Privacy Policy

Hommie ("Hommie", "we", "us", "our") operates the website at usehommie.com and the Hommie mortgage-readiness platform. We are the data controller for the personal data described in this policy.

We are registered with the Information Commissioner's Office (ICO) as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our ICO registration number is [ZB######].

2.1 Account & identity data

2.2 Mortgage readiness questionnaire data

Collected during onboarding and stored in your profile. All fields are optional — you can skip or update them at any time.

2.3 Open Banking data (optional)

If you choose to connect your bank account via our Open Banking provider TrueLayer (FCA authorised), we collect and store:

2.4 Derived & computed data

2.5 Usage & analytics data

We process your personal data under the following lawful bases under UK GDPR Article 6:

We use your personal data exclusively for the following purposes:

• Providing, maintaining, and improving the Hommie mortgage readiness platform
• Calculating and updating your mortgage readiness score
• Generating personalised recommendations and action plans
• Authenticating your identity and securing your account
• Communicating with you about your account (transactional emails only)
• Detecting and preventing fraud, abuse, or security threats
• Complying with our legal and regulatory obligations
• Conducting anonymised product analytics to improve the service (subject to your consent)

We share your data only with the following sub-processors, each bound by a Data Processing Agreement (DPA) with us and compliant with UK GDPR:

We do not use any other sub-processors without updating this policy and, where required, notifying you. We will never sell your data to data brokers, advertisers, or financial institutions.

Some of our sub-processors (Google, PostHog, Vercel) process data in the United States. Where this occurs, we ensure appropriate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Agreement (IDTA) addendum approved by the ICO
• Supplementary technical measures including encryption in transit (TLS 1.2+) and at rest (AES-256)
• IP anonymisation for Google Analytics before any data is transferred

Your core financial and profile data is stored in the EU (Supabase on AWS eu-west-1) and does not leave the UK/EEA.

When your account is deleted, your personal data is permanently deleted from our live systems immediately. We will request deletion from sub-processor systems within 30 days of your request. A deletion record is retained for 3 years for ICO accountability purposes; this record contains only your user ID, the date of the request, and its status — not your personal data.

We implement the following technical and organisational measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers uses TLS 1.2 or higher
• Encryption at rest: All database data is encrypted at rest (AES-256) by Supabase/AWS
• Bank token encryption: Open Banking access and refresh tokens are encrypted with AES-256 before being written to the database — the database never stores plaintext tokens
• Row-level security (RLS): Database policies ensure that every user can only read and write their own data — no user can access another user's records
• Authentication: Passwords are hashed using bcrypt via Supabase Auth; we never store or transmit plaintext passwords
• Access control: Only authorised Hommie engineers can access production infrastructure, and only where necessary
• Audit logging: All significant data changes (score recalculations, profile edits) are logged with timestamps

If you discover a security vulnerability, please report it responsibly to privacy@usehommie.com before public disclosure.

Despite our security measures, no system is entirely immune from breach. In the event of a personal data breach, we will:

• Assess the breach and its likely risk to your rights and freedoms within 24 hours of discovery
• Where the breach is likely to result in a high risk to your rights and freedoms, notify you directly without undue delay — and in any event within 72 hours of us becoming aware
• Report qualifying breaches to the Information Commissioner's Office (ICO) within 72 hours of becoming aware, as required by UK GDPR Article 33
• Take immediate remediation steps to contain and prevent recurrence

Breach notifications to you will be sent to the email address registered on your account and will include: the nature of the breach, the categories and approximate number of records affected, likely consequences, and the steps we have taken or propose to take to address the breach.

You have the following rights regarding your personal data. To exercise any of them, contact privacy@usehommie.com. We will respond within one calendar month (extendable by two further months for complex requests, with notice).

You can withdraw consent for PostHog and Google Analytics at any time via our cookie consent banner. You can also block Google Analytics by installing the Google Analytics Opt-out Browser Add-on. Withdrawing analytics consent does not affect your ability to use Hommie.

Hommie is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@usehommie.com and we will delete it promptly.

We may update this Privacy Policy from time to time. Where changes are material — for example, if we add a new data category, change our lawful basis, add a new sub-processor, or change how we use your data in a way that requires new consent — we will notify you by email at least 14 days before the change takes effect and, where required by UK GDPR, seek fresh consent. For minor clarifications, we will update the "Last updated" date at the top of this page.

Where a change to this policy involves new processing for which we rely on your consent, we will seek your explicit consent before that processing begins — continued use of the service alone does not constitute consent to new processing. For changes based on other lawful bases (contract performance, legitimate interests, or legal obligation), we will provide 14 days' notice and your continued use after that date indicates acceptance of those changes. If you do not agree to the updated policy, you may delete your account at any time.