Start your free 14-day trial Open the demo account Search the whole site
Product DomesticCommercialEnd of tenancyHoliday letsAirbnbWindowsCarpets and upholsteryOne-off and specialistFacilities managementCleaner appRAMSYour websiteInvoicing Everything CleanFlo does →
Compare Cleaning software comparedCleanFlo vs JobberCleanFlo vs ZenMaidCleanFlo vs GetCleanFlowCleanFlo vs ConnecteamCleanFlo vs SweptCleanFlo vs BigChangevs a spreadsheet and WhatsAppCleanFlo vs SqueegeeCleanFlo vs ServiceM8CleanFlo vs Cleenie
Free tools Cleaning Quote CalculatorPrice Per m² CalculatorUK VAT CalculatorProfit Margin CalculatorTrue Cost of a CleanerHoliday Entitlement CalculatorPer-Seat Cost CalculatorContract Tender Calculator All 17 free tools → 16 printable templates →
Pricing Guides Help Contact Sign in

last updated · 23 August 2026

Sub-processors

Every company that touches your data, what each one sees, and what changed. Published here so you can check it before you sign up, not after.

Every company that touches your data. We give 30 days' notice before adding to this list, and you can object: see DPA section 7.2. To be told by email when it changes, write to privacy@cleanflo.io.

Current sub-processors

These are the third parties we engage to process personal data on your behalf. Each is bound by a written contract imposing obligations no less protective than our data processing agreement, and we remain fully liable to you for what they do.

  1. Supabase, Inc.

    USA · data hosted in Ireland (eu-west-1)

    What they do
    Database, authentication, file storage and serverless functions. Our primary infrastructure provider.
    What they see
    All categories: staff records, client records, jobs, invoices, photographs, messages, health & safety records.
    Transfer safeguard
    EU SCCs + UK Addendum

  2. Netlify, Inc.

    USA

    What they do
    Application hosting and content delivery for the web app and marketing site.
    What they see
    IP addresses and HTTP request metadata. No database content.
    Transfer safeguard
    EU SCCs + UK Addendum

  3. Stripe, Inc. / Stripe Payments Europe Ltd

    USA / Ireland

    What they do
    Subscription billing and payment processing.
    What they see
    Account holder name, email, billing address and payment details. No staff or client data.
    Transfer safeguard
    EU SCCs + UK Addendum

  4. Resend, Inc.

    USA

    What they do
    Transactional and marketing email delivery: invoices, job notifications, invitations, reminders.
    What they see
    Recipient name, email address and message content.
    Transfer safeguard
    EU SCCs + UK Addendum

  5. Cloudflare, Inc.

    USA

    What they do
    Turnstile bot protection on the sign-in and sign-up forms.
    What they see
    IP address and browser/device signals. Does not track across other websites.
    Transfer safeguard
    EU SCCs + UK Addendum

  6. OpenStreetMap Foundation

    United Kingdom

    What they do
    Map tiles shown when picking or viewing a site location.
    What they see
    The map area being viewed, and the requesting IP address.
    Transfer safeguard
    Not a restricted transfer

  7. Ideal Postcodes (postcodes.io)

    United Kingdom

    What they do
    UK postcode lookup, to place a site on the map from its postcode.
    What they see
    The postcode being looked up.
    Transfer safeguard
    Not a restricted transfer

  8. Google LLC · Apple Inc. · Mozilla Foundation

    USA

    What they do
    Push notification delivery, only where a user has enabled push in Settings.
    What they see
    Notification payload and a device endpoint identifier.
    Transfer safeguard
    EU SCCs + UK Addendum, where applicable

Where your data is stored

Your database lives in the European Economic Area: Amazon Web Services, Ireland (eu-west-1), via Supabase. The EEA is covered by UK adequacy regulations, so storing it there is not a restricted transfer.

Several providers above are established in the United States. For those we put an appropriate Article 46 safeguard in place before any transfer begins: normally the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, and we carry out a transfer risk assessment. Copies are available on request.

What is not on this list

Two things worth stating plainly, because their absence is the point:

  • No advertising or analytics network. The application sets no analytics, advertising or tracking cookies, and no third party receives your data for marketing purposes. We do not sell personal data.
  • No AI or machine-learning provider. Your data is not used to train models, ours or anyone else's, and is not sent to any model provider.

Typefaces are served from our own servers rather than from Google, on this site and in the application, so no IP address reaches a font host on any page load.

Change history

23 August 2026
List first published. Cloudflare, OpenStreetMap, Ideal Postcodes and the push notification services were added to reflect suppliers already in use that had not previously been listed. No new supplier gained access to data on this date.

Related

See also our data processing agreement, how your data is held, the privacy notice for the application and how to get in touch.