Sub-processors
Last updated: 27 April 2026
LettingGuru uses the following third-party services to operate the platform. Each processor is bound by a Data Processing Agreement (DPA) under UK GDPR / EU GDPR which you can read at the linked DPA URL. We update this list when we add or remove a processor — material changes are emailed to agency owners 30 days in advance.
For data subject rights (access, erasure, portability, etc.), email us at hello@lettingguru.co.uk. You can also raise a complaint with the UK ICO at ico.org.uk.
| Vendor | Purpose | Data types | Region | DPA |
|---|---|---|---|---|
| Vercel | Web app hosting + Edge Network | All app traffic, IP addresses, cookies | EU + global | View DPA |
| Netlify | Marketing site hosting | Site visitors, IP addresses | Global | View DPA |
| Neon | PostgreSQL database (primary) | All application data | EU (eu-west-2 — London) | View DPA |
| Cloudflare R2 | Object storage (photos, documents, recordings) | User-uploaded files, recordings | EU + UK | View DPA |
| Resend | Transactional email delivery | Email address, message body | EU + US | View DPA |
| Firebase Cloud Messaging | Push notifications | Device tokens | Global (Google) | View DPA |
| Twilio | Telephony (AI Receptionist, SMS) | Phone numbers, call audio, SMS body | EU + UK | View DPA |
| Sumsub | Tenant identity verification (Right-to-Rent, AML) | Government ID document images, selfies, name, date of birth, residency status | EU + UK | View DPA |
| Anthropic (Claude) | AI features — descriptions, triage, voice agent reasoning | Property + tenant text, transcripts | US (zero-retention contract) | View DPA |
| OpenAI | Vision / OCR features + voice transcription (Whisper) | Uploaded images, documents, voice notes | US (zero-retention API) | View DPA |
| Google (Gemini) | Image editing — virtual staging, sky/lawn replacement | Property photos | EU + US | View DPA |
| Retell | AI voice agent orchestration | Call audio, transcripts | US | View DPA |
| ElevenLabs | Text-to-speech for the AI receptionist (via Retell) | Generated speech audio | EU + US | View DPA |
| Deepgram | Speech-to-text for AI calls (via Retell) | Call audio (transient) | US | View DPA |
| Stripe | Platform invoice billing + agency rent collection (Connect) | Card details, billing email/address (PCI-DSS scope) | EU + UK | View DPA |
| Acube (Open Banking) | Bank account sync for rent matching | Bank transactions (read-only) | EU + UK | View DPA |
| Homelet (Barbon) | Tenant referencing — credit checks, employer + landlord references | Applicant name, address, NI number, employment details, references | UK | View DPA |
| Xero | Optional cloud accounting sync — invoices, contacts, rent ledger | Landlord invoices, contractor invoices, rent payments | EU + UK | View DPA |
| JustMoveIn | Tenant move-in concierge — utilities, broadband, council tax setup | Tenant name, email, phone, move-in address | UK | View DPA |
| Rightmove | Property syndication via RTDF feed | Property listings (no tenant PII) | UK | View DPA |
Sub-transfers outside UK / EU
Where data is transferred outside the UK or EU (notably to US-based AI providers — Anthropic, OpenAI, Retell, Deepgram), we rely on Standard Contractual Clauses (SCCs) under UK GDPR and supplementary technical measures (TLS encryption in transit, zero-retention API contracts where available). For the AI receptionist specifically, call recordings stay in UK-region storage; only text-form prompts/transcripts are processed by the LLM provider.
Adding a new processor
When we engage a new sub-processor that materially changes the data flow, we update this page and email all agency owners 30 days in advance. Owners may object; if we can't agree on a replacement, the agency may terminate the contract for that reason without penalty.