Sub-processors
The suppliers who handle personal data on our behalf, what each one receives, and where it goes. “We” are Mather Software Ltd, which operates HomeThink and is the data controller.
Effective date: 2026-10-19 | Version 1.8
These are our processors under Article 28 of the UK GDPR: they act on our instructions and may not use your data for their own purposes. Where a written data processing agreement is in force, the table links the document itself and says how it took effect — in every case so far the supplier's own terms, accepted when the account was opened, rather than anything separately negotiated.
Where the table says Not recorded, we have not satisfied ourselves that a written agreement is in force with that supplier, and we are not going to imply one. That is an open item on our side rather than a statement about the supplier: some publish an agreement that has to be signed separately, and we have not completed that step. It is stated plainly here because a register that reads as complete when it is not is worse than one that admits a gap.
This is a different list from the public registers we look things up in — HM Land Registry, the EPC register, the Environment Agency and so on. Those are not our processors, and none of them is told who you are. They are described in §5.2 of the Privacy Policy.
| Supplier | What they do | Where | What they receive | Data processing agreement |
|---|---|---|---|---|
| Convex | Database and backend infrastructure | United StatesUK Addendum to the EU SCCs | All application data — properties, analyses, preferences, chat. | In forceForms part of Convex's agreement, legally binding from its effective date. |
| Clerk | Authentication and account management | United StatesUK Addendum to the EU SCCs | Email address, name, session tokens. | In forceIncorporated into and forms part of Clerk's agreement, effective on its effective date. |
| Anthropic | The AI behind analysis and chat | United StatesUK Addendum to the EU SCCs | The details of the home you check (its address, the facts you confirm and the public-record data we gathered for it), your stated preferences — including your household make-up and figures derived from your affordability settings, not the income or savings figures themselves — your chat messages, and viewing photos you upload (Pro). Does not train models on data submitted through its business API. | In forceIncorporated by reference into Anthropic's Commercial Terms of Service. |
| Stripe | Payment processing | United StatesUK Addendum to the EU SCCs | Email address and billing details. We never see your card number. | In forceSubject to and forms part of the Stripe Services Agreement. |
| Vercel | Website hosting and delivery | United StatesUK Addendum to the EU SCCs | The requests your browser makes, including your IP address. | In forceBinding on entering Vercel's agreement, on the Pro and Enterprise plans. |
| Sentry | Error monitoring | European Union (Frankfurt)No third-country transfer — EU-hosted. | Technical details of errors and your account identifier. No email address or name. | Not recorded |
| PostHog | Product analytics (only if you accept analytics storage) and pseudonymous server telemetry keyed to your account id (legitimate interests) | United StatesNot recorded — no transfer terms confirmed. | Your account identifier, which pages and features you use (with consent), and server events such as a report run or a subscription started. No name or email address. | Not recorded |
| YourMail | Sending email | United KingdomNo third-country transfer — UK-based. | Your name, email address, and the content of the message. | Not recorded |
| Google (Google LLC, Google Maps Platform — Street View) | A street photo of the home you check, for signed-in readers | United StatesNot recorded — no transfer terms confirmed. | The home's address line and postcode, to find the street photo. When the photo loads, the viewer's browser requests it from Google directly, so Google also receives that viewer's IP address and browser details. It is not told who anyone is. | Not recorded |
| Cloudflare (Turnstile bot check) | Telling people from automated sign-ups — the bot check our sign-in provider (Clerk) loads on the sign-in and sign-up forms | United States (global network)Not recorded — no transfer terms confirmed. | Your IP address and browser and device characteristics, while the check runs in your browser. It is not told your name or email address. | Not recorded |
| OpenRouteService (HeiGIT gGmbH) | Travel-time and commute calculations, and travel-time areas on the map | GermanyNo third-country transfer — EU-based (covered by UK adequacy regulations). | The start and end coordinates of a commute or travel-time area you ask for. It is not told who you are. | Not recorded |
| RevenueCat, Inc. | Subscription status for Pro bought in the HomeThink mobile app (App Store or Google Play) | United StatesUK Addendum to the EU SCCs | Your account identifier, the purchase receipts Apple or Google issue for a subscription you buy in the app, and that subscription's status (active, renewing, expired). No name or email address. | In forceForms part of RevenueCat's Terms of Use, with the UK Transfer Addendum incorporated. |
| Expo (650 Industries, Inc.) | Delivering updates to the HomeThink mobile app | United States (global network)Not recorded — no transfer terms confirmed. | A random identifier the app creates for each installation, your IP address, your phone's operating system and the app's version, each time the app checks for an update. No name, email address or account identifier. | Not recorded |
Changes to this list
If we add a sub-processor, we will update this page before they begin processing, and note the change in the Privacy Policy's version history. If a change matters to you, tell us at support@mathersoftware.com.
International transfers
Where a supplier processes data outside the UK and a data processing agreement is in force with it, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of that agreement. Where the table says Not recorded, we have not confirmed transfer terms either. Sentry is hosted in the European Union and YourMail in the United Kingdom, so neither involves a third-country transfer.