinger: it is in Supabase, and the application writes no customer records to the hosting disk | Server: Malaysia. File backups: Singapore (both as shown in the hosting account) | Hostinger publishes its own Data Processing Addendum (processor terms; incorporated by reference in Hostinger's Terms "if applicable"; standard contractual clauses; deletion 30 days after termination; revised 2026-09-15). This is Hostinger's agreement with its own customer — provider DPA evidence only. It is not AnswerBnB's DPA and does not replace it. Account-specific applicability and the DPA version accepted are not independently verified |
| Supabase | Database (Postgres) and authentication | All Customer Personal Data stored by AnswerBnB; provider credentials only in encrypted form; sign-in data including a password hash | AWS Asia Pacific (Seoul), ap-northeast-2 (verified from the production configuration) | Supabase publishes its own Data Processing Addendum (processor terms; standard contractual clauses; deletion after a 30-day retrieval period), documented. Account-specific acceptance, plan tier and backup retention for AnswerBnB's project are not verified |
| Groq | AI inference (reading guest messages, drafting and checking replies). Model: openai/gpt-oss-120b | The content in section 10.5 | United States for retained customer data, per Groq's documentation; other processing locations not stated | Groq publishes its own Data Processing Addendum (processor; standard contractual clauses; deletion within 180 days after termination), documented. Whether zero data retention is enabled on AnswerBnB's account is not verified; AnswerBnB does not claim it is enabled. Account-specific acceptance not verified |
| Resend | Transactional email: sign-up verification, password reset, invitations, welcome messages, escalation notifications | Recipient email address and email content (for an escalation: property name, guest name, the guest's question, the AI's finding) | Resend states its primary operations are in the United States. AnswerBnB's account region and email retention are not verified | Resend publishes its own Data Processing Addendum (processor for the content it sends; standard contractual clauses; EU-US Data Privacy Framework; deletion within 90 days after account termination), documented. Account-specific acceptance not verified |
| Google (Google Fonts) | Delivers the website's typefaces to visitors' browsers. Website-visitor request processing only; not a processor of Customer Personal Data | A visitor's IP address and browser details when a page loads. No account or guest information | Google's global network; not verified | Google's terms have not been reviewed. Independent service. Retention not stated and not claimed |
| Slack; Meta (WhatsApp Business, Messenger) | Optional escalation notifications. Only when the Customer enables and configures them with the Customer's own credentials | An escalation summary (property, guest name, guest question, AI finding) sent to the workspace or recipients the Customer chooses | Provider-controlled; not verified | Provider terms have not been reviewed. Chosen and controlled by the Customer. Retention and location not stated and not claimed |
The Customer's own Connected Systems (Annex A, part 2) are not Subprocessors. AnswerBnB does not currently use advertising, analytics, session-recording or error-monitoring tools, a payment processor, or separate file storage.