HomePilot's Privacy, Data and Sub-processor Policy

HomePilot is a mortgage decision-support platform for home buyers in Ireland. It exists to take somebody from the point of wondering whether they can afford a home to the point of operationally executing the purchase. To do that, HomePilot necessarily holds a detailed picture of your scenario's financial position.

That is the product. It is also the reason this document exists in the form it does: a platform that knows what you earn, what you have saved, and what you can afford has a materially higher duty than a platform that knows which articles you clicked.

What HomePilot is not

HomePilot is not a lender, a broker, a mortgage intermediary, or a provider of financial advice. It does not make lending decisions, does not submit applications on your behalf, and does not pass your information to lenders. It performs arithmetic on figures you provide and shows you the result. Nothing in the product is a recommendation to take, avoid, or alter a financial product, and nothing in it should be relied on as advice.

Everything else in this document is detailed. This is the principle.

A number never crosses the boundary. Your deposit, your income, your property price, your loan-to-value ratio, your monthly repayment, your funding shortfall, your budget totals, your scheme eligibility and your readiness assessment are processed inside HomePilot and are not transmitted to any advertising, analytics or marketing platform. Not aggregated, not hashed, not as a custom parameter, not as a conversion value.

What may cross our acquisition partners is a very short list: that a sign-up started, that a sign-up completed, that an email was verified, that a first login happened, plus three simple yes-or-no flags. whether the account is activated, whether it holds a plan, whether it has gone quiet, and the campaign details that brought you.

This is not a statement of good intentions. It is enforced as an explicitly enumerated allowlist in our source code that denies everything not on it by default. Adding an item requires a reviewed code structure change; it is not a setting an administrator can toggle, and it is not a configuration screen somebody can misconfigure at three in the morning.

The reason we are this specific is that the alternative has a track record. Sending named individuals' affordability and mortgage data into advertising infrastructure through tracking pixels is the exact conduct behind the litigation brought against mortgage lenders and health providers in recent years. It is almost never done deliberately; it is done by installing a marketing tag on a page that happens to display a number. We have designed the system so that it cannot happen by accident.

One consequence worth stating plainly, because it works against us commercially and we would rather you heard it here. If you decline acquisition cookies before registering, we cannot connect your later sign-up to the campaign that produced it, and that registration is unattributable to us forever. We accept that. It is the correct outcome, and a boundary you only honour when it is convenient is not a boundary.

3.1 Information you give us

• Identity: Email address, display name, password (stored only as a salted hash — we cannot read it). (When: Registration)
• Contact and verification: Mobile phone number, normalised to international format. (When: Two-factor setup)
• Financial inputs: Income, deposit and cash available, monthly savings, property price, interest rate, term, overpayment plans. (When: As you build a plan)
• Budget inputs: Legal and conveyancing costs, survey, stamp duty, kitchen, flooring, furnishing, moving costs, insurance, contingency, and any overrides you set. (When: As you build a budget)
• Scheme information: Help To Buy configuration and tax paid, First Home Scheme equity percentage, valuation and redemption planning. (When: If you use the schemes)
• Project information: Checklist task status, planned and actual dates, custom tasks you create, your target moving date. (When: Throughout)
• Preferences: Notification choices, auto-save, unsaved-change warnings, active scenario, interface settings. (When: Any time)
• Documents: Payslips, bank statements, employment letters and similar, where you choose to upload them. (When: Not yet active)

3.2 Information generated as you use HomePilot

We record meaningful actions inside the planning tools; a scenario created, a stress test run, an overpayment modelled, a budget category adjusted, a checklist task completed, a comparison made between two repayment schedules. These are not page views; they describe how a person navigates the decision of buying a home, and they are what tells us which parts of the product genuinely help.

3.3 Information generated automatically

Session and device information necessary to keep you signed in and to protect the account: session identifiers, the devices you have chosen to trust, IP address and approximate region derived from it, browser and device type, request timestamps, and security event records such as failed sign-in attempts.

3.4 Information from before you had an account

If you consented to acquire cookies, the anonymous record of your visits before registering, pages viewed, the campaign parameters on the link you followed, referring source, and the fact that this anonymous visitor later became a registered account.

3.5 What we deliberately do not collect

We do not collect precise geolocation. We do not fingerprint your device — device characteristics are used to lay out the interface for your screen and are not used as an identifier. We do not buy data about you from data brokers. We do not enrich your account with third-party demographic, credit or income data. We do not connect to your bank accounts. We do not collect special category data as defined in Article 9 of the GDPR, and you should not enter any into free-text fields.

This is the section most people skip and the one that matters most, so it is built to be read rather than endured. A sub-processor is any company we engage that processes your personal data on our behalf. We publish the complete list. We do not describe them vaguely as "trusted partners", we do not group them into unnamed categories, and we do not omit the ones that are inconvenient to name.

5.1 The visualisation: what each one can actually see

The critical question is not how many companies are involved. It is what each of them can see. Three tiers, and the distribution is the point.

• Tier 1 - holds your full plan: The infrastructure your account physically lives on. Encrypted at rest and in transit. Access is logged. (Hosting and compute, Primary database, Cache and event bus). These are the substrates. They hold everything because they are where “everything” is stored. They do not analyse it, mine it, or use it.
• Tier 2 - see a figure, and only in a message to you: Exactly one sub-processor is in this tier: Email delivery. When we email you that your plan shows a shortfall of a given amount, that figure is in the body of the email, and the company that delivers the email necessarily renders it. There is no way to email you a number without your email provider handling that number. We tell you rather than pretending otherwise.
• Tier 3 - never sees a financial figure: Everyone else.
  • Identity verification: sees phone number, nothing else.
  • SMS delivery: sees phone number, message text, no figures.
  • Messaging app delivery: sees phone number, message text, no figures.
  • Acquisition platform: sees anonymous ID, events, yes/no flags.
  • The messaging channels are deliberately figure-free. A reminder that a task is due tomorrow summons you to the dashboard; it does not state your financial position in a thread on somebody else’s platform.

5.2 The register

5.3 The concentration risk, stated plainly

Six of HomePilot's external functions; identity verification, phone validation, email delivery, SMS, the messaging-app gateway, and the acquisition platform. All run through a single vendor group. That is an unusual degree of concentration, and honesty requires naming it rather than letting six separate table rows imply six separate suppliers. It has a real benefit: one contract, one data processing agreement, one security posture. It has a real cost: a single vendor incident could simultaneously affect our ability to sign people in, to send security notifications, and to send reminders. Payments sit deliberately outside this group, with a separate provider.

Your account data — your plan, your budget, your scenarios, and your authentication records — is stored and processed exclusively within the European Economic Area (AWS Dublin, Ireland region: eu-west-1).

Where external sub-processors identified in Part 5 (such as Twilio communications gateways or Stripe billing infrastructure) transfer or route telemetry or transactional data to or through the United States, all such transfers are executed under Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by active certification under the EU–US Data Privacy Framework (DPF) and technical Transfer Impact Assessments (TIAs).

We keep personal data only for as long as we need it for the purpose we collected it for, and then we delete it.

• Authentication: HomePilot issues two separate tokens. A short-lived access cookie (Secure, SameSite, cryptographically signed) valid for 15 minutes, and a longer-lived refresh token stored securely in our database.
• Encryption: Data is encrypted in transit (TLS/HTTPS) and encrypted at rest by the storage layer. Passwords are stored only as salted hashes.
• Two-factor authentication: Registration requires verification of your phone number before the dashboard is reachable.
• Access control: Every request is checked for authentication and specific record entitlement at the database query level.

8.5 AI Development Sandbox Isolation

All autonomous AI coding agents, continuous integration systems, and test execution environments execute strictly within ephemeral, in-memory sandboxes (MongoMemoryServer and local Redis mock instances). Production Amazon DocumentDB clusters, customer authentication secrets, and live user mortgage financial models are strictly isolated with zero access permitted to external AI model providers or development agents. No customer financial figures or personal identifiers are ever transmitted to or processed by development sandbox agents.

HomePilot is building a readiness assessment: a figure between zero and one hundred describing how close your plan is to being ready to proceed.

9.1 It will be built only from substance (Deposit actually saved, affordability that holds).

9.2 It is decision support, not a decision. HomePilot does not lend and does not pass an assessment to a lender.

9.3 Limitations: It relies substantially on figures you enter, and the weightings are an informed initial judgment.

10.1 Security notifications cannot be switched off. (Password changed, two-factor disabled).

10.2 Reminders cover things you set up yourself (messaging app or email).

10.3 Progress updates carry figures, and are therefore email only. Every message stating a figure carries the date that figure was calculated.

Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Data Protection Commission within 72 hours.

HomePilot is intended for adults purchasing residential property in Ireland and is not directed at anyone under 18. Contact [PRIVACY CONTACT EMAIL] to report issues.

Governed by the companion HomePilot Consent & Cookie Policy Management document. Change your choices at any time from Account Settings → Privacy, or by clicking Manage Cookie Preferences. Withdrawal is as easy as granting.

Under the GDPR you have the following rights (exercisable free of charge, answered within one month via Account Settings or [PRIVACY CONTACT EMAIL]):

• 14.1 Access: (self-service export available)
• 14.2 Rectification
• 14.3 Erasure
• 14.4 Restriction
• 14.5 Withdrawal of consent
• 14.6 Not to be subject to automated decisions
• 14.7 To complain: to the Data Protection Commission (dataprotection.ie).