Skip to content
Guester
ENTR
Book a demo
Legal documents

Subprocessors and Data Flows

Data sources, private cloud/data-centre infrastructure in Türkiye and information received by external services.

Version 3.3Document date:

Provider: The Artifics (pre-formation brand); privacy contact: info@theartifics.com. Guester is The Artifics' hotel software service. This is version 3.3 (13 October 2026), based on the 12 October technical inventory and subsequent confirmed operational information. Listing a service does not mean it is enabled for every hotel. Modules, properties, accounts and permissions are determined by customer-account activation records.

Private cloud/infrastructure providers, data-centre operators, model/content processors, Hotel-connected services and public sources have different roles. A headquarters country does not identify every processing, storage or remote-access location. This page is neither a platform data-collection licence nor a Turkish international-transfer instrument. A personal-data route lacking its required conditions must not be used.

Guester’s application and data-processing infrastructure operates on private cloud clusters and is not described as a shared website hosting package. Primary MariaDB/Redis, review SQLite files and PMS reports are held on infrastructure supplied through Sunucun Bilgi İletişim Teknolojileri ve Ticaret Ltd. Şti. The operator/provider inventory identifies its physical location as Mars Datacenter Istanbul-1, operated by Mars Veri Merkezi A.Ş. Infrastructure supplied through Netlen İnternet Hizmetleri Ltd. Şti. supports panel, portal/backoffice presentation and website/WordPress services; its recorded physical location is DATACASA Istanbul-1, operated by Datema Bilişim Ticaret A.Ş.

The panel frontend displays data received from the API and does not hold an independent persistent PMS/hotel database. This does not mean it performs no processing: display and transmission, sessions, browser memory/cache and technical records may involve relevant personal data. Website application and WordPress records are distinct from this frontend description and are assessed for their own controller purposes.

The infrastructure provider and physical data-centre operator are separate organisations. Naming the physical facility does not establish its operator as the sole or principal processor; storage, maintenance/support, access, security and contractual roles are established through the actual service chain. Private cloud alone does not guarantee customer-dedicated physical hardware, a particular isolation level or uninterrupted service. Tier/ISO statements may be used only within the relevant facility’s verified certification scope and validity; no uniform certification is attributed to the entire Guester service or every data centre. This inventory does not provide a blanket Tier III/ISO certification guarantee. Physical locations in Türkiye do not prevent processing outside Türkiye through Cloudflare, AI or other external-service routes.

Mars Veri Merkezi A.Ş. lists ISO standards concerning information security, business continuity, cloud security and privacy management on its official certifications and quality-assurance page. DATACASA publishes infrastructure information on its official website. Certification scope and validity are assessed using current provider documents; a public list of standards does not itself establish a valid certificate for a particular facility or the Guester application.

The Oracle OPERA 5 SFTP route receives XML reports from a hotel's own PMS to the API server. This active route can contain guest names, reservations, rooms, rates and country statistics; its primary direction is Hotel to Guester. Some hotels' PMS fields may also include nationality/birth dates; each property's field map is separately established. A local import does not guarantee that another module never sends the data to AI or international integrations.

Cloudflare Inc. (headquarters: US) is an active Workers AI provider. Functions include review themes/sentiment, translation, draft replies, staff-review matching, room-type normalisation and event text. Depending on the function, input includes review text/excerpts, reviewer names, hotel names/notes and staff names, roles and departments. Truncation does not necessarily remove personal-data status. Active-model licences and service/account terms require separate assessment.

Cloudflare reverse-proxy/CDN operates in front of dashboard.guester.co and backoffice.guester.co. TLS terminates at Cloudflare, so IPs, session cookies and guest/reservation/lead content included in that traffic pass through the service. This is more than DNS. The inventory identifies api.guester.co and guester.co as direct/DNS-only; that distinction does not remove content sent to model APIs. Actual network regions and retention/access settings cannot be inferred from headquarters.

Google Gemini-based guester-ai panel chat is active (Google headquarters: US): user messages and added hotel context are sent to the model. The complete context fields must be established for each service version; no blanket claim is made that all PMS fields remain internal. Other direct Gemini branches may use hotel name, city, room count and check-in/out times; enabled email automation may process sender, subject, body, history and rates/availability. Email-automation activation is account-specific.

OpenRouter Inc. (headquarters: US) is an active multi-model AI intermediary and routing service. Models used may include Google/Gemini and Anthropic/Claude; processing scope depends on the selected model, module and Hotel authority. Review replies and enabled Google Business Profile reply routes may use review text/reviewer name, hotel name and authorised notes; other active AI functions may process user messages and necessary PMS/hotel context. Which recipient receives PMS name, room, country/nationality or date-of-birth fields is established per function; not all fields are assumed to reach every model. A Gemini default recorded in code is not a fixed list of all models or recipients actually used. Cloudflare fallback on error/quota may operate according to configuration.

Use of an Anthropic/Claude model through OpenRouter does not establish a direct contract with Anthropic. The actual inference provider/endpoint, other infrastructure parties serving the model, data fields and processing/access countries are established from routing records and applicable service terms. Depending on the actual endpoint, a Claude model may be served by Anthropic’s own service or another inference provider’s infrastructure; not every Claude call is assumed to reach Anthropic. Neither the model brand nor a provider’s headquarters alone identifies this chain. No blanket security guarantee is made about training, logging/retention, zero retention or paid/unpaid-account conditions without verification; automatic routing to an unapproved recipient is prohibited.

Other AI providers, such as OpenAI, may be evaluated in the future; OpenAI is not a confirmed active recipient in this version. Before a new route containing personal data is enabled, the DPA’s notice/objection process and conditions for the actual recipient, countries, data scope, contractual terms, transfers and technical controls are satisfied and the list updated. Flexibility to choose future providers is not unlimited advance authority for an unidentified recipient.

The Channex.io Ltd. channel integration is active (headquarters: UK). For authorised properties it may receive property, room-type, rate-plan and ARI (rates/availability/restrictions) information; reservation webhook/feed data may include guest full name, email, phone and country. Fields and read/write permissions depend on the property's enabled connection. Country is not assumed to mean nationality. Masking a cardholder field does not bring full card/CVV processing into service scope.

Channex's onward OTA routes and subprocessors must also be assessed. Connecting a hotel's account is not permission to collect competitor pages. Writing rates or availability to external channels requires function-specific action authority and limits beyond analysis. Oracle OHIP is used only where enabled for a selected property; client/property identifiers and queries can retrieve reservations, housekeeping and revenue information. Active OPERA SFTP does not establish active OHIP for every hotel.

Our Playwright-based collection route uses Booking.com, Agoda, Google, Trip.com, Expedia/Hotels.com and TripAdvisor pages for own/competitor hotel reviews and rates. Requests include hotel identifiers/slugs and dates; responses can include reviewer names, text and rates. These platforms are sources and do not all become Guester subprocessors merely because listed. A public quoted rate is not realised ADR or verified revenue.

Apify Technologies s.r.o. (headquarters: Czechia) and selected Actors collect Expedia, Hotels.com and TripAdvisor reviews. Standard inputs are hotel URLs/OTA identifiers and Actor parameters, not PMS/guest files. Reviewer names and text are received and may be processed by the collection service. Actor developer, version, logs/datasets and retention routes require separate identification; URL-only input does not mean the entire process contains no personal data.

An enabled proxy pool relays target-address/business queries; no blanket claim that every proxy sees no personal data is made before the actual provider and traffic-access scope are verified. DuckDuckGo may provide fallback hotel-URL search. Source permissions, intellectual property, contractual terms and personal-data bases remain separate; this page does not authorise bypassing access restrictions.

SMTP/IMAP and surveys open with the hotel's connected email account and may process guest/staff email addresses, names, messages and survey links. Selecting Gmail/Google or Microsoft 365/Graph (US headquarters), Yandex (Russia headquarters) or another mail service creates different recipients/locations. One hotel's choice does not enable that transfer for every hotel. OAuth email automation and ordinary SMTP have different permissions and scope.

Enabled Google Business Profile/OAuth uses authorisation tokens and account email; reviews/names are received and replies are sent to the relevant Google service. Account connection is not unrestricted authority to publish automatic replies. An external AI client connected using the hotel's MCP token may request review/reservation summaries, initials, PMS summaries and rates. For example, a claude.ai/Anthropic connection enabled by the Hotel is this external client route; it is separate from the Claude model use through OpenRouter described above and is activated separately. Masking does not always prevent re-identification.

Google Places API (New) is used only where its key/feature is enabled. Business/hotel search or matching queries and related technical request information may be sent to Google; standard search input is not a PMS/guest file. Activation, exact query fields and the actual service/country scope are established separately; listing this conditional route does not establish activation for every Hotel.

OpenFreeMap on studio maps, Esri ArcGIS on guest guide maps, and remote Unsplash/picsum.photos/Wikimedia images may receive user/guest browser IPs, displayed coordinates and relevant referrers. Map/image requests may process personal data without cookies. User-clicked WhatsApp sharing transmits survey/message text; Google/TripAdvisor navigation creates browser traffic to those services. Their own policies also apply.

Ticketmaster city events, Open-Meteo city/coordinate weather, Frankfurter currency conversion and Turkish industry/event sources provide content using business/city/currency queries. Their standard functions do not receive PMS files. Panel fonts are local; the product inventory does not identify panel analytics/Sentry/GTM. That finding cannot be extended to WordPress website forms/plugins.

Our self-hosted Uptime Kuma monitors availability. GitHub stores source code rather than providing a standard runtime PMS route. External monitoring such as PM2 Plus/Keymetrics is a recipient only if actually enabled and appropriate conditions cover logs that may contain personal data. Domain certificate services are assessed separately from private cloud infrastructure and model-content services. Application secrets and guest files are not placed in source repositories.

Each personal-data recipient requires defined roles, fields/purposes, processing/access locations, contracts, transfer mechanisms and retention/deletion conditions. Specific periods or zero retention are not claimed without verification. Subprocessor changes follow DPA notice/objection rules. A new international route or expanded scope opens only after required instructions and legal conditions; updating this page alone creates no authority.

Google Site Kit/Analytics and Google Ads tags are configured on the Guester website for use and advertising/campaign measurement; the panel’s no-tracking finding does not apply. An enabled package may transmit connection, page/interaction, measurement/advertising identifiers and conversion data to Google. First-party guester_attr is optional statistics; a permitted record may accompany an application or booking. “Analytics only” opens this local recording, not the shared Google Analytics/Ads package. That package requires a choice permitting both statistics and marketing. A Consent Mode signal alone does not prove every external request is blocked.

Cal.com, Inc.’s app.cal.com service schedules Guester demos and may process names, emails, appointment details, technical connection information and permitted campaign sources. Its published policy describes US processing, subprocessors elsewhere and processing booking data on customer instructions. Actual account/plan, connected calendars/video services and applicable DPA/transfer arrangements require separate establishment. A general provider policy does not automatically satisfy Turkish transfer conditions.

Founding applications create private WordPress records containing name/hotel/email/business phone/room count, language/channel, permitted campaign data, browser information and a short salted IP digest. The selected mail route delivers notifications and acknowledgments. The Founding external CRM/webhook route is disabled in this version; any future activation requires prior recipient/scope identification, contract/transfer conditions and disclosure. Application data has different purposes and lifecycles from PMS files.

All legal documents Back to document top