Legal

Sub-processors

The service providers that may process personal information for prop.forsale, what they do, and where.

Version 1.1 Last updated 27 September 2026

On this page

1. Current sub-processors

Each provider processes personal information only on our instructions, under written terms at least as protective as our data processing addendum (/dpa).

Current sub-processors
Provider	What it does for us	Personal information it can receive	Where	EU/UK transfer safeguard
Cloudflare, Inc.	Hosting, databases, file storage in the data region each agency chooses, queues, content delivery, custom domains, bot protection (Turnstile), transactional email sending and inbound email routing, cookieless usage counts, and the Workers AI models and AI Gateway used by search, import, the agency assistant and the deal chat (including reading the text of deal documents when an agency turns document reading on).	Everything the platform stores or serves, including account, listing, enquiry, deal room and subscriber records, uploaded documents and photos, email content, and technical request data such as IP addresses. The agency assistant sends an enquirer’s name, a masked email address and recent messages to Workers AI when an agent asks it about a lead. The deal chat sends a person’s question and what they may see in the deal room, and (with document reading on) the text of documents they may open, to Workers AI.	Global network. The main database is in the United States (eastern North America). Agency documents and photos are stored in the region chosen at sign-up: United States (default), European Union, Asia-Pacific or Oceania.	EU-US Data Privacy Framework (participant); Standard Contractual Clauses in Cloudflare’s data processing addendum
Clerk, Inc.	Sign-in, account security and session management for agents, agency staff and invited deal room parties.	Name, email address, sign-in identifiers, device and session information of signed-in users.	United States.	EU-US Data Privacy Framework, UK Extension and Swiss-US framework (certified); Standard Contractual Clauses as a fallback
Stripe, Inc. / Stripe Payments Europe	Subscription and credit payments.	Billing contact name and email, payment card details (collected directly by Stripe), transaction records.	United States and European Union.	EU-US Data Privacy Framework, UK Extension and Swiss-US framework (certified); Standard Contractual Clauses as a fallback
PostHog, Inc.	Optional product analytics and masked session replays, only after a visitor accepts analytics cookies; anonymous per-workspace business event counts otherwise.	Pseudonymous visitor id, pages visited, clicks and feature usage, device and browser type; for signed-in agency users an internal account id, workspace id, plan and role. IP addresses are discarded; form inputs are masked.	United States.	EU-US Data Privacy Framework, UK Extension and Swiss-US framework (certified); Standard Contractual Clauses as a fallback
Resend, Inc.	Backup email delivery (Cloudflare Email is used first): verification messages, enquiry and deal room notifications, invitations, newsletter confirmations and campaigns.	Recipient email address and name, message content, delivery, bounce and complaint events.	United States.	EU-US Data Privacy Framework (certified); Standard Contractual Clauses as a fallback
Firecrawl (SideGuide Technologies, Inc.)	Reading a public property page when an agent asks to import it, and web search for optional discovery features.	The advert web address and the public content of that page, which can include the advertising agent’s published contact details, or a search query.	United States.	Standard Contractual Clauses
xAI Corp.	AI features an agent asks for: drafting and improving listing copy (AI Enhance), turning an imported page into a draft listing, and optional search features.	Listing facts including the street address, and the public content of imported pages (which can include the advertising agent’s published contact details), or a search query. Enquirer, subscriber and deal room information is never sent.	United States.	Standard Contractual Clauses in xAI’s data processing addendum
Brave Software, Inc.	Web search used by optional property discovery features, when switched on.	The search query typed by the visitor.	United States.	Standard Contractual Clauses in the Brave Search API data processing addendum
Serper (serper.dev)	Web search used by optional property discovery features, when switched on.	The search query typed by the visitor.	United States.	Standard Contractual Clauses
Mistral AI SAS	Reading scanned deal documents and photos of documents (OCR) for the deal chat, only for agencies that turn document reading on.	The scanned pages of deal documents the agency’s deal chat reads, and photos of documents, which can include names, identity and account numbers, addresses, signatures and amounts. Only the pages that are scans are sent, as a new file holding just those pages: the rest of the document is never sent. Each file goes with the request that reads it and is not uploaded to Mistral’s file storage; the text that comes back is stored only encrypted with the agency’s key.	European Union (Mistral AI SAS, Paris, France).	Processed by an EU company under its data processing addendum; no transfer outside the EU is needed for this service
GitHub, Inc.	Runs our build, deployment and database backup jobs.	Database backups pass through its temporary build machines on their way to our backup storage on Cloudflare. No copy is kept on GitHub after a job ends.	United States.	Standard Contractual Clauses in GitHub’s data protection agreement

2. Changes and objections

We announce a new sub-processor here, and by email to workspace owners, at least 30 days before it starts processing personal information. To object, email privacy@pfs-stage.dev within that period with your reasons.

Change log
Date	Change
2026-09-27	Added Mistral AI SAS (Paris, France): OCR of scanned deal documents and photos, only for agencies that turn on document reading for the deal chat. Clarified that the deal chat uses Cloudflare Workers AI, including to read the text of deal documents.
2026-09-27	Added GitHub, Inc. (build and database backup jobs). Clarified that Resend is a backup to Cloudflare Email, that Firecrawl is provided by SideGuide Technologies, Inc., and that the agency assistant uses Cloudflare Workers AI.
2026-09-26	First published list: Cloudflare, Clerk, Stripe, PostHog, Resend, Firecrawl, xAI, Brave and Serper.

3. Links that are not sub-processors

Listing pages link to WhatsApp and OpenStreetMap. Nothing is sent to them unless you follow the link, so they are not sub-processors; their own privacy policies apply once you do.