Sub-processors
These are the third-party services that process personal data on Homjo's behalf, each under a data-processing agreement. We don't sell your data — this is simply who helps us run the service.
Every service listed has a live code path in Homjo today. Each row links to that vendor's data-processing agreement and names the legal basis for any transfer outside the EU. Copies of each agreement are held on file (last refreshed September 2026) and can be requested at privacy@homjo.com.
Last updated: 2026-09-09
| Service | What it's used for | Data processed | Location | Transfer basis | Agreement |
|---|---|---|---|---|---|
| Supabase | Database, authentication, storage, edge functions | account, listings, auth tokens, uploaded media | EU (Ireland, eu-west-1) | EU-only processing — no transfer | View DPA |
| Vercel | Frontend hosting + edge network; aggregate, cookieless web analytics (page views, referrer, country, device) | IP address, user-agent | EU + US | EU–US Data Privacy Framework (certified) | View DPA |
| Stripe | Payments + subscription / Boost transactions | payment metadata (no card number), billing email, identity documents + selfie for optional ID verification (processed and held by Stripe Identity — never stored by Homjo) | EU + US | EU–US Data Privacy Framework (certified) | View DPA |
| RevenueCat | In-app purchase management for the iOS app — validates Apple App Store purchases and tells Homjo when a Plus subscription or boost is bought, renewed, cancelled or refunded | account id (Homjo user id), purchase and subscription history (Apple product, dates, status), listing id attached to a boost purchase, device platform | United States (RevenueCat, Inc., San Francisco) | EU–US Data Privacy Framework (RevenueCat, Inc. is certified) with Standard Contractual Clauses as fallback under the RevenueCat DPA | View DPA |
| Google and Apple (sign-in providers) | Optional sign-in with a Google or Apple account (OAuth). Each provider learns that you signed in to Homjo and shares your provider ID, email (or, for Apple Hide My Email, a relay address) and profile details with us. Facebook sign-in is built but switched off (VITE_AUTH_FACEBOOK_ENABLED=false) and will be listed here if enabled. | provider account id, email address, profile photo URL, the fact that you signed in to Homjo | US (each acts as an independent controller under its own privacy policy) | Independent controllers; both certified under the EU–US Data Privacy Framework | View DPA |
| MailerLite | County expansion waitlist (“notify me when Homjo launches in …”) | email address, county of interest, stated intent (optional) | EU (Lithuania), with US sub-processors | EU processing; its US sub-processors under Standard Contractual Clauses (2021/914) | View DPA |
| Postmark | Transactional email | recipient email, message content | US | EU–US Data Privacy Framework (certified) | View DPA |
| Twilio | SMS one-time codes | mobile number | EU + US | EU–US Data Privacy Framework (certified) | View DPA |
| Anthropic | AI content moderation + writing assistance | listing text, profile bio, search queries | US | EU–US Data Privacy Framework (certified) | View DPA |
| AWS Rekognition | Image moderation | uploaded images | EU (eu-west-1, Ireland) | EU-only processing — no transfer | View DPA |
| AWS Translate | User-requested translation of listings and chat messages | listing title + description, chat message text (participant-requested only) | EU (eu-west-1, Ireland) | EU-only processing — no transfer | View DPA |
| Replicate | AI image generation | form-validated prompt fields | US | Standard Contractual Clauses (2021/914), in the linked DPA | View DPA |
| Mapbox | Map tiles + address geocoding | coordinates, addresses | US | EU–US Data Privacy Framework (certified) | View DPA |
| Cloudflare Turnstile | Anti-bot / abuse prevention | IP address, browser signals | EU + US | EU–US Data Privacy Framework (certified) | View DPA |
| Sentry | Error monitoring and session diagnostics | error traces and stack traces, account email address and user id (attached to error events for signed-in users), session recordings (only when an error occurs; text and inputs masked), device/browser metadata, click paths and navigation timing | EU + US | EU–US Data Privacy Framework (certified); events stored in the EU region | View DPA |
| OpenStreetMap Foundation (Nominatim) | Address and area search — forward geocoding for the post-an-ad location picker and Area Guide | IP address, the address or area text the user is typing, browser user-agent | EU + UK | EU processing; UK covered by the EU adequacy decision | View DPA |
| OpenFreeMap (Hyperknot Software Kft.) — basemap tiles | Map background tiles, sprites and fonts on listing, post and Browse maps | IP address, map tile coordinates — i.e. roughly where the user is looking, browser user-agent and referrer (anonymised server logs) | EU (Hungary); Cloudflare may serve as CDN | EU processing; any Cloudflare CDN processing under the EU–US Data Privacy Framework (Cloudflare is certified) | View DPA |
| Esri (ArcGIS World Imagery) | Satellite basemap tiles — the satellite toggle on listing location maps | IP address, map tile coordinates | US | EU–US Data Privacy Framework (certified) | View DPA |
| jsDelivr (Twemoji flag assets) | Country-flag SVGs in the language and region switchers | IP address, browser user-agent | Global CDN (Cloudflare/Fastly/Bunny) | No personal data stored — the request IP is used only to deliver the file | View DPA |
| DiceBear | Generated placeholder avatars in Connect / Match | IP address, the avatar seed in the URL (a Homjo-generated identifier, not a name) | Global CDN | No personal data stored — the request IP is used only to deliver the image | View DPA |
| Dublin City Council / Visit Dublin (event images) | Event images displayed on community event cards and detail pages | IP address, the event image being viewed | EU (Ireland) | EU-only — no transfer | View DPA |
| Google (account profile photos) | Serving the profile photo of users who sign in with Google | IP address, browser user-agent, the opaque photo URL Google issued for that account | US | EU–US Data Privacy Framework (certified) | View DPA |