Service providers
Last updated: 31 October 2026
These companies process personal data for HomeHero. We only use providers that offer sufficient guarantees (GDPR Art. 28) and we'll update this page before adding a new one. Questions: support@homeheeros.com.
Current providers
| Provider | Purpose | Personal data | Location | Transfer safeguard | Role | When |
|---|---|---|---|---|---|---|
| Render Services, Inc. | Hosting of the website, app server and database | All data stored by HomeHero | EU (Frankfurt, Germany); company in the USA | EU data residency; EU Standard Contractual Clauses for remote support access | Processor (acts on our instructions) | Always |
| Stripe Payments Europe, Ltd. | Card payments, refunds, payouts to Heroes (Stripe Connect), identity checks (Stripe Identity) | Name, email, payment details, payout account, ID documents and selfie (identity checks), transaction data | Ireland (EU); Stripe group in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses | Processor; independent controller for its own legal duties | Always |
| Resend (Plus Five Five, Inc.) | Sending emails (account, bookings, support) | Email address, name, email content | USA (EU sending region where configured) | EU Standard Contractual Clauses / EU–US Data Privacy Framework | Processor (acts on our instructions) | Always |
| Twilio Ireland Ltd. | Phone verification codes and booking text messages | Phone number, message content | Ireland (EU); Twilio group in the USA | Binding Corporate Rules and Standard Contractual Clauses | Processor (acts on our instructions) | Always |
| Google Ireland Ltd. | “Continue with Google” login | Name, email, Google account id | Ireland (EU); Google LLC in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses | Independent controller | Only if you use this login |
| Google Ireland Ltd. (Google Analytics / Tag Manager) | Usage statistics — only with analytics consent | Pseudonymous device id, pages viewed, approximate location from IP (IP not stored by Google Analytics 4) | Ireland (EU); Google LLC in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses | Processor (acts on our instructions) | Only with analytics consent |
| Microsoft Ireland Operations Ltd. (Clarity) | Heatmaps and masked session replays — only with analytics consent | Pseudonymous device id, clicks, scrolls, page layout (typed text and personal details masked) | Ireland (EU); Microsoft Corp. in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses | Processor; independent controller for its own legal duties | Only with analytics consent |
| Microsoft Ireland Operations Ltd. (Entra ID) | “Continue with Microsoft” login | Name, email, Microsoft account id | Ireland (EU); Microsoft Corp. in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses | Independent controller | Only if you use this login |
| Meta Platforms Ireland Ltd. | “Continue with Facebook” login; Meta Pixel ad measurement — only with marketing consent | Login: name, email, Facebook id. Pixel: pseudonymous browser id, page visits and conversion events (no names, emails or messages) | Ireland (EU); Meta Platforms, Inc. in the USA | EU–US Data Privacy Framework and Standard Contractual Clauses | Processor; independent controller for its own legal duties | Only with marketing consent (Pixel); when you use Facebook login |
| OpenFreeMap | Map tiles shown on task and service maps | IP address and the map area requested (standard web request) | EU (Hetzner, Germany/Finland) | Within the EU | Processor (acts on our instructions) | Always |
| Komoot GmbH (Photon geocoder) | Address and town suggestions while you type (looked up by our server — your device doesn't contact Komoot) | The text typed into the address field | Germany (EU) | Within the EU | Processor (acts on our instructions) | Always |
| Browser push services (Google FCM, Mozilla, Apple, Microsoft) | Delivering push notifications you turned on | Device push address and the encrypted notification | EU/USA, depending on your browser | Notifications are end-to-end encrypted (Web Push); EU–US Data Privacy Framework | Processor (acts on our instructions) | Only if you turn on push |
| Google Fonts | Fonts — served from our own domain, Google receives no request from your device | None | Self-hosted | Not applicable | Processor (acts on our instructions) | Always |
Heroes are not our processors
Heroes are independent businesses or private individuals. When you book one, they receive what they need for the job and decide themselves how to use it, in line with the law and our Terms.