In short
- The public website, free check, business checkout and order-status database run on Cloudflare.
- The free check uses Cloudflare Workers AI. It does not send the visitor to OpenAI, Anthropic, Google or Perplexity.
- Those four assistants may be tested during an accepted full project using only guest-style questions and necessary public hotel information.
- Mollie's hosted checkout processes the €499 payment after the buyer supplies the business and billing details to Staedy.
Roles depend on the service. A provider may be a processor for Staedy and separately act as a controller for its own account, security or legal duties.
Public website, check and onboarding
Cloudflare, Inc. and Cloudflare group companies
- Services
- DNS, content delivery, Workers runtime, static assets, rate limiting, security and operational logs, D1 database, Workers AI and email routing.
- Data
- Connection and security data; submitted hotel URL; bounded public page text processed for the live check; generated check output; business contact, company, billing and VAT details; confirmations; order, payment-reference, timestamp and status data.
- Role
- Processor for Staedy customer content and service data under Cloudflare's customer data-processing addendum; Cloudflare may be an independent controller for the limited purposes stated in its own privacy policy.
- Location
- Global network. The checkout D1 database is configured with Cloudflare's EU jurisdiction. Edge and Workers AI processing are not represented as EU-only.
- Transfer safeguard
- Cloudflare's Data Processing Addendum, including the applicable EU Standard Contractual Clauses under Art. 46 GDPR and the safeguards described there.
- Training
- Cloudflare states that Workers AI customer content is not used to train models or improve Cloudflare or third-party services without explicit consent.
The public check currently runs the Cloudflare-hosted model identified in the service configuration as @cf/meta/llama-3.1-8b-instruct-fast. Meta supplies the model software; the inference request is made through the Cloudflare Workers AI binding.
AI services used in accepted full projects
Where the confirmed project method includes recording how named assistants answer guest-style questions, Staedy may use the providers below. The input is limited to the question and public hotel or market information necessary to run it. Customer email addresses, billing data, credentials, unpublished assets, private feedback and guest records are excluded.
OpenAI Ireland Ltd. / OpenAI, L.L.C.
- Purpose
- API-based measurement of ChatGPT-style answers and cited sources.
- Location
- EEA and United States, depending on the contracted service and configuration.
- Safeguard
- Provider business/API data terms and the applicable adequacy or Standard Contractual Clause route documented before use.
Google Ireland Ltd. / Google LLC
- Purpose
- API-based measurement of Gemini answers and sources.
- Location
- EEA and United States, depending on the contracted service and configuration.
- Safeguard
- Provider data-processing terms and the applicable adequacy or Standard Contractual Clause route documented before use.
Anthropic Ireland, Ltd. / Anthropic PBC
- Purpose
- API-based measurement of Claude answers and sources.
- Location
- EEA and United States, depending on the contracted service and configuration.
- Safeguard
- Provider commercial/API data terms and the applicable adequacy or Standard Contractual Clause route documented before use.
Perplexity AI, Inc.
- Purpose
- API-based measurement of Perplexity answers and sources.
- Location
- United States.
- Safeguard
- Provider enterprise/API terms and a documented Art. 46 transfer route before personal data is submitted.
Staedy uses business or API settings intended to prevent submitted project content from being used to train provider models. If a provider cannot be used under the documented contractual and transfer controls, that provider is omitted and the failure or omission remains visible in the project record.
Payment, invoicing and business account
Mollie B.V. and applicable payment intermediaries
- Purpose
- Hosted payment-method selection, transaction processing, authentication, fraud prevention, payment status, refunds and chargebacks for the one-off €499 order.
- Data sent by Staedy
- Buyer's first and last name, work email, billing street, postal code, city and country, €499 amount and random order reference. The legal business name and VAT ID remain in Staedy's D1 record.
- Data collected by Mollie
- Selected payment method, payment account or card information, IP address, browser/device, authentication, risk and transaction data as applicable. Staedy receives only the transaction reference, method and status required for reconciliation.
- Role
- Independent controller for regulated payment processing, fraud prevention and legal duties under Mollie's user agreement and privacy notice.
- Location and transfers
- Mollie B.V. is established in the Netherlands. Payment methods can involve banks, card schemes and other intermediaries; applicable locations and transfer safeguards are described in Mollie's privacy notice.
Qonto (Olinda SAS and applicable group entity)
- Purpose
- Business account, payment administration and electronic invoices after a project is accepted.
- Data
- Business and billing identity, address, VAT information, invoice amount, payment reference and status.
- Role
- Independent controller for regulated payment, fraud-prevention, anti-money-laundering and legal duties; processor only where its service terms expressly assign that role.
- Location
- France and the EEA, subject to Qonto's current terms and provider list.
Staedy's form collects the business and billing record but never payment-card or bank-login data. Those details are entered directly in Mollie's hosted checkout after the buyer continues to payment.
Other recipients
Data may also be disclosed to professional legal, tax or security advisers bound by confidentiality; a website platform or developer expressly chosen by the customer for an approved release; and a public authority where disclosure is legally required.
Provider changes
Material provider or transfer changes are published here before they are used for new project data where practicable. Active customers may ask to be notified and may object on reasonable data-protection grounds by emailing privacy@staedy.com.