Subprocessors

GetThere's subprocessors

Updated 20 October 2026 · Draft for legal review

GetThere runs the Flight Delay Pass for each Underwriter, which is responsible for its travellers' data. These providers process that data for GetThere, under contracts that hold them to the same standard. Each Underwriter's Privacy Notice links this page, and so does GetThere's privacy notice.

• Render: hosting, database and file storage. Data: everything GetThere keeps. Where: Singapore.
• Postmark: sending and receiving email. Data: forwarded bookings, and the emails we send. Where: United States.
• Twilio: WhatsApp messages and phone checks. Data: mobile number, and the messages we send. Where: United States.
• Meta (WhatsApp), through Twilio: delivering our WhatsApp messages. Data: mobile number, and the messages we send. Where: United States, and other countries it operates in.
• Stripe: payments. Data: card details you type at checkout, name, email, amount. Where: United States.
• Airwallex: issuing pre-loaded rescue cards, identity and sanctions checks. Data: legal name, date of birth, home address, email, mobile number. Where: Singapore, and other countries it operates in.
• FlightAware: flight status. Data: flight numbers and dates, never names. Where: United States.
• Cloudflare, in front of our hosting: carrying every visit to our pages. Data: your internet address, the pages you open and what you type into them. Where: its data centre nearest you.
• Anthropic (Claude): reading a booking email from an airline or travel site we haven't seen before. Data: a copy of that booking email's text, with the travellers' names, the booking reference, email addresses and phone numbers replaced with made-up ones. Where: United States.
• GitHub: keeping that same copy, with the personal details replaced, while we teach the service to read that kind of email. Data: the copy only. Where: United States.

Payments and pre-loaded rescue cards are made on each Underwriter's own Stripe and Airwallex accounts, so for a pass, Stripe and Airwallex work for the Underwriter named in its terms.

When a provider processes data outside the country where you live, contracts hold it to the standard the law there requires.

Services that receive no personal data

GetThere also uses these services. They never receive a traveller's name, email, phone number, booking reference or card details, so they aren't subprocessors.

• SerpApi (Google Flights): typical fares, to set a rescue card's limit. Sent: airports, a date, the cabin and how many travel.
• Duffel: typical fares, used only if SerpApi isn't available. Sent: the same as SerpApi.
• Amadeus: market fares, to check that a booking's fare is believable. Sent: airports, a date and the currency.
• Open-Meteo: weather forecasts for airports. Sent: an airport's location.
• GoDaddy: the domain name and its DNS records, including each partner's email address. Sent: domain records only.

Fonts are served by GetThere itself, so no font service sees your visit.

Changes

We tell each Underwriter before adding or replacing a provider, and record the change here with its date.

• 20 October 2026: Meta, Cloudflare and GitHub added; payments and cards are on each Underwriter's own accounts.
• 20 October 2026: services that receive no personal data listed; Anthropic reads a copy with personal details replaced.
• 18 October 2026: list published.