Data-Processing Terms

These terms cover one thing: the details about your own clients that you type into Homjo's business tools, today the Invoices & Quotes tool. They form part of the Terms of Service for anyone who uses those tools. "You" means the provider who uses the tools; "Homjo" means Homjo Networks Limited, registered in Ireland under Company Number 815338.

Written in plain English on purpose, and describing what the software actually does. They follow the structure of the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915) and cover each point that Article 28(3) of the GDPR requires a contract of this kind to cover. They are Homjo's own wording, not the Commission's clauses word for word.

1. Who is who

For the client details you enter, you are the controller: you decide whose details to enter, what to enter, and what the document is for. Homjo is your processor: it stores those details and puts them on the documents you create, on your instructions.

This is separate from the data Homjo holds about you as a user (your account, your listings, your own business and billing details). For that data Homjo is the controller, and the Privacy Policy applies.

You are responsible for having a lawful reason to hold your clients' details, and for telling your clients how you use them.

2. What is processed

If you start an invoice from a booking, Homjo fills in the customer's name, the listing title and the price for you, at your click. You can change them before you issue the document.

3. Your instructions

Homjo processes your clients' details only on your instructions. Your instructions are the actions you take in the product: creating, editing, issuing, marking, downloading and deleting documents, exporting your data, and deleting your account. You can also give an instruction in writing to legal@homjo.com.

If the law of the EU or of Ireland requires Homjo to process the data in some other way, Homjo tells you before it does so, unless that law forbids telling you.

If Homjo believes an instruction would break data-protection law, it tells you straight away.

4. What Homjo does not do with your clients' data

Homjo does not use your clients' details for any purpose of its own. In particular, Homjo:

• does not email, message or market to your clients;
• does not pass your clients' details to its AI features or to any AI provider;
• does not use them for analytics or to build profiles;
• does not sell them or share them with other users.

Homjo does count documents. It counts how many documents you issue each month, to apply your plan's monthly allowance, and it counts how many providers use the tools and how many documents exist, for its own totals. Those counts contain no client details.

5. Confidentiality

Anyone at Homjo who is able to access the database is bound by a duty of confidentiality, and may look at your clients' details only where that is needed to run, secure or fix the service, or to carry out an instruction from you.

6. Security

These are the measures in place today:

• Access rules in the database. Each document belongs to the account that created it. The database's row-level rules let a signed-in user read and change only their own documents, and let nobody who is not signed in read any. No other user, and no moderator screen in the app, can open your documents.
• Encryption in transit. The site and the apps talk to our servers over HTTPS only, and the site instructs browsers to refuse an unencrypted connection.
• Encryption at rest. Our hosting provider, Supabase, states that it encrypts stored customer data with AES-256, and that database backups are encrypted.
• Hosting in the EU. The database that holds your documents is hosted in the EU (Ireland).
• Issued documents cannot be altered. Once a document is issued, the database refuses any change to its content, so an issued invoice cannot be edited silently by anyone using the app.
• Error reports. If the app hits an error, a report goes to our error-monitoring provider. Reports are set up to mask typed text and to remove email addresses. They are not meant to contain client details, but we cannot promise that a fragment never appears in one.

Homjo helps you, on request, to meet your own duties on security, on data-protection impact assessments and on consulting the Data Protection Commission before processing, as far as they concern these tools and using the information Homjo has.

7. Sub-processors

You give Homjo a general authorisation to use sub-processors. The current list, with what each receives and where it processes it, is published in the sub-processor register.

The ones that handle your clients' details are:

• Supabase, which hosts the database, in the EU (Ireland);
• Sentry, which receives error reports, only in the limited way described in Section 6.

Homjo's other sub-processors do not receive your clients' details.

Adding or replacing a sub-processor. Before a new sub-processor starts handling your clients' details, Homjo emails you at least 15 days in advance, saying who it is, what it will receive and where. If you object, you can stop using the tools, and delete your drafts or your account, before it starts.

Homjo places each sub-processor under data-protection obligations that match these terms in substance, and remains responsible to you for what its sub-processors do.

8. Transfers outside the EEA

Your documents are stored in the EU. Where a sub-processor processes data outside the European Economic Area, the sub-processor register names the legal basis for that transfer (the EU Standard Contractual Clauses or the EU–US Data Privacy Framework). Homjo makes no other transfer of your clients' details.

9. Helping you with your clients' rights

Your clients can ask you to see, correct or delete their details. What you can do yourself depends on the document:

• A draft. You can view it, correct the client's details, and delete it.
• An issued document. You can view it, download it, mark its status, and get it in your data export. You cannot edit or delete it: it is locked when it is issued. It is erased when your account is deleted.

For anything you cannot do yourself, write to legal@homjo.com and Homjo will help you respond to the request. If one of your clients writes to Homjo directly about a document you created, Homjo passes the request to you and does not answer it for you.

10. Deleting and getting the data back

• Getting it back. While your account exists, Profile → Settings → Your Data → "Download my data" gives you all your documents, with your clients' details and the line items, as one file. It does not contain the PDFs: download each PDF you need from the document itself.
• Deleting. You can delete a draft at any time. Issued documents, and everything else in the tools, are erased when your account is deleted. Erased records remain in encrypted database backups until those backups roll off.
• Your own duty to keep records. The law may require you to keep your invoices. Revenue requires businesses in Ireland to keep their records for six years. Homjo does not keep them for you after your account is deleted. Download your documents before you delete your account.
• An account that has not been used for three years is erased after a warning email, as the Privacy Policy describes. The documents go with it.

11. Personal data breaches

If Homjo becomes aware of a personal data breach affecting your clients' details, it tells you without undue delay, by email to the address on your account, with what it knows: what happened, what data is affected, and what it is doing about it. It helps you meet your own duties to notify the Data Protection Commission and the people affected.

12. Showing that Homjo keeps to these terms

On request to legal@homjo.com, Homjo gives you the information you need to show that it keeps to these terms. Homjo also allows and contributes to audits, including inspections, carried out by you or by an auditor you appoint, at reasonable intervals or where there are signs that these terms are not being kept. Please give reasonable notice. Homjo makes the same information available to the Data Protection Commission on request.

13. If these terms are not kept

If Homjo breaks these terms you can tell it to stop processing your clients' details until it complies, and you can stop using the tools and delete your account at any time. If anything in these terms conflicts with the rest of the Terms of Service about your clients' details, these terms apply.

14. Changes

Changes to these terms are notified in the same way as changes to the Terms of Service: by email at least 15 days before they take effect, and by a notice at the top of this page.

Version 1.0 · Published 29 September 2026 · Takes effect 20 October 2026 · legal@homjo.com