Legal
Sub-processor List
Archived at /legal/sub-processors/v1.0/. This version is never overwritten in place. Published under clause 7 of the Data Processing Addendum, which requires 30 days' written notice before a sub-processor is added or replaced.
Lux Oasis Advisory & Services LLC, a company registered in the Sharjah Free Zone (SHAMS), United Arab Emirates, licence number 2645909, TRN 104722180700003 ("we", "us", "our").
01How to read this list
This list contains only the providers that Oasis Revenue Lab actually uses in delivering the service. It does not list every company whose name appears in our marketing.
It separates two things that are often confused:
- Our sub-processors. Providers we engage, on our contract, to help deliver the service. We are responsible to you for them.
- Your own platforms. Accounts you hold on your own contract, which we access with your permission. They are your suppliers, not ours. We are not responsible for them.
Where a location is marked as requiring verification, that is deliberate. We will not state a processing location we have not confirmed against the provider's current documentation. Every such entry must be confirmed and the placeholder removed before this document is published.
02Our sub-processors
| Provider | What it does for the service | Personal data involved | Where it processes |
|---|---|---|---|
| Anthropic (Claude) | The reasoning engine behind the AI agent. Portfolio figures, market context and the text of your questions are sent to it so that the agent can analyse them and draft the briefing and its answers. | Free-text content of your questions and messages, which can contain personal data if you put it there. Portfolio and rate data. We do not send guest identity data to it. | [PLACEHOLDER: confirm against Anthropic's current documentation. Anthropic is established in the United States; the regions in which the interface we use processes and stores data must be verified and stated here.] |
| Telegram | The delivery channel. Briefings, alerts and answers are sent to you through it, and your questions come to us through it. | Your Telegram handle and user identifier, and the content of the messages exchanged. | [PLACEHOLDER: confirm and state. Telegram operates a distributed infrastructure and the operating entity and storage locations must be verified before this is published.] |
| PriceLabs | The pricing engine. We read your listing configuration, prices, minimum prices and market data from it, and where you have bought a managed service we also change settings in it. | Listing and rate data. Personal data only where a listing or account name identifies an individual. | [PLACEHOLDER: confirm and state. PriceLabs is established in the United States.] |
| Hostaway | The property management system integration. We read reservation and outcome data from it so the agent can measure what actually happened. | Reservation records, which can include guest name, guest contact details, stay dates and rate paid. | [PLACEHOLDER: confirm and state. Hostaway is established in North America.] |
| Airbtics | Market data. Forward booking pace and Dubai market identifiers used to give demand context in the briefing. | None of yours. We send it market and location parameters, not your client or guest data. | [PLACEHOLDER: confirm and state.] |
| Brave Search | Events and news context feeding the daily interpretation. | None of yours. We send search queries about events, news and market conditions, not your data. | [PLACEHOLDER: confirm and state. Brave is established in the United States.] |
Notes on the table
PriceLabs and Hostaway appear twice in your commercial life. Where you hold the account and we access it under your permission, they are your platforms, listed in section 3, and their terms with you govern. Where we send data to them as part of delivering our own service, they are our sub-processors, listed above. Both are true at once, and the practical effect is that revoking our access under clause 7.4 of the Terms of Service stops the first but not the second.
Airbtics and Brave Search receive no client data. They are listed for completeness because they are live in the service and because their output shapes the advice you receive. If that changes, this list changes and clause 7.2 of the Data Processing Addendum applies.
03Your own platforms, which are not our sub-processors
| Platform | Relationship |
|---|---|
| PriceLabs | Your account, your contract, your fees. We access it with your permission at the level recorded on the Order Form. |
| Hostaway or another property management system | Your account, your contract, your fees. |
| Airbnb | Your account, your contract. We do not access it unless the Order Form says we do. |
| Booking.com | Your account, your contract. We do not access it unless the Order Form says we do. |
You are responsible for holding these accounts, for complying with their terms, and for the consequences if they are suspended, changed or withdrawn. We are not a party to them and we give no undertaking about them.
04Recipients on our website that are not sub-processors
These receive your IP address when you load a page, because of how the page is built. They are not given any data you enter and they are not part of the service.
| Recipient | Why | Effect |
|---|---|---|
| Google (Google Fonts) | Web fonts are loaded from fonts.googleapis.com and fonts.gstatic.com on every page, including the legal pages. | Your browser makes a request to Google's servers, disclosing your IP address and basic request data. |
PriceLabs RM Partners Directory (pricelabs-rmpartners.directoryup.com) | The partner badge image and link are served from the directory rather than from our own site. | Loading a page carrying the badge discloses your IP address to that host. |
The Cookie Policy covers this in full.
05Providers named in our documents that we do not currently use
Slack. Our previous terms named Slack as an alternative briefing channel. We do not currently deliver briefings on Slack and Slack is not a sub-processor. If a client asks for it, it becomes one, and clause 7.2 of the Data Processing Addendum applies before it is used.
06Cross-border transfers
Several of the providers above are established outside the United Arab Emirates, so processing your data means transferring it outside the UAE.
For those transfers we rely on contractual protections in our agreement with the recipient and, where the recipient offers them, on that recipient's own standard data protection clauses. Where you are subject to the EU or UK GDPR in your own right, we will enter into the relevant standard contractual clauses with you on request.
We do not hold, and do not rely on, any adequacy decision or any certification. The UAE transfer regime under Federal Decree-Law No. 45 of 2021 depends on executive regulations, and we do not claim certainty about a regime that is not yet settled. When it is settled we will update this document and tell active clients.
07Changes
We give at least 30 days' written notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds, and if we cannot resolve the objection you may terminate the affected service without penalty. Every version of this list is archived at its permanent URL.
This document has been prepared for review and requires sign-off by a qualified UAE lawyer before publication. It is not legal advice.