Legal

Data Processors and Sub-processors

The third-party services Smart Property Software Ltd uses to operate the platform, with the category of processing each one performs and the country in which they process data.

Smart Property Software Ltd is the data controller of personal data we receive from Meta and from customers. The following list discloses every sub-processor with potential access to that data, including the category of service they provide and the country in which they process the data. A formal Data Processing Agreement (DPA) is in place with each processor.

Hostinger International Ltd

  • Category: Infrastructure-as-a-Service (compute, primary application database, encrypted block storage, internal network).
  • Country of processing: United Kingdom.
  • Platform Data accessible: Encrypted Meta access tokens, WhatsApp Business Account identifiers, phone-number identifiers, inbound and outbound WhatsApp messages, delivery statuses, webhook payloads. All Platform Data is encrypted at rest with keys held by Smart Property Software Ltd; Hostinger does not hold decryption keys.
  • Purpose: Hosts the SmartTenant API, web app, worker, and PostgreSQL database inside our private VPC.

Cloudflare, Inc.

  • Category: TLS edge, content delivery, DDoS protection, Turnstile bot challenge.
  • Country of processing: United Kingdom (London / Manchester anycast PoPs serve UK end-user traffic).
  • Platform Data accessible: Encrypted-in-transit TLS connections only. Cloudflare terminates TLS for browser traffic; the API path to api.smartpropertysoftware.com is served via Cloudflare Tunnel where Cloudflare does not see decrypted content.
  • Purpose: Edge TLS for marketing and admin surfaces; DDoS protection; tunnel ingress for the API.

Microsoft Corporation (Microsoft 365)

  • Category: Transactional outbound email (SMTP).
  • Country of processing: United Kingdom and Republic of Ireland (Microsoft EU/UK data residency).
  • Platform Data accessible: None of the Meta WhatsApp Platform Data leaves the SmartTenant private VPC via SMTP. Microsoft 365 is used only to deliver transactional emails (account, billing, notification) to SmartTenant landlords, never to WhatsApp recipients.
  • Purpose: Outbound landlord-only transactional email.

GlitchTip (self-hosted)

  • Category: Error and exception telemetry.
  • Country of processing: United Kingdom (runs inside the same Hostinger VPC as the application).
  • Platform Data accessible: Error stack traces with PII scrubbing applied at source — WhatsApp message bodies, access tokens, and personal contact details are stripped before the event reaches GlitchTip.
  • Purpose: Engineering observability for crash and exception triage.

Why we do not use other commonly-named processors

We do not use AWS, Google Cloud Platform, Azure, Vercel, Render, or any other public cloud provider for the SmartTenant production workload. We do not use third-party AI providers (OpenAI, Anthropic, etc.) on WhatsApp message content. We do not sell Platform Data and do not share Platform Data with advertisers, data brokers, marketing networks, or affiliate networks.

Updates

This list is authoritative. If we engage a new sub-processor with access to Platform Data, we will update this page before granting access. Customers who require notice of sub-processor changes should email [email protected] to subscribe to processor-change notifications.

Effective from

This list is effective from May 30, 2026.