Data processing agreement

The terms under which Hovio handles enquiries on an estate agency's behalf. Required by Article 28 of the UK GDPR.

Draft for review. This sets out honestly what the software does and who it sends data to. It has not been settled by a solicitor, and the transfer mechanism in section 7 in particular needs one. Every placeholder marks something only you can fill in.

1. The parties, and who is who

This agreement is between the estate agency named on the account ("you", the controller) and company name ("we", the processor). It forms part of the terms of service.

You decide why enquiries from your website are collected and what happens to them. We process them only to provide the service, and only as you instruct.

2. What we process, and why

Subject matter	Providing an AI assistant that answers property enquiries, captures leads and books viewings on your website.
Duration	For as long as your account is open, plus the deletion period in section 9.
Nature and purpose	Collection, storage, generation of replies, and making the results available to you in your dashboard and by email.
Types of personal data	Name; email address; telephone number; the content of the chat; stated budget and property requirements; viewings booked, with date and property.
Categories of data subject	Members of the public who use the assistant on your website — prospective buyers, sellers, landlords and tenants.
Special category data	None is requested. A visitor may volunteer something in free text; the assistant is instructed not to ask for or pursue it.

3. Our obligations

We process personal data only on your documented instructions, which for these purposes are this agreement, the terms of service, and your settings in the dashboard.
If we are ever required by law to process it otherwise, we will tell you first unless that law forbids it.
Everyone with access is bound by confidentiality.
We take the security measures set out in the annex.
We will not use your data to train any AI model, and neither will our AI provider — see section 6.
We will not sell it, and no agency can ever see another agency's records.

4. Helping you meet your own duties

Everything a visitor sends is visible to you in your dashboard, so a request for access, correction or erasure can usually be answered without us. Where it cannot, we will help, at no charge for a reasonable number of requests.

We will also give you the information you reasonably need for a data protection impact assessment or a consultation with the ICO.

5. If something goes wrong

We will tell you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with what we know at that point and what we are doing about it. Reporting to the ICO is yours to make, as controller.

6. Sub-processors

You give general authorisation for the sub-processors below. We will give you at least 30 days notice before adding or replacing one, and you may object; if we cannot resolve the objection you may terminate.

Who	What they do	Where
Supabase	Hosts the database and authentication. All enquiry records live here.	United Kingdom (London)
Anthropic	Provides the AI model that writes the replies. Receives the conversation and your property details; does not receive your dashboard or your other records.	United States
Vercel	Serves the website and the embedded widget.	United States and global edge network
Resend	Delivers the alert emails telling you a viewing was booked or a lead captured.	United States

Anthropic does not train its models on data submitted through its API. This reflects its commercial terms as at date; those terms, not this sentence, are what bind them.

7. Sending data outside the UK

Enquiry records are stored in the United Kingdom. Generating a reply necessarily sends the conversation to Anthropic in the United States, and alert emails go through Resend, also in the United States.

This section needs a solicitor. Those transfers require a lawful mechanism — in practice the UK International Data Transfer Addendum to the EU standard contractual clauses, plus a transfer risk assessment. Do not put Hovio in front of the public until this is in place and named here.

8. Audit

We will provide the information needed to demonstrate that we meet this agreement, and allow an audit by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.

9. Deletion

When your account closes you may export everything from the dashboard. We then delete your data within 30 days, including from backups on their normal rotation, except anything we are legally required to keep.

10. Priority

Where this agreement and the terms of service conflict on the handling of personal data, this agreement wins.

Annex — security measures

Separation between agencies

Every record carries the agency that owns it, and the database enforces that with row-level security rather than application code. An account with no membership of an agency reads zero rows, which has been tested directly rather than assumed.

Credentials

The AI provider's key is held server-side and never reaches a browser. The widget key that appears in your page source identifies your agency and grants no read access to your records.

In transit and at rest

All connections use TLS. The database is encrypted at rest by the host and backed up daily.

Abuse

The public endpoint is rate limited per visitor address and per agency. Visitor IP addresses are salted and hashed before being counted and are never stored in readable form.

Prompt injection

The assistant is instructed that visitor text is data and never instruction, and refuses attempts to change its role or reveal its instructions. Its tools accept only declared fields, and every booking is re-checked against the diary in code rather than trusted from the model.

← Back to Hovio