Sub-processors
Version 1.0 · Effective 15 October 2026
Epic House SIA runs Clavy with a small number of providers that process personal data on its behalf. In GDPR terms they are processors; trust centers usually call them sub-processors. This page describes them by category, says where they run, and explains how to obtain the itemised list that names each one.
Our role, and why there is no data processing agreement
Epic House SIA is the controller of the personal data Clavy holds: the e-mail address and password you sign in with, your purchases and the reports you order, and your saved location if you share it. Clavy processes no personal data on behalf of its customers: you entrust nothing to Clavy to be processed on your instructions, and the property and market information is public data that Clavy transforms, not personal data you give us. There is therefore no data processing agreement (DPA) to sign, and none is needed to use Clavy. The providers below are Clavy's own processors.
We keep them to the minimum the Service needs. Each processes data only for the purpose shown, under its written data-processing terms, and for any transfer outside the European Economic Area we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the provider is certified, or on the Commission's Standard Contractual Clauses (Decision 2021/914).
Categories of sub-processor
| Category | What they do | Data | Location |
|---|---|---|---|
| Cloud hosting and file storage | Run the application, its functions and workflows; store report PDFs and the site's own images and 3D models | Account and request data, IP addresses, report files | EU, Frankfurt, for functions and files; the provider's control plane is in the US |
| Database | Store the application's records | Account, subscription, order, report and audit data | Being confirmed; our deployment runbook places it in Frankfurt |
| E-mail delivery | Send verification, password-reset, account, invitation, report-ready and purchase e-mails | E-mail address, name, message content | EU, Ireland, as configured; the provider is based in the US |
| Payments | Take payment and run subscriptions, the billing portal and invoices (Stripe, whose checkout and billing pages you use directly) | E-mail address, name, billing details, payment identifiers; card details stay with Stripe and never reach Clavy | EU, Ireland; group companies in the US |
| Error monitoring | Collect the technical details of an error, only when enabled | Error, page and browser details; no name, e-mail address or IP address | EU data region, being confirmed |
| Network protection | Protect the server that holds the property information | Technical data of the requests between the application and that server; no account data | Global network |
Where a cell says "being confirmed", the check against the provider's current terms is not finished. Nothing on this page is a promise about a provider we have not checked.
The itemised list
We maintain an itemised list that names each provider with its purpose, the data it receives, its role, its location, the agreement that governs the processing and the safeguard for any transfer outside the EEA. Write to privacy@clavy.io to receive it. When you exercise your right of access, we name the recipients of your data.
Services you use directly
These services receive data only when you use the feature, under their own terms. They do not process data on our instructions; they are listed for transparency.
| Service | When | Data | Location |
|---|---|---|---|
| Google (Google Ireland Ltd. and Google LLC) | Only when you click to open the interactive Google map or the 3D view | Your IP address and the location viewed | EU and US |
| OpenStreetMap Foundation (Nominatim) | When the address of your saved location is looked up, or when you search for a place on the account page's map | The coordinates rounded to about 100 metres (three decimals) or the text you typed, sent by Clavy's server; no name, e-mail or IP address. Clavy makes at most one request per second across the whole application | United Kingdom (adequacy decision) |
| Instituto Geográfico Nacional | When a page shows aerial imagery | Your IP address; your browser requests the images directly from www.ign.es and tms-pnoa-ma.idee.es | Spain |
Not used for personal data
The public data sources behind the property and market information are read by Clavy and receive no personal data from it. The legal information page lists them with their licences.
Changes to this list
We update this page, with a new version and effective date, before a new provider starts processing personal data. Earlier versions stay available below it. For questions, write to privacy@clavy.io.