Legal
Sub-processor List
Version 1.0 · Effective 1 September 2026
Permanent URL of this version: https://www.oasisguestlab.ai/legal/sub-processors/v1.0/ Current version always at: https://www.oasisguestlab.ai/legal/sub-processors/
What this document is
This is the list of third parties that process personal data on our behalf when we provide Oasis Guest Lab to a client. It is a separate document with its own version number and its own URL so that it can change without reopening the Data Processing Addendum.
It is referred to in clause 8.4 of the Data Processing Addendum. That clause is the one that matters commercially: we give clients at least 30 days' written notice by email before adding or replacing a sub-processor, clients may object on reasonable data protection grounds, and if we cannot resolve an objection the client may terminate the affected part of the Service without penalty and be refunded fees paid for any period after termination.
This list contains only providers we can actually evidence in the Oasis Guest Lab product. It does not contain providers we might use, are considering, or use on another of our services. If a provider is not on this list, it does not receive personal data through Oasis Guest Lab.
The list
1. Meta Platforms (WhatsApp Business Platform)
| What it does | Transports guest messages. Every message between a guest and a connected number travels through Meta's WhatsApp infrastructure. Meta also holds the WhatsApp Business Account, the phone number registration, the display name and the message templates |
| Personal data it processes | Guest phone number, WhatsApp profile name, message content, delivery and read status, timestamps |
| Where it processes | Meta's global infrastructure, including the United States |
| Relationship | Meta is the platform on which the WhatsApp channel exists. It is a necessary recipient of every message. Meta's own terms and privacy documentation govern its handling of the data on its platform |
| Model training | We do not permit WhatsApp data to be used for advertising. Meta's use of business messaging data is governed by Meta's own terms, which we do not control |
| Can it be removed? | No. There is no WhatsApp service without Meta |
2. 360dialog
| What it does | Our WhatsApp Business Solution Provider. Provides the official WhatsApp Business API connectivity through which our platform sends and receives messages, and handles number registration and template submission |
| Personal data it processes | Guest phone number, WhatsApp profile name, message content in transit, delivery status, timestamps |
| Where it processes | European Union. [TO CONFIRM: the current processing region and entity stated in 360dialog's own data processing terms, to be verified against their live documentation before publication] |
| Relationship | Sub-processor under a written contract |
| Why it is here | We use the official WhatsApp Business API through an authorised Business Solution Provider. We do not use unofficial gateways or unofficial clients |
| Can it be removed? | Only by replacing it with another authorised Business Solution Provider, which would be a change under clause 8.4 of the Data Processing Addendum |
3. OpenAI
| What it does | Generates the AI replies. When a guest message arrives, the message and the relevant context from that unit's knowledge layer are submitted to OpenAI's API, which returns a draft reply |
| Personal data it processes | The content of the guest message, which may include the guest's name and anything else the guest writes, together with the unit context sent with it |
| Where it processes | The United States. OpenAI is established in the United States. [TO CONFIRM: whether a regional or zero-data-retention processing option is in use on our account, and if so, which] |
| Relationship | Sub-processor under OpenAI's business terms and data processing addendum |
| Model training | We engage AI providers only on terms that do not permit the provider to use content submitted through the Service to train the provider's own models. [TO CONFIRM: written confirmation of this position on our current account tier before publication.] If that position ever changes for a provider we use, we will state it here plainly and treat it as a change requiring 30 days' notice |
| Transfer mechanism | Guest data reaches OpenAI from our EU-hosted platform. Where the GDPR applies, we rely on the standard contractual clauses adopted by the European Commission, in the module appropriate to the relationship. Where the UAE PDPL applies, we rely on the contractual commitments in the provider's data processing terms. We do not claim that OpenAI holds any particular privacy framework certification |
| Can it be removed? | Replacing the AI provider is possible in principle and would be a change under clause 8.4 |
4. Hetzner
| What it does | Hosting. Our servers, our databases, our self-hosted Chatwoot instance and our stored conversation history all sit on infrastructure operated by Hetzner |
| Personal data it processes | All personal data held by the Service at rest: message content, phone numbers, names, booking data, conversation history, dashboard user records |
| Where it processes | The European Union. This is where guest and unit data is stored. It is not stored in the United Arab Emirates |
| Relationship | Sub-processor under Hetzner's data processing agreement |
| Note | Hetzner is an infrastructure provider. It does not access the content of the data; it provides the servers and the data centres |
| Can it be removed? | Replacing the host is possible and would be a change under clause 8.4. It would also be the change most likely to alter the answer on data residency |
5. Chatwoot
| What it does | The operator dashboard. This is where a client's team reads conversations, takes over from the AI, and continues the thread in the same WhatsApp conversation |
| Personal data it processes | Message content, guest phone number and profile name, conversation history, escalation labels, dashboard user accounts and action logs |
| Where it processes | Nowhere outside our own infrastructure. Chatwoot is open-source software and we run it self-hosted on our own servers at Hetzner in the European Union |
| Relationship | This entry is a software component, not a data recipient. Chatwoot Inc. does not receive client or guest data under this deployment, because we do not use their hosted cloud product. It is listed for completeness and transparency, because the software is a third-party component of the Service and because clients ask |
| What would change this | If we ever moved to Chatwoot's hosted cloud service, Chatwoot Inc. would become a genuine sub-processor receiving guest data, and that would require 30 days' notice under clause 8.4 |
6. Hostaway
| What it does | Property management system integration. Where a client connects Hostaway, bookings flow from Hostaway into Oasis Guest Lab so that the AI knows who is arriving, at which unit and when, before the guest sends a message |
| Personal data it processes | Guest name, phone number, unit, check-in and check-out dates, booking source and booking reference |
| Where it processes | [TO CONFIRM: Hostaway's current processing locations, to be taken from Hostaway's own sub-processor documentation before publication. We will not state a location we have not verified] |
| Relationship | This one is different, and clients should understand the difference. Hostaway is the client's own provider under the client's own contract with Hostaway. The client instructs the connection. In that flow Hostaway is the source and we are the recipient, so for booking data we receive from Hostaway, Hostaway is not acting as our sub-processor: it is acting for the client. Where we send anything back to Hostaway, we do so on the client's instruction |
| Optional? | Yes. This integration only exists if the client connects it. A client that does not use Hostaway has no data flowing to or from it |
Providers we do not use
For the avoidance of doubt, and because it is easier to check a stated negative than an unstated one, Oasis Guest Lab does not use, and no personal data flows to:
- any analytics product, including Google Analytics, Google Tag Manager, Plausible, Matomo and Fathom;
- any advertising or tracking network;
- any payment processor within the Service;
- any CRM, marketing automation, email service provider or form backend;
- any hosted customer support desk other than the self-hosted Chatwoot instance described above.
Our website sets no cookies and stores nothing in your browser. It does load web fonts from Google Fonts, which discloses your IP address to Google on page load. That is a website matter rather than a Service matter and it is covered in the Cookie Policy, not here, because it does not involve guest or client data processed on a client's instructions.
Notice and objection, in short
- We publish a new version of this list before a change takes effect.
- We email every client at least 30 days beforehand.
- A client may object in writing on reasonable data protection grounds within those 30 days.
- We try to resolve the objection, which may mean not using that provider for that client's data.
- If we cannot resolve it within 30 days, the client may terminate the affected part of the Service, or the whole agreement, without penalty, and we refund fees paid for any period after termination.
- Where a change is urgent and necessary to keep the Service secure or lawful, we may make it faster, tell the client as soon as we can, and explain why. The objection right is unaffected.
Third-party marks
Third-party names, logos and trademarks are the property of their respective owners. Their appearance on this site indicates the tools and platforms we work with. It does not imply any endorsement, sponsorship or affiliation beyond any partner status we expressly state and hold.
This document has been prepared for review and requires sign-off by a qualified UAE lawyer before publication. It is not legal advice.