Homehogs Ltd Privacy Notice

Effective date: 24 August 2026. Last updated: 4 November 2026.

1. ABOUT THIS NOTICE

This privacy notice explains how Homehogs Ltd collects, uses, shares, stores, and protects your personal data when you use Homehogs, including our web app, mobile apps, account tools, reminders, document tools, AI-assisted features, and more. It applies to users, household members, invited users, prospective users, and anyone whose personal data is processed through Homehogs.

Homehogs is operated by Homehogs Ltd, a company registered in England and Wales (company number 17353377) with our registered office at 71 to 75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commission (the ICO) under registration number ZC222992. In this notice, “Homehogs,” “we,” “us,” and “our” refer to Homehogs Ltd.

This notice should be read in conjunction with our Terms and Conditions and any privacy information shown in the app or at the point of data collection. Please note that other organisations may also process your personal data when you use features connected to their services. If an organisation decides how and why it uses your information, it is responsible for explaining its processing in its own privacy notice.

If you have any questions or concerns about privacy or data protection, feel free to reach out to us at hello@homehogs.com. We’re here to help!

2. WHAT IS HOMEHOGS?

2.1 Homehogs as Your Home Management Companion. Homehogs is a convenient web and mobile app designed to help you manage your home and property. With Homehogs, you can easily organise all your important household information, documents, reminders, inventories, appliances, bills, warranties, maintenance records, supplier communications, handover packs, logbook packs, and more, all in one place!

2.2 Important Note on Usage: to use Homehogs, you need to be at least 18 years old to create an account or purchase a subscription. We want to ensure that our service is used appropriately, so Homehogs is not intended for children, and we do not allow anyone under 18 to create accounts.

3. OUR DATA PROTECTION ROLES

3.1 When Homehogs is the controller

3.1.1 Homehogs is the controller of personal data, meaning we decide how and why your data is used for our services. This includes data necessary for creating and managing your account, signing you in, applying permissions, processing payments, managing subscriptions, providing support, sending service messages, understanding service usage, operating enabled features, maintaining records, and ensuring compliance with legal obligations. It also encompasses any content you upload, enter, store, generate, import, export, or share through Homehogs, which we process to provide and operate our services effectively.

3.2 Your responsibility for information you choose to add or share

3.2.1 You decide what household, property, document, supplier, tenant, occupier, contractor, agent, buyer, seller, neighbour, guarantor, or other third-party information you choose to enter, upload, import, store, share, export, or include in packs through Homehogs.

3.2.2 If you use Homehogs for your own personal or household purposes, you are responsible for making sure that the information you add and share is fair and appropriate for the people it relates to.

3.2.3 If you use Homehogs for a business, professional, landlord, letting, property-administration, tenancy, or property-management purpose, you may be an independent controller of the personal data you decide to collect, upload, keep, share, export, or include in packs.

3.2.4 You are responsible for making sure that any personal data about another person is handled lawfully and fairly before you upload it to Homehogs or share it using Homehogs.

3.3 Mobile app, app stores, devices, and platform providers

3.3.1 When you use a Homehogs mobile app, Homehogs is the controller of personal data that we collect and use to operate your Homehogs account and provide the Homehogs service.

3.3.2 Apple, Google, device manufacturers, mobile networks, app stores, operating systems, platform analytics, crash-reporting providers, payment systems, and account services may also process personal data.

3.3.3 Those organisations may act as separate controllers where they decide how and why to use personal data for their own platforms, stores, devices, operating systems, accounts, payment flows, diagnostics, security, analytics, or rules.

3.4 Service providers, processors, and independent controllers

3.4.1 We use service providers to help us operate Homehogs. Where a provider processes personal data only on our instructions, it acts as our processor or service provider.

3.4.2 Where a provider decides its own purposes and methods for using personal data, it acts as an independent controller. This may apply to app stores, device platforms, payment providers, Trustpilot, Google services, connected services, and platform services, depending on the feature used.

3.4.3 A provider may act as our processor for one activity and as an independent controller for another activity. For example, a payment provider may process payment data for us while also using limited information for fraud prevention, compliance, or payment-network obligations.

3.4.4 Where another organisation acts as an independent controller, that organisation is responsible for explaining its own processing, lawful bases, retention, rights handling, international transfers, and security arrangements.

3.5 Information about other people

3.5.1 If you enter, upload, store, share, export, or otherwise use personal data about household members, tenants, occupiers, guarantors, contractors, agents, suppliers, buyers, sellers, neighbours, or other people, you must have a proper reason and authority to do so.

3.5.2 You should avoid uploading special category data, highly sensitive personal data, or confidential third-party information unless it is necessary for your legitimate use of Homehogs and you have the right to use it in that way.

3.5.3 If you invite another person to use Homehogs, grant them access, share a link, create a pack, or export information for them, you are responsible for checking that the recipient should receive that information and that the permissions, pack, link, or export are appropriate.

4. Personal data we collect

4.1 We collect various types of personal data to provide and improve our services. Here’s an overview of what we collect and how we receive it:

• Account and Identity Information: This includes your name, email address, login details, account identifiers, household identifiers, invited-user status, permissions, and authentication information.
• Contact Information: We gather information when you reach out to us for support, respond to messages, or provide feedback. This may include your emails, support messages, and any attachments you share.
• Household and Property Information: You may enter or upload information about your homes, addresses, household members, occupiers, and related data. This can include personal data about yourself or others.
• Documents and User Content: We process various documents, images, text, and notes that you upload, share, or generate through Homehogs, which may contain personal data.
• Payment and Subscription Information: If you purchase a paid plan, we may collect your subscription status, plan type, billing details, transaction references, and payment information, which is processed by either Stripe or the relevant app store used to purchase the subscription, such as the Apple App Store and the Google Play Store.
• Technical, Device, and Usage Information: We collect technical data about your usage of Homehogs, including device type, operating system, app version, IP address, and feature usage to maintain and improve our service.

Sources of Personal Data

We obtain this data from various sources:

• Directly from You: When you create an account, upload documents, or interact with our services.
• Invited Users: From household members or invited users who access shared data through Homehogs.
• Connected Services: If you link or use third-party services, we may receive information necessary for those features. Examples include email providers and app stores.
• Public or External Sources: Information from public registers, supplier verification services, and other platforms relevant to Homehogs.

5. Cookies and similar technologies

5.1 We use cookies and similar technologies to operate Homehogs, keep you signed in, remember preferences, secure the service, prevent fraud, understand usage, measure performance, diagnose issues, and improve features. Certain cookies are needed for the service to work. Other cookies, such as analytics, performance, advertising, or optional tracking cookies, are used only where permitted by law and, where required, with your consent. You can manage cookie choices using the cookie banner shown on your first visit to our website, or the “Change your measurement choices” button on our privacy and cookie policy pages, where available. You may also control cookies through your browser or device settings, but disabling certain cookies may affect how Homehogs works.

5.2 More information about the cookies and similar technologies we use, why we use them, how long they last, and how to change your choices is set out in our Cookie Policy at https://www.homehogs.com/cookies.

Change your measurement choices

5.3 When you visit Homehogs we check which country your internet address is in, so that we can show you the right version of the service. That lookup runs against a database on our own servers, so your address is not sent to anyone else, and the result is remembered in a cookie for 30 days, or for 90 days if you confirm your country yourself. That cookie is listed with the others in our Cookie Policy.

6. Why we use personal data and our lawful bases

6.1 To create and manage accounts

6.1.1 We use account, identity, contact, authentication, and settings information to create accounts, sign users in, manage access, apply permissions, operate household membership, and provide account tools.

6.1.2 Our lawful bases are contract, where processing is needed to provide the service you request, and legitimate interests, where processing is needed to administer, secure, and improve account operations.

6.1.3 When you create an account you confirm that you are 18 or over, and we keep the date you confirmed it against your account. If you first joined through a social sign-in, that confirmation is part of accepting our terms.

6.2 To provide the Homehogs service

6.2.1 We use user content, household information, property information, documents, reminders, inventory records, supplier records, permissions, sharing settings, and connected-service information to provide the features you choose to use.

6.2.2 Our lawful bases are contract, where processing is needed to provide the service, and legitimate interests, where processing is needed to operate, maintain, improve, troubleshoot, and secure the service.

6.3 To provide reminders, packs, sharing, and permissions

6.3.1 We use relevant account information, household information, property information, documents, dates, reminders, invited-user details, permissions, and sharing information to send reminders, enable collaboration, create exports, produce packs, and control access.

6.3.2 Our lawful bases are contract and legitimate interests.

6.4 To process payments and subscriptions

6.4.1 We use payment, subscription, plan, renewal, cancellation, transaction, tax, and account information to process payments, administer subscriptions, manage trials, handle refunds, respond to billing queries, and keep financial records.

6.4.2 Our lawful bases are contract, legitimate interests, and legal obligation where we must keep tax, accounting, or compliance records.

6.5 To provide support and service communications

6.5.1 We use account, contact, communications, technical, diagnostic, and user-provided information to answer queries, troubleshoot issues, send important service notices, deal with complaints, and maintain service quality.

6.5.2 Our lawful bases are contract, legitimate interests, and legal obligation where the communication concerns legal, regulatory, security, or consumer-rights matters.

6.5.3 Service communications are not marketing. Even if you opt out of marketing, we may still send important service, security, legal, billing, subscription, support, and account messages where needed.

6.6 To secure the service and prevent misuse

6.6.1 We use account, authentication, technical, device, usage, security-log, and diagnostic information to protect Homehogs.

6.6.2 This helps us detect misuse, investigate suspicious activity, prevent fraud, enforce terms, and protect users and other people.

6.6.3 Our lawful bases are legitimate interests and legal obligation where security or legal compliance requires the processing.

6.6.4 When you set or change a password, we check whether it has appeared in a known data breach using the Pwned Passwords service run by Have I Been Pwned. Only the first five characters of a hash of the password are sent, never the password itself, so the service cannot tell what your password is. If the check cannot be reached, your password is accepted without it.

6.6.5 If you switch on the app lock in the Homehogs app, unlocking with Face ID, Touch ID, a fingerprint or Windows Hello is checked by your phone or computer itself. Homehogs only hears yes or no and never receives your face or fingerprint. Your PIN is kept on the device as a salted hash and is never sent to us.

6.7 To improve and analyse the service, and to measure our advertising

6.7.1 We use usage information, analytics information, feedback, support trends, feature activity, diagnostics, and aggregated or anonymised information to understand how Homehogs is used.

6.7.2 This helps us improve reliability, prioritise development, and measure product performance.

6.7.3 Our lawful basis is legitimate interests. Where consent is required for cookies or similar technologies, we rely on consent.

6.7.4 You may object to processing based on legitimate interests as described in Section 15. We will consider your objection in line with data protection law.

6.7.5 We advertise Homehogs on Google. Where you have agreed to it, and only on our public website, we record that a visit which arrived from one of our adverts went on to complete something, such as joining our waiting list, so that we can tell which adverts are worth paying for. Our lawful basis is your consent, which you give and withdraw through the choices described in Section 5. This measurement is never used to build advertising profiles of you or to show you adverts elsewhere: the Google setting that would allow that, advertising personalisation, is switched off permanently. It never runs inside your account.

6.8 To send review invitations through Trustpilot

6.8.1 If we invite you to review Homehogs we will send your name and confirmed email address to Trustpilot so Trustpilot can deliver the invitation and host any review you choose to write. We only invite confirmed email addresses, send invitations one at a time (not in bulk), and retain a short record of invitations so we do not ask the same person repeatedly. We rely on our legitimate interests to request feedback to help us improve the service. Trustpilot controls what happens to any review after it is submitted; please see Trustpilot’s privacy notice for details. Ignoring an invitation will not affect your account, access, support, subscription, or use of Homehogs. If you prefer not to receive review invitations, you can opt out at any time by emailing us at hello@homehogs.com.

6.9 To operate AI-assisted features

6.9.1 We use your content and prompts to provide AI-assisted features. Most of these are optional and run only when you choose to use them, for example when you upload a document to be read or ask the in-app assistant a question. One runs for every member without being asked: the tip on the home page, which is generated once a day from a summary of your household's records. Another runs without being asked when a tradesperson replies to an enquiry you sent from Homehogs: the reply is read once as it arrives, so that any price and dates in it can be offered for you to check and add. We also email you a copy of the reply in the tradesperson’s own words, with a link to open it in Homehogs. Where the reading found a price, the email names it for you to check. A reply held back because it came from an address your enquiry was not sent to is not copied: we tell you only that it is waiting for you to check and which address it came from. A third runs without being asked when you reach the finishing step of a piece of work on a project or repair: what the work was is read once to suggest the paperwork worth keeping from it, such as the invoice, the guarantee and the product details, and each suggestion is ticked off as you add a document of that kind. Our lawful bases for processing this data are contract (to provide the AI feature you request) and legitimate interests (to maintain and improve those features). Where we propose to use personal data to train or improve third-party models, we will first obtain your explicit opt-in consent. You are not required to use the optional features.

6.9.2 AI outputs are suggestions only; they may be incomplete, inaccurate, biased, or out of date. You should review AI outputs carefully before relying on them. We do not make automated decisions about you that produce legal effects or similarly significant effects without appropriate safeguards and explicit notices. Where such automated processing is ever used, we will provide meaningful information about the logic involved and the right to human review.

6.10 To send marketing where you have given permission

6.10.1 We only send you marketing about Homehogs where you have let us or where the law allows it, and we are open about which of those it is. When you create an account the choices are in front of you as tick boxes, offered ticked, and you can untick any of them before you finish or change them at any time from your account. Marketing here means updates, offers and product news about Homehogs. Every marketing message carries an unsubscribe link that works in one click. Opting out of marketing does not stop the service messages about your account, billing or support described in section 6.5.3.

6.10.2 When you create an account we show you three tick boxes, all of them ticked, and you can untick any of them before you finish. They are: system notifications, which are the important things happening in your own house, covering warranties and insurance expiring, EPCs and mortgage fixes ending, jobs and To do notes falling due, return visits to put work right and tenancy dates, and including a Monday summary of the week ahead; marketing communications, which are news about Homehogs itself, meaning new features and the occasional offer; and useful insights, which is a short email when we publish a new guide, saying what it covers. The first of the three is a service setting rather than marketing, as explained in section 6.5.3.

6.10.3 We send the second and third of those on the basis of our legitimate interest in telling our own customers about our own similar services, under the rule in the Privacy and Electronic Communications Regulations that permits this where you were offered the choice when we took your address and are offered it again in every message. The tick boxes are the first of those offers, and the unsubscribe link in every such message is the second.

6.10.4 You can change any of the three at any time from your account page, under Email preferences. Every non-essential email carries an unsubscribe link that works in one click without signing in, and each link switches off only the kind of email it came with, so stopping the offers does not stop the guides, and neither of them affects the notifications about your own house. We keep a record of these choices as described in section 12.5.

6.10.5 If a member invites you to Homehogs by email, we send one invitation to the address they gave us, saying who invited you and why you are receiving it. It carries an unsubscribe link. If you use it, we keep a hashed record of your address so that no further invitation is sent to it, whoever asks us to, and the address itself is removed once the invitation has lapsed.

6.11 To comply with law and protect legal rights

6.11.1 We may use personal data to fulfil legal obligations, respond to lawful requests, maintain necessary records, enforce our terms, defend against claims, and manage regulatory, tax, accounting, auditing, security, or legal matters. Our basis for this processing is either a legal obligation or legitimate interests.

6.12 To run the free tools on our website

6.12.1 Our website offers free tools that anyone can use without an account: a house price calculator, a home lookup, an EPC checker, an appliance recall checker, a sale-ready check and a landlord register checker, which section 6.13 describes. We never ask who you are when you use them. What you type into them is not linked to you or to any account.

6.12.2 The house price calculator uses the postcode, the kind of home, the price paid and the month of purchase that you enter. It sends the postcode to postcodes.io and to HM Land Registry, as described in section 9.8, to find the area’s house price index and the sales recorded on that postcode. The price and the month you enter never leave our servers.

6.12.3 The EPC checker sends the postcode you enter to the Energy Performance of Buildings register. It shows the certificates the register holds for homes on that postcode, then the full certificate for the home you pick. The search is protected by Cloudflare Turnstile, as described in section 9.10. A certificate is about a home rather than a person, but its address and details can relate to the people who own, live in or let that home. The register publishes certificates openly so that people can understand the energy performance of homes. We show them for the same reason and exactly as the register provides them. We do not store them. If a certificate is for your home and you do not want it to be publicly available, you can ask the register to remove it from public view, as explained in the GOV.UK guidance Energy Performance Certificates: opt-out of public disclosure. Our checker shows only what the register returns for a postcode search.

6.12.4 The appliance recall checker sends the words you enter to the GOV.UK product safety register (see section 9.8) and shows the notices it returns.

6.12.5 The sale-ready check uses the answers you choose about your home’s paperwork, such as whether you have an energy performance certificate. It looks nothing up and sends your answers nowhere. They are scored when you send them and are not stored.

6.12.6 The home lookup sends the postcode you enter to postcodes.io, HM Land Registry and the Energy Performance of Buildings register, as described in section 9.8, to list the homes on it. For the home you pick, it shows that home’s sales from HM Land Registry and its energy certificate from the register. It sends the postcode’s central point on the map to the Environment Agency, to show the flood areas around it, and a point on the map for the home to the government’s national planning data service and police.uk, to show the planning protections and the crime recorded around it: the home’s own point where we can place it, from Ordnance Survey’s open list of property reference numbers that we keep ourselves, or the postcode’s centre otherwise. None of them is sent an address. The search is protected by Cloudflare Turnstile, as described in section 9.10. A home’s sales and certificate can relate to the people who own or live in it. HM Land Registry and the register publish them openly so that people can understand the property market and the energy performance of homes. We show them for the same reasons and exactly as they provide them. We do not store them. Section 6.12.3 explains how to ask the register to take a certificate out of public view.

6.12.7 We keep nothing about you from these tools, with one exception: a landlord register reminder that you ask for, described in section 6.13. Search results are held in our servers’ memory for up to half an hour so that going back a step does not repeat the search. After that they are discarded. The area information and sold prices that the house price calculator looks up are kept for later searches in a shared store, which is organised by postcode, never records who asked and contains no addresses. The region the landlord register checker finds for a postcode is kept in the same store. The home lookup’s answers about a particular home, its sales and its certificate, are held in memory for ten minutes and never stored. Its answers about a place, the planning protections and crime figures around a postcode’s central point, are kept in the same shared store, which records the place and never who asked. Our monitoring records, described in section 9.11, keep no more than the first half of a postcode and none of the words you search for. We use your IP address for up to ten minutes to stop any one connection making too many searches.

6.12.8 Our lawful basis is legitimate interests: offering useful free tools to the public, showing what Homehogs can do and keeping the tools secure and fair to use.

6.13 To send landlord register reminders

6.13.1 Our free landlord register checker tells landlords when the region a rented home is in must join the government’s landlord register for England. It sends the postcode you enter to postcodes.io, as described in section 9.8, to find the region. Like the tools in section 6.12, the check itself keeps nothing about you.

6.13.2 For a home in England, and only while there is still a date to tell you about, the checker offers to email you a reminder. If you ask for one, we keep your email address, the region, the first half of the postcode you checked, when you asked, which reminder emails we have sent and, where your visit came from one of our adverts or campaigns, that campaign’s name. We do not keep the full postcode. The form is protected by Cloudflare Turnstile, as described in section 9.10.

6.13.3 We use these details only to send the reminder: an email confirming it straight away and an email four weeks before your region’s deadline. If you asked before registering became required in your region, we also email you on the day it does. Each email says in one sentence what Homehogs keeps for landlords. We do not add your address to any marketing list or use it for anything else. The campaign name, where there is one, is used only to count how many reminders each of our adverts or campaigns led to. It is never used to contact you.

6.13.4 Every reminder email carries an unsubscribe link. Using it deletes your email address straight away, together with every reminder you asked for with it, whichever region the email was about. Otherwise we delete the reminder 30 days after your region’s deadline. If you also have a Homehogs account and close it, any reminders for its email address are deleted with it.

6.13.5 Our lawful basis is your consent, which you give by asking for the reminder and can withdraw at any time using the unsubscribe link in any of its emails. For the campaign name, which only tells us which of our adverts work, our lawful basis is legitimate interests: knowing which of our advertising is worth paying for.

6.14 To keep a list of homes you are thinking of buying

6.14.1 Homehogs lets you keep a list of homes you are thinking of buying. For each one we keep the address and postcode you picked or typed, the property reference number and energy certificate number it was picked with, and what you add yourself: the asking price, a link to the listing, the council tax band, where it has got to and your notes. A home you might buy is usually somebody else’s home, so we keep nothing more about it than that.

6.14.2 When you open a home on your list, we read what the public registers say about it at that moment, in the same way as the home lookup described in section 6.12.6: its sales from HM Land Registry, its energy certificate from the Energy Performance of Buildings register, and the flood areas, planning protections and recorded crime around it. Nothing we read is stored against you or against the home: its own sales and certificate are held in memory for ten minutes, and what is known about its area is kept in the shared store described in section 6.12.7, which is organised by place and never records who asked.

6.14.3 The list belongs to your household. Members who can see your property records can see it, it is included when you export your data, and it is deleted with your household. You can remove a home from the list at any time. We do not use the list for marketing, to train AI or for advertising.

6.14.4 Our lawful basis is the performance of our contract with you: keeping the list is part of the service you use.

6.15 To keep your mood board and show it to tradespeople

6.15.1 When you paste a link to a shop’s page into your mood board, our server visits that page once to read the name, price and picture the shop publishes for links to it, then fetches that picture from the address the page gives. It sends the shop only the address you pasted, less any tracking tags. Nothing else about you goes with it. We keep a small copy of the picture, no larger than 720 pixels, on your household’s own board, with the shop’s name and a link to its page. We do not show that picture to anyone outside your household or put it in any email, share link, logbook, pack or download.

6.15.2 When you send an enquiry about a project to a tradesperson from Homehogs, you can include ideas from your mood board. The email lists each one’s name, shop, quantity, who is buying it, the few words you wrote on its card and a link to the shop’s page; a colour goes by its name, maker’s code and hex code. It never carries a shop’s picture. You can also add one link to an ideas page. The email always carries one if you tick photos of your home. The page shows the same ideas as the email, as they were when it was sent, with any photos you ticked. It can also show an AI picture of an idea that you kept from Picture it, if you tick it, with the label the picture carries. A product is shown there by its name and shop with a link to the shop’s own page, never by the shop’s picture. Anyone with the link can open it without signing in until it expires 30 days after the email is sent, or until you withdraw it from the conversation. The page shows copies made from your photos with their location data removed. It shows nothing else from your account: not your name, the job or your address. A photo you delete stops showing there straight away. We record the time of each opening and show you that record. We record nothing about who opened it.

6.15.3 Our lawful basis is contract: keeping your mood board and sending what you choose to a tradesperson are parts of the service you ask us for. For reading the shop’s page and keeping a small copy of its picture on your board, our lawful basis is our legitimate interest in showing you a preview of a link you gave us.

7. Sharing, household permissions, and user responsibility

7.1 You control sharing through Homehogs

7.1.1 Homehogs may allow you to invite household members or other users, grant permissions, share records, generate packs, export information, or share documents. You are responsible for checking who you invite, what you share, what permissions you grant, and whether the recipient should have access.

7.1.2 If you send ideas or photos of your home to a tradesperson with an enquiry, anyone holding the link to the ideas page in that email can see them until it expires or you withdraw it, as section 6.15.2 explains.

7.2 Shared information may include other people’s personal data

7.2.1 Shared records, handover packs, logbook packs, exports, reminders, documents, messages, and supplier records may include personal data about tenants, occupiers, household members, guarantors, agents, contractors, suppliers, buyers, sellers, or other people. You are responsible for ensuring that you have a proper reason and authority to include and share that personal data.

7.3 Removing access

7.3.1 Where Homehogs provides access controls, you should remove access when it is no longer needed. You can do this in the Settings area of Homehogs: find “Who’s in the household”, and use the options beside a member’s name to change the role and access they have been given, or to remove them from the household altogether.

7.3.2 Removing access may not delete copies already exported, downloaded, saved, or otherwise held by someone who previously had access.

8. AI-assisted features

8.1 Overview of AI Features

Homehogs offers AI-assisted features to assist you with household and property management. These features can help you read documents, photos and plans, extract important information, summarise data, draft suggested messages, answer questions about your Homehogs information, estimate replacement values, plan improvements, draw an idea on a photo of a room, and suggest suppliers. Apart from the daily tip on the home page, the reading of a tradesperson’s reply to an enquiry you sent and the paperwork suggested when you finish a piece of work, all described in section 6.9, they are optional and run only when you choose to use them. What a feature can read is limited by the permissions that apply to your account. Some of the records you keep describe other people, such as tenants, tradespeople and people you have invited to your household, and where a feature reads those records their details are processed in the same way as your own.

8.1.1 Data Handling and Security

When you use these AI features, the relevant data is sent to our Azure OpenAI resource, which sits in Microsoft Azure UK South. The model we use is one Microsoft offers as a global deployment, so the reading itself may be carried out in a Microsoft data centre outside the UK, under Microsoft's data protection terms for Azure OpenAI and the safeguards described in section 11. Anything the service stores, including copies Microsoft may keep for up to 30 days to check for misuse of the service, stays in the UK. We send only the minimum information necessary to generate the results you request, and apply encryption in transit, access controls and logging. AI outputs are suggestions only. We do not store AI inputs or outputs in Homehogs user-accessible logs by default; we may retain limited technical metadata about AI requests (e.g. timestamps, feature identifier, token usage) for operational, security and abuse-prevention purposes. Any retention of AI input or output for debugging or improvement will be subject to explicit notice and your opt-in consent.

Picture it, which draws an idea on your own photo of a room, uses a different model: FLUX, made by Black Forest Labs and sold and run by Microsoft on our Microsoft Foundry resource, which also sits in Microsoft Azure UK South. Microsoft runs it in its own Azure environment. Nothing is sent to Black Forest Labs, and neither Microsoft nor Black Forest Labs uses your photo, your words or the picture to train or improve their models. As with the reading above, the drawing itself may be carried out in a Microsoft data centre outside the UK, and anything Microsoft keeps to check for misuse of the service stays in the UK. Before anything is drawn your words are checked, and once drawn the picture is checked, by Microsoft’s Azure AI Content Safety on the same resource, so that harmful pictures are not made or shown. That check looks only at your words and at the picture drawn, not at the photo you choose or at anything else you store. Its results are not kept, nobody at Homehogs sees what it checked and it is not used to make any decision about you. We ask you to take the photo with nobody in it, and every picture is labelled in its corner as an AI picture of an idea, not a design.

8.1.2 Usage Limits

To protect the system’s integrity and performance, we implement a daily cap on the number of AI calls and token usage for each household. This measure prevents excessive usage and ensures fair access for all users.

8.1.3 Manual Access

If AI features are unavailable, you will still have access to manual processes for those features, allowing you to manage your tasks effectively.

8.1.4 Telling You at the Point of Use

When you use an AI-assisted feature we show you a one-line notice, with an OK button, saying that the material is read by an AI model on Microsoft Azure, that your records stay stored in the UK and that nothing is used to train it. It appears where the reading starts, such as the upload panel, the form you drop a document on, the photo overlay, the quick add sheet, the assistant, the reading of a tradesperson’s reply, the paperwork list on a piece of work you are finishing, the snag list and the Picture it card on a plan or a project, and it is shown again each time until you press OK. We record on your account the date you pressed it. An email that passes on a price our AI found in a tradesperson’s reply says in the email that an AI model on Microsoft Azure did the reading and that it can be wrong. The in-app assistant repeats that line whenever you open it. There is currently no setting that switches the AI-assisted features off; if you would rather they were not used, please contact us at hello@homehogs.com.

8.1.5 Limitations of Liability

AI outputs may be incomplete, inaccurate, biased or hallucinated and are for guidance only. You should verify outputs before relying on them. We do not use AI to make automated decisions that produce legal effects or similarly significant effects without appropriate safeguards; where such automated processing is used, we will provide meaningful information about the logic involved and a right to human review. You accept that Homehogs is not liable for decisions you make based on AI suggestions; we will, however, investigate and remediate reported harmful or biased outputs.

8.1.6 AI Feature Examples

For more detailed information about each AI feature and the specific information processed, please refer to the table below:

9. Connected services, supplier discovery, and external platforms

9.1 Connected services

9.1.1 Homehogs may allow you to connect, import from, verify through, or interact with external services.

9.1.2 External connections are used only to fetch, verify, display, or process the information needed for the relevant Homehogs feature.

9.1.3 If you disconnect an external service, future imports, syncing, verification, reminders, or related features may stop. You can do this by opening the part of Homehogs where you set the connection up, for example the Bills area for an energy supplier connection, and selecting Disconnect. Please note that disconnecting a service may not automatically delete information already imported into Homehogs unless you delete that information or close your account.

9.1.4 When you paste a link to a shop’s page into your mood board, the shop’s website receives a request from our server, not from you, as section 6.15.1 explains.

9.2 Supplier discovery and Google Places

9.2.1 Our supplier discovery feature searches Google Places for businesses near you. We send the kind of work and a general location, which is the town you have recorded or the district half of your postcode, together with a map point for that district. Your full postcode, your address and your identity are never sent. Where that search returns very few businesses we also ask an AI for names of local firms to look up, sending it the same trade and general location and nothing else. Please note that Google and other services may process your information according to their own privacy policies when they operate as independent controllers.

9.3 App stores and mobile platforms

9.3.1 When you download or use Homehogs through platforms like Apple, Google, or Android, these providers may handle your personal data as independent controllers. Their processing could involve app downloads, managing subscriptions, in-app purchases, device identifiers, and crash reporting, among other services.

9.4 Payment providers

9.4.1 We use Stripe, together with the Apple App Store or Google Play where you subscribe through one of our mobile apps, to process payments, manage billing, administer subscriptions, handle failed payments, process refunds, and maintain transaction records. Payment providers may process payment information as our processor, as an independent controller, or both, depending on the payment flow and applicable terms.

9.5 Email and communications providers

9.5.1 We use SendGrid, a Twilio company, to send account, service, security, support, billing, marketing where permitted, and other communications. The same provider delivers documents that you forward to your household’s private Homehogs email address. We may also use communications tools to manage support requests, service messages, and marketing preferences.

9.6 Analytics and advertising measurement providers

9.6.1 We use Google Analytics, which runs on our public website only and only where you have consented, to understand service usage, measure performance, diagnose issues, improve features, and support product decisions. Where analytics involve cookies or similar technologies requiring consent, we will request consent through the relevant consent mechanism.

9.6.2 We use Google Ads conversion tracking, which also runs on our public website only and only where you have consented, to measure which of our adverts lead to people joining our waiting list or signing up. It is asked for separately from the analytics above, so agreeing to one is never agreeing to the other, and refusing it means nothing about your visit is sent to Google Ads at all. Google acts as an independent controller for this measurement and processes it under its own terms and privacy policy.

9.7 Hosting and infrastructure providers

9.7.1 We host and operate Homehogs on Microsoft Azure. All application data (the app, database, documents, photos, logs and telemetry) is stored in Microsoft Azure UK South, including the Azure OpenAI resource used for AI features and the Microsoft Foundry resource used to draw pictures for Picture it; the AI reading and drawing may run in another Microsoft region, as section 8.1.1 explains. Microsoft Azure processes personal data on our behalf to deliver hosting, storage and related services under contractual data‑protection obligations.

9.8 Property and address information services

9.8.1 Some Homehogs features look up information about a property from public or official sources. We send only what the lookup needs. Your postcode and chosen address go to the Energy Performance of Buildings register for EPC information. Your postcode goes to postcodes.io and to HM Land Registry public price paid data for valuations, and the district half of your postcode goes to postcodes.io when you look for local suppliers. A map point derived from your postcode goes to the Environment Agency public flood-monitoring service, which names the flood warning and alert areas near the property. For the planning check in home improvements, a map point for your home goes to the government’s national planning data service (planning.data.gov.uk), which names the planning protections over and near it: your home’s own point where we can place it, from Ordnance Survey’s open list of property reference numbers that we keep ourselves, or your postcode’s centre otherwise. To draw the weather over your house on the home page, the central point of your postcode’s district (the first half of your postcode, such as LS29) goes from our servers to WeatherAPI.com, which sends back the forecast for that district. We keep the forecast for no more than a day, stored by district and never by who asked, and you can turn the weather off from the house’s weather badge, a choice kept only on your device. An appliance brand and model go to the GOV.UK product recall register. Your account details and your identity are not sent to any of these services.

9.8.2 When you open the sale preparation page for a property, we send its postcode to the Ofcom coverage checker, which predicts the broadband and mobile coverage for the homes in that postcode. Only the postcode is sent. Where we hold your property’s unique property reference number, we use it ourselves to find your home in Ofcom’s answer, and it is not sent to Ofcom. What Ofcom predicts is shown to you and is not stored, unless you choose to use its predicted broadband speed as your own answer.

9.8.3 The free tools on our website, described in section 6.12, use the same services. The postcode you enter goes to postcodes.io and HM Land Registry for the house price calculator, or to the Energy Performance of Buildings register for the EPC checker. The words you enter in the recall checker go to the GOV.UK product safety register. The postcode you enter in the landlord register checker goes to postcodes.io to find its region. The home lookup sends the postcode you enter to postcodes.io, HM Land Registry and the Energy Performance of Buildings register, the postcode’s central point to the Environment Agency, and a point for the home (its own where we can place it, the postcode’s centre otherwise) to the national planning data service (planning.data.gov.uk) and police.uk. Nothing that identifies you is sent with them.

9.9 Energy supplier connections

9.9.1 If you choose to connect an energy supplier account, such as Octopus Energy, we use the credentials you provide to fetch your tariffs, meter readings, and related billing information from that supplier, and for no other purpose. Those credentials are stored in encrypted form. You can disconnect a supplier at any time, as described in section 9.1.3.

9.10 Anti-fraud and bot checks

9.10.1 Certain forms, including registration, support requests, requests for our free guides, the searches in our free EPC checker and home lookup and the reminder form on our free landlord register checker, are protected by Cloudflare Turnstile, which sets your browser a short check confirming that it is not an automated system. Your browser answer and your IP address are sent to Cloudflare for that check. No account, household, or property information is sent. Cloudflare operates a worldwide network, so the check may be handled outside the United Kingdom.

9.11 Service monitoring and diagnostics

9.11.1 We use Microsoft Azure Application Insights to monitor the reliability and performance of Homehogs. Unlike the website analytics described in section 9.6, this operates within the service itself and records which requests the service handled, how long they took, and the details of anything that went wrong, including the address of the page involved. It is used to find and fix faults and to keep the service secure, and not to build a profile of you. Microsoft acts as our processor for this.

9.11.2 If the Homehogs app on your phone or tablet hits a problem, it sends us a short diagnostic report so that we can find and fix the fault: the app version, the device platform, the page you were on and the type and text of the error. It never includes the contents of your documents, and it is kept in the same monitoring service described in 9.11.1.

10. Who we share personal data with

10.1 Service providers

10.1.1 We may share personal data with service providers to assist in operating Homehogs. This includes data processing by Microsoft Azure for hosting, infrastructure, Azure OpenAI for AI features, and various other third-party platforms necessary to deliver our services. The main providers we rely on are Microsoft Azure (hosting, storage, service monitoring, and the Azure OpenAI service behind our AI features), Stripe (payments), SendGrid (email delivery), Google (Analytics and advert measurement on our public website, and Google Places for supplier discovery), Cloudflare (anti-fraud and bot checks), and Trustpilot (review invitations). Each provider operates under its own privacy policy and terms, and we advise you to review those documents for information about how they handle your data.

10.1.2 Where any provider acts as an independent controller, it is responsible for its data use

10.2 App stores and platform providers

10.2.1 We may share or receive information from Apple, Google, app stores, device platforms, and operating-system providers where required for app distribution, subscriptions, purchases, diagnostics, security, and platform operation.

10.3 Trustpilot

10.3.1 If we invite you to review Homehogs, we send your name and confirmed email to Trustpilot so they can deliver the invitation and host any review you submit. We keep a short record of invitations so we do not ask the same person repeatedly and so we can respect requests not to be contacted. Trustpilot controls the reviews and is responsible for how review content and related personal data are handled; see Trustpilot’s privacy notice for details. Ignoring an invitation will not affect your Homehogs account or access.

10.4 Connected services and supplier tools

10.4.1 If you use connected services, supplier discovery, verification, import, export, or sharing features, we may share the information needed to operate the feature with the relevant connected-service provider, supplier-verification provider, mapping or place-information provider, public-register source, or recipient you choose.

10.5 Other users you choose to involve

10.5.1 We may share personal data with household members, invited users, recipients of shared links, pack recipients, or other people where you choose to invite them, grant them access, share content, or generate an export or pack for them.

10.5.2 The ideas and photos of your home that you send to a tradesperson with an enquiry are shown to anyone who opens the link to the ideas page in that email, as section 6.15.2 explains.

10.6 Legal, regulatory, and safety reasons

10.6.1 We may share personal data with courts, regulators, law enforcement, public authorities, advisers, insurers, auditors, or other relevant parties where necessary to comply with law, respond to lawful requests, enforce our terms, protect rights, prevent fraud, investigate security incidents, protect users or other people, or deal with legal claims.

10.7 Business changes

10.7.1 If we are involved in a merger, acquisition, restructuring, financing, investment, sale of assets, insolvency process, or transfer of business, we may share personal data with prospective or actual parties and advisers where necessary and subject to appropriate safeguards.

11. International transfers

11.1 Transfers outside the United Kingdom

11.1.1 Homehogs stores all application data in Microsoft Azure UK South. The one exception to UK-only processing is the AI reading and drawing described in section 8.1.1, which Microsoft may carry out in a data centre outside the UK under the safeguards in 11.1.3.

11.1.2 Some service providers, including app stores, payment providers, communications providers, analytics platforms, review platforms, connected-service providers, public-register services, support providers, and independent controllers, may process personal data outside the United Kingdom depending on the service used.

11.1.3 If we transfer personal data outside the UK, we use appropriate safeguards (such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, or other lawful mechanisms) as required by law.

11.2 Independent third-party controllers

11.2.1 Where another organisation acts as an independent controller, such as Trustpilot, an app store, a payment provider, Google service, or connected-service provider, that organisation is responsible for its own international transfers.

11.2.2 The organisation will explain those transfers in its own privacy notice.

12. How long we keep personal data

12.1 Our approach

12.1.1 We keep personal data only for as long as reasonably necessary for the purposes described in this notice. This includes providing the service, maintaining records, meeting legal obligations, resolving disputes, enforcing terms, protecting security, and supporting legitimate business needs.

12.2 Account and user content

12.2.1 Account information and user content are generally kept while your account remains active or as otherwise needed to provide the service. If you want to remove content from your account, you can do this by deleting the individual record or document within Homehogs, or by closing your account from the Your account page, which deletes the households that only you use, together with their records and documents.

12.2.2 When you delete a tenancy or an inspection, it is hidden straight away and removed permanently 30 days later, together with the details recorded under it, such as its occupants, references, keys and inspection rooms. Files attached to it stay in your documents until you delete them. From the moment a tenancy is deleted, its tenants can no longer see its files. Repairs reported during the tenancy and meter readings taken for it stay as part of the property’s history.

12.2.3 A link to an ideas page you send to a tradesperson is kept with the conversation it was sent in, together with the record of when it was opened. Both stay after the link has ended and are deleted with the job, the property or your household. A copy of a shop’s picture on your mood board is deleted once no card uses it, for example when you remove the card or give it a new picture. It is removed permanently 30 days later with your other deleted documents.

12.3 Payment, legal, and tax records

12.3.1 Payment, billing, tax, accounting, complaint, legal, and compliance records may be retained for the periods required or permitted by law.

12.4 Trustpilot invitation records

12.4.1 We keep a record of who has been asked to review Homehogs to ensure that nobody is asked repeatedly and to respect requests not to be asked again.

12.4.2 We keep our own record of an invitation for two years from the date it was sent, after which it is deleted automatically. The record exists to make sure that the same person is not asked again, and is limited to who was invited, the address the invitation was sent to, who sent it, and when. We keep it even if the account it names is closed within that period, because it is a record of something we did rather than part of that account.

12.4.3 Trustpilot, as an independent controller, separately determines how long it retains review content and related personal data for the reviews it hosts. To find out how long Trustpilot keeps this data, please see https://help.trustpilot.com/s/article/Whats-the-retention-period-of-reviews?language=en_US for more information.

12.5 Marketing preference records

12.5.1 If you opt in to or opt out of marketing communications, we will keep a record of your preference to ensure we respect your choice. Additionally, we may retain limited records as necessary to verify that marketing communications are not sent to individuals who have opted out.

12.6 The free tools on our website

12.6.1 The free tools on our website keep nothing linked to you, apart from a landlord register reminder that you ask for (see section 12.7). Section 6.12.7 explains what is held briefly and why.

12.7 Landlord register reminders

12.7.1 A landlord register reminder is kept until you use the unsubscribe link in one of its emails or until 30 days after the deadline for its region, whichever comes first. Section 6.13 explains what it holds.

12.8 Homes you are looking at

12.8.1 A home on your list of homes you are thinking of buying is kept until you remove it from the list or your household is deleted. Section 6.14 explains what it holds.

13. Security

13.1 How we protect personal data

13.1.1 We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction. These measures may include access controls, authentication, encryption, monitoring, logging, backup procedures, security review, least-privilege access, provider due diligence, and staff or administrator controls.

13.2 Your role in security

13.2.1 Please keep your login details safe. Use strong authentication where available, protect your devices, and carefully check your sharing permissions. If you believe your account, device, share link, or access code has been compromised, let us know as soon as possible.

13.3 No absolute security guarantee

13.3.1 No online service can be guaranteed to be completely secure. We will continue to take reasonable steps to protect personal data and respond appropriately to security incidents.

14. Your data protection rights

14.1 Overview of Your Rights

14.1.1 You have certain rights regarding your personal data, subject to the conditions and limitations set out in data protection law. These rights apply when you interact with the Homehogs app or use our services, including but not limited to:

• Access: You have the right to request copies of your personal data that we hold, allowing you to know what information we process.
• Correction: If you notice that any personal data we have about you is inaccurate or incomplete, you have the right to request its correction.
• Deletion: You may request the deletion of your personal data when it is no longer needed for the purposes for which it was collected or if you withdraw your consent for processing.
• Restriction of Processing: You can ask us to restrict the processing of your personal data under certain circumstances, such as when you contest the accuracy of your data.
• Objection to Processing: You have the right to object to us processing your personal data for legitimate interests, and you can request that we stop processing in these cases.
• Withdrawal of Consent: If we are processing your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the legality of processing that occurred before the withdrawal.
• Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format, allowing for easy transfer to another service.
• Direct Marketing: You can object to receiving direct marketing communications from us at any time.
• Complaints: You have the right to complain to us about how we use your personal data, as described in 15.2. If you believe your rights have been violated, you also have the right to lodge a complaint with the UK’s data protection regulator, the Information Commission (the ICO), or another relevant supervisory authority.

14.2 When Your Rights Apply

These rights apply to your interactions with the Homehogs app in the following contexts:

• When Creating an Account: Your right to access and correct personal data applies when you provide your information to create and manage your Homehogs account.
• During Usage of Features: Right to access, correction, and deletion of data applies while using Homehogs features, including uploading documents, tracking household information, and using AI-assisted functionalities.
• When Contacting Support: If you interact with our support team, you can exercise your rights related to your personal data that we may possess as a result of that interaction.
• Upon Marketing Communications: If you opt into or withdraw from marketing, your related rights come into effect, allowing you to manage your preferences.

When you object to processing based on legitimate interests, this does not automatically require us to cease processing in every instance. However, we will carefully consider your objection according to applicable data protection laws and the operational needs of the Homehogs app.

15. We’re Here to Help with Privacy Concerns

15.1 If you have any privacy concerns or questions, we’d love to hear from you. Please reach out to us at hello@homehogs.com, and be sure to include enough information so we can understand and assist you.

15.2 Complaints to us. You have the right to complain to us if you are unhappy with how we have used your personal data. Email your complaint to hello@homehogs.com, or send it through the support form on our website at homehogs.com/support. We will acknowledge it within 30 days of receiving it, look into it without undue delay, keep you informed of our progress and tell you the outcome.

15.3 If you are not satisfied with how we have dealt with your complaint, you also have the right to complain to the Information Commission, the UK’s data protection regulator, which is still known as the ICO. You can find its contact details on its website, ico.org.uk.

16. Changes to this notice

16.1.1 We may update this privacy notice from time to time to keep you informed of changes related to Homehogs, our services, features, our use of AI, connected services, cookies, marketing practices, or how we handle data. If we make any important changes, we’ll let you know through email, an in-app notification, a notice on our website, or other suitable methods so you’re always in the loop. The version of this notice that’s in effect will detail how we handle your personal data during that time, unless we provide a later version or specific notice that indicates otherwise.