Start your free 14-day trial Open the demo account Search the whole site
Product DomesticCommercialEnd of tenancyHoliday letsAirbnbWindowsCarpets and upholsteryOne-off and specialistFacilities managementCleaner appRAMSYour websiteInvoicing Everything CleanFlo does → See it running →
Compare Cleaning software comparedCleanFlo vs JobberCleanFlo vs ZenMaidCleanFlo vs GetCleanFlowCleanFlo vs ConnecteamCleanFlo vs SweptCleanFlo vs BigChangevs a spreadsheet and WhatsAppCleanFlo vs SqueegeeCleanFlo vs ServiceM8CleanFlo vs Cleenie
Free tools Cleaning Quote CalculatorPrice Per m² CalculatorUK VAT CalculatorProfit Margin CalculatorTrue Cost of a CleanerHoliday Entitlement CalculatorPer-Seat Cost CalculatorContract Tender Calculator All 18 free tools → 16 printable templates →
AI (beta) Pricing Guides Guides Contact Sign in

last updated · 9 October 2026

Sub-processors

Every company that touches your data, what each one sees, and what changed. Published here so you can check it before you sign up, not after.

Every company that touches your data. We give 30 days' notice before adding to this list, and you can object: see DPA section 7.2. To be told by email when it changes, write to privacy@cleanflo.io.

Current sub-processors

These are the third parties we engage to process personal data on your behalf. Each is bound by a written contract imposing obligations no less protective than our data processing agreement, and we remain fully liable to you for what they do.

  1. Supabase, Inc.

    USA · data hosted in Ireland (eu-west-1)

    What they do
    Database, authentication, file storage and serverless functions. Our primary infrastructure provider.
    What they see
    All categories: staff records, client records, jobs, invoices, photographs, messages, health & safety records.
    Transfer safeguard
    EU SCCs + UK Addendum

  2. Netlify, Inc.

    USA

    What they do
    Application hosting and content delivery for the web app and marketing site.
    What they see
    IP addresses and HTTP request metadata. No database content.
    Transfer safeguard
    EU SCCs + UK Addendum

  3. Stripe, Inc. / Stripe Payments Europe Ltd

    USA / Ireland

    What they do
    Subscription billing and payment processing.
    What they see
    Account holder name, email, billing address and payment details. No staff or client data.
    Transfer safeguard
    EU SCCs + UK Addendum

  4. Resend, Inc.

    USA

    What they do
    Transactional and marketing email delivery: invoices, job notifications, invitations, reminders.
    What they see
    Recipient name, email address and message content.
    Transfer safeguard
    EU SCCs + UK Addendum

  5. Cloudflare, Inc.

    USA

    What they do
    Turnstile bot protection on the sign-in and sign-up forms and the website chat.
    What they see
    IP address and browser/device signals. Does not track across other websites.
    Transfer safeguard
    EU SCCs + UK Addendum

  6. Anthropic, PBC

    USA

    What they do
    Writes the answers in the cleanflo.io website chat ("Ask Flo").
    What they see
    The questions a visitor types and the chat so far. No IP address, and no data held in the application.
    Transfer safeguard
    EU SCCs + UK Addendum

  7. OpenStreetMap Foundation

    United Kingdom

    What they do
    Map tiles shown when picking or viewing a site location.
    What they see
    The map area being viewed, and the requesting IP address.
    Transfer safeguard
    Not a restricted transfer

  8. Ideal Postcodes (postcodes.io)

    United Kingdom

    What they do
    UK postcode lookup, to place a site on the map from its postcode.
    What they see
    The postcode being looked up.
    Transfer safeguard
    Not a restricted transfer

  9. Google LLC · Apple Inc. · Mozilla Foundation

    USA

    What they do
    Push notification delivery, only where a user has allowed notifications. In the iOS and iPad app: Apple Push Notification service. In the Android app: Google Firebase Cloud Messaging, used only to deliver notifications. In a browser: the browser maker's own push service.
    What they see
    Notification payload and a device push token or endpoint identifier.
    Transfer safeguard
    EU SCCs + UK Addendum, where applicable

Where your data is stored

Your database lives in the European Economic Area: Amazon Web Services, Ireland (eu-west-1), via Supabase. The EEA is covered by UK adequacy regulations, so storing it there is not a restricted transfer.

Several providers above are established in the United States. For those we put an appropriate Article 46 safeguard in place before any transfer begins: normally the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, and we carry out a transfer risk assessment. Copies are available on request.

What is not on this list

Two things worth stating plainly, because their absence is the point:

  • No advertising or analytics network. The application sets no analytics, advertising or tracking cookies, and no third party receives your data for marketing purposes. We do not sell personal data.
  • No AI or machine-learning provider. Your data is not used to train models, ours or anyone else's, and is not sent to any model provider.

Typefaces are served from our own servers rather than from Google, on this site and in the application, so no IP address reaches a font host on any page load.

Change history

9 October 2026
Push notification row clarified for the CleanFlo iOS and Android apps: Apple Push Notification service delivers to iPhone and iPad, and Google Firebase Cloud Messaging to Android. Both suppliers were already listed; no new supplier gained access to data. Apple and Google also distribute the apps through their stores, under their own terms, and receive no customer data from us in that role.
8 October 2026
Anthropic added, to answer questions in the cleanflo.io website chat. It receives only what a visitor types into the chat: nothing held in the application is sent to it.
23 August 2026
List first published. Cloudflare, OpenStreetMap, Ideal Postcodes and the push notification services were added to reflect suppliers already in use that had not previously been listed. No new supplier gained access to data on this date.

Related

See also our data processing agreement, how your data is held, the privacy notice for the application and how to get in touch.