Privacy Policy

Who we are

ÉireHome Flow is a free, educational website for people buying their first home in Ireland. It offers a step-by-step guide, a progress tracker (My journey), a buying power calculator and optional free accounts. It is trading as ÉireHome Flow.

The controller responsible for your personal data is ÉireHome Flow, Ireland. You can contact us at eirehomeflow@gmail.com.

In this policy, "we", "us" and "our" mean ÉireHome Flow. "You" means anyone who visits the site or has an account.

This policy explains what personal data we handle, why we handle it, who else receives it and what rights you have. It is written to meet the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the Irish ePrivacy Regulations (S.I. No. 336 of 2011). Please read it together with our Terms of use.

What we collect

When you visit, with or without an account

• Technical data sent by your browser. No website can be delivered without your device's IP address. Your browser also sends details such as your browser type (user agent), the page requested and the time. Our hosting provider, GitHub, logs the IP address of every visitor for security. When a page loads, your browser also downloads the Supabase code library from jsDelivr, a content delivery network, so jsDelivr and its network partners receive this technical data too. We do not receive or see these logs.
• Data kept in your browser. Your journey progress (which steps you have ticked) and the figures you type into the calculator (such as salary, savings, gifts, property price, interest rate and term, and whether the home is new or second-hand) are saved in your browser's storage on your device, together with a note that you saved them to your journey, so My journey can show your own figures on the steps they belong to. Calculator figures are never sent to us or to anyone else. Journey progress is sent to us only if you have an account and are signed in. If you choose a language for the site, your browser keeps that choice too, with a copy of the site's text in that language. The section on browser storage and cookies below has the details.

Our fonts, images and translations are served from our own site, so no font, image or translation service is told about your visit. The translations are written in advance: nothing you read or type is sent to a translation service.

When you create an account

• Your full name, which you enter when you sign up, or which comes from your Google account if you sign in with Google. You can change it on My profile.
• Your email address.
• Your password, if you sign up with your email. Supabase stores it in hashed (scrambled) form. We never see it. If you sign in with Google, we hold no password for you.
• If you sign in with Google: the name, email address and profile picture link on your Google account, and the identifier Google uses for your account. Google shows you what it will share before you continue. We do not receive your Google password or anything else from your Google account.
• The date you created your account and the time you last signed in.
• Your journey progress: which of the 31 steps you have marked as done, and when your progress was last updated.
• Security records that Supabase keeps: logs of events such as signing up, signing in and resetting your password, and a record of each browser or device where you are signed in. These include your IP address, your browser user agent and the time. In this policy we call them authentication logs.

We do not ask for your address, phone number, PPS number, bank details or documents, and your account does not hold your calculator figures.

Account emails

We send emails only about your account or the service. Our account system sends two automatic emails: one to confirm your email address when you sign up, and one to reset your password when you ask for it. Each contains a link to complete that step.

In a few cases we may also email you ourselves, for example to warn you before we delete an inactive account, to tell you why we have suspended or closed your account, or to tell you before ÉireHome Flow closes. We do not send marketing emails or newsletters.

All these emails are sent through our email provider, currently Google (Gmail), using your email address.

The logo in these emails is published with our website on GitHub. When your email app displays images, it downloads the logo from GitHub, which can see the IP address of your device or of your email provider. We do not use this to check whether you have opened an email.

When you email us or use our contact form

If you write to us, we receive your email address, your name if you include it, and whatever you choose to tell us. Our mailbox is provided by Google (Gmail).

If you use the form on our Contact us page, we receive your name, your email address, the topic you choose, your message and the language the site was showing. We also keep a scrambled (hashed) form of your IP address, made with a secret key, so we can limit how many messages can be sent from one connection in an hour. We cannot turn it back into your IP address. The form keeps a copy of your message in our database at Supabase, in Ireland, and Resend delivers it to our mailbox.

Where your data comes from

We get your data from you, or from your device when you use the site. If you choose to sign in with Google, Google sends us your name, email address and profile picture link, with your permission. We do not buy data about you or receive it from anyone else.

Why we use your data and our legal basis

The law requires a legal basis for each use of personal data. Ours are:

• Creating and running your account. This covers signing up, signing in, keeping your name and email address, and saving your progress so you can pick it up on any device. Legal basis: performance of a contract with you (Article 6(1)(b) GDPR), namely our Terms of use.
• Sending account emails. Confirming your email address, resetting your password and the occasional messages about your account or the service described above. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Keeping accounts and the site secure. Authentication logs help detect and prevent abuse and unauthorised access to accounts. Legal basis: our legitimate interest in protecting the service and the people who use it (Article 6(1)(f) GDPR).
• Delivering the website. Sending pages and the code library to your browser needs your IP address. Legal basis: our legitimate interest in providing a working website that you have chosen to visit (Article 6(1)(f) GDPR).
• Answering your emails and contact form messages. Legal basis: our legitimate interest in replying to people who contact us (Article 6(1)(f) GDPR). When you use one of your data protection rights, we handle your request to meet a legal obligation (Article 6(1)(c) GDPR). We keep a record of the request and our reply because of our legitimate interest in being able to show that we met the law (Article 6(1)(f) GDPR).
• Protecting the contact form from spam. The scrambled IP address lets us stop one connection from sending many messages. Legal basis: our legitimate interest in keeping the form usable and our mailbox free of abuse (Article 6(1)(f) GDPR).
• Legal claims. Where necessary, we may keep and use data to establish, exercise or defend legal claims. Legal basis: our legitimate interests (Article 6(1)(f) GDPR).

Where we rely on legitimate interests, we have weighed our interests against your rights and kept the data involved to a minimum. You can ask us for more detail about this.

We do not rely on your consent for any of the uses above.

Do you have to give us your data?

No. You can read the guide, use My journey and use the calculator without giving us any personal data. To create an account, you must give a name, an email address and a password. Without them we cannot create an account for you. Authentication logs are part of how accounts are kept safe, so they come with having an account.

What we do not do

• We do not use analytics, advertising or tracking pixels.
• We do not sell or rent your data, and we do not share it for marketing.
• We do not build profiles about you.
• We do not make decisions about you by automated means that have legal or similarly significant effects. The calculator runs only in your browser and gives general estimates. It makes no decision about you.
• We do not pass your details to lenders, mortgage brokers or anyone else, and we receive no commissions or referral fees.

Who receives your data

We use a small number of service providers. Each one receives only what it needs to do its job.

• Supabase (Supabase Pte. Ltd., Singapore) runs our account system and database. It stores your account details, your progress, the authentication logs and the messages sent through our contact form. Our Supabase project is hosted on Amazon Web Services servers in Ireland (region eu-west-1). Supabase acts as our processor under its data processing addendum, which means it may use your data only on our instructions. See the Supabase privacy policy.
• GitHub (GitHub, Inc., USA) hosts the website. It also serves the logo used in our emails. GitHub logs the IP address of every visitor for security purposes, whether or not the visitor has a GitHub account. GitHub handles these logs under its own privacy statement. We do not have access to them.
• jsDelivr (Volentio JSD Limited, United Kingdom) is a content delivery network. It delivers the Supabase code library that our pages load. jsDelivr and the network partners it uses (currently Cloudflare, Fastly, Bunny and GCore) receive your IP address and the details your browser sends. jsDelivr says it uses this data to run and protect its service and to publish download counts for each file. See the jsDelivr privacy policy.
• Resend (Plus Five Five, Inc., trading as Resend, USA) delivers the messages sent through our contact form to our mailbox. It receives what you enter in the form. Resend acts as our processor under its data processing agreement. See the Resend privacy policy.
• Google provides the email service (Gmail) we use to send account emails and to receive your messages. Google processes your email address and the content of these emails. If you choose to sign in with Google, Google also confirms who you are and sends us the details listed above, and so knows that you signed in to ÉireHome Flow. See the Google Privacy Policy.

We may also disclose personal data where the law requires it, for example to comply with a court order, or where necessary to establish, exercise or defend legal claims. We do not share it with anyone else.

International transfers

Our account database is kept in the European Economic Area (EEA), in Ireland. Some of our providers, or their partners, may still process data outside the EEA. This is how each of them protects it:

• Supabase is a Singapore company. It and its sub-processors may access data from outside the EEA, including from Singapore and the US. These transfers are covered by the European Commission's Standard Contractual Clauses, which form part of Supabase's data processing addendum.
• GitHub is based in the US. GitHub, Inc. is certified under the EU-US Data Privacy Framework, which the European Commission has found to provide adequate protection. GitHub also relies on Standard Contractual Clauses.
• Resend is based in the US and processes data there. Plus Five Five, Inc. is certified under the EU-US Data Privacy Framework, and its data processing agreement also includes the European Commission's Standard Contractual Clauses.
• Google may process data in the US and other countries. Google LLC is certified under the EU-US Data Privacy Framework, and Google uses Standard Contractual Clauses where a transfer is not covered by an adequacy decision.
• jsDelivr is based in the United Kingdom, which the European Commission has found to provide adequate protection. Its network partners serve files from servers around the world, so your browser's request may be handled outside the EEA, for example in the US. jsDelivr's privacy policy says that data may be transferred to and kept on computers outside your country. We do not choose which server handles your request.

You can ask us for more information about these safeguards, or for a copy of them where one is available, by emailing us.

How long we keep your data

• Account details and progress: for as long as your account exists. When you delete your account on My profile, it is deleted straight away, with your progress. When you ask us by email instead, we delete it within one month.
• Inactive accounts: if nobody signs in to an account for 24 months, we will delete it, with its progress. We will email the account's address at least 30 days before. To keep your account, sign in before the date given in that email.
• Authentication logs: Supabase's logs of sign-up, sign-in and password events are deleted after no more than 7 days. The record of a signed-in browser or device is deleted when that session ends, for example when you sign out, or when your account is deleted.
• Backups: if our Supabase plan includes backups, deleted data may remain in them until they expire, which takes no more than 14 days.
• Account emails in our mailbox: Gmail may keep a copy of each account email we send. We delete these copies within 90 days.
• Emails and contact form messages you send us: for as long as we need to deal with your message, then for up to 2 years after our last reply, in case you follow up or there is a dispute. This includes a record of any data protection request and how we handled it.
• The copy of contact form messages in our database: for the same period as the emails, then deleted, with the scrambled IP address.
• Resend's delivery logs: Resend keeps a record of each message it delivers for a short period set by our plan, then deletes it.
• Data in your browser: stays on your device until you clear it, or until it is removed as explained in the next section.
• Logs kept by GitHub and jsDelivr: these companies set their own retention periods under their privacy policies. jsDelivr says it keeps usage data that has not been turned into statistics only until it has been analysed, and then deletes it.

Browser storage and cookies

Our site does not set any cookies. It does use your browser's storage on your device, as follows:

• eirehome-flow (localStorage): keeps your journey progress, the figures you enter in the calculator and whether you have saved them to your journey, so they are still there when you come back and My journey can show them. It stays until you clear your browser's data for our site. Signing out clears your journey progress from it, and resetting your progress clears the ticks. Calculator figures never leave your browser.
• eirehome-flash (sessionStorage): holds a one-time notice, such as "You have signed out", while you move from one page to the next. It is deleted as soon as the notice is shown, or when you close the tab.
• Supabase session (localStorage, under a key that starts with sb- and ends with -auth-token): used only while you are signed in. It holds a session token that keeps you signed in as you move between pages and come back later. It is removed when you sign out.
• eirehome-google (sessionStorage): used only when you choose to sign in with Google. It remembers, for up to 15 minutes, which page to take you to when you come back from Google. It is deleted when you come back, or when you close the tab.
• eirehome-locale (localStorage): the language you choose in the language menu, so the site stays in that language when you come back. It stays until you choose another language or clear your browser's data for our site. If you never choose one, the site follows the language settings of your browser and nothing is stored.
• eirehome-locale-preview (sessionStorage): used only when you open a link to our site that ends in ?lang= and a language code. It keeps that language for the pages you open in the same tab, without changing the language you chose. It is deleted when you close the tab.
• eirehome-i18n: followed by a language code and a section name (localStorage): copies of the site's text in your language, and in English as a fallback, so each page opens in your language straight away. They hold no personal data. A copy is replaced when we change the text, and the copies for other languages are deleted when you choose a new language.

Under Regulation 5 of the ePrivacy Regulations (S.I. No. 336 of 2011), a website does not need your consent to store information on your device where this is strictly necessary to provide a service you have asked for. Each item above is used only for a feature you choose to use: tracking your journey, using the calculator, seeing a notice after you sign in or out, coming back to the right page after signing in with Google, staying signed in, and seeing the site in your language. None is used for analytics, advertising or tracking. That is why we do not show a cookie banner.

You can clear this storage at any time in your browser settings. If you block it, the guide and the calculator still work, but your progress and figures are lost when you leave or reload the page, and you may not stay signed in as you move between pages.

Your rights

Under the GDPR, you have the right to:

• Access: get a copy of the personal data we hold about you and information about how we use it.
• Rectification: have data that is wrong or incomplete corrected. You can change your name yourself on My profile.
• Erasure: have your data deleted, including your account.
• Restriction: ask us to limit how we use your data, for example while we check whether it is accurate.
• Objection: object to our use of your data where we rely on legitimate interests.
• Portability: receive the data you gave us (your name, email address and progress) in a structured, machine-readable format, or have it sent to another organisation where this is technically possible.
• Withdraw consent: we do not currently rely on consent. If we ever do, you will be able to withdraw it at any time. This will not affect anything we did before you withdrew it.

Your right to object. You can object at any time, on grounds relating to your particular situation, to our use of your data based on legitimate interests. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

Some of these rights have limits set by law. If we cannot fully meet a request, we will tell you why.

How to use your rights

You can do some things yourself on the site:

• See and change your name on My profile.
• Change your password on My profile.
• Reset your progress on My journey. This clears the ticks in your browser and, if you are signed in, in your account.
• Sign out. This clears your journey progress from that browser. The copy in your account stays.
• Clear the data kept in your browser through your browser settings.

To delete your account, use "Delete my account" on My profile. It deletes your account and your saved progress straight away. If you cannot sign in, email us instead. For anything else, email eirehomeflow@gmail.com.

Please email us from the address linked to your account, so we can confirm the request is yours. If we cannot confirm who you are, we may ask for more information, but only what we need to check.

We will reply within one month of receiving your request. If a request is complex, or you send several, we may extend this by up to two more months. If so, we will tell you within the first month and explain why. Using your rights is free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why.

How to complain

If you are unhappy with how we handle your data, you can contact us first and we will try to put it right. You do not have to. You have the right to complain to the Data Protection Commission (DPC), Ireland's data protection authority:

• Website: www.dataprotection.ie
• Post: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland

If you live or work in another EU or EEA country, or the issue happened there, you can also complain to the data protection authority in that country.

How we protect your data

• Connections to our site, to Supabase and to jsDelivr are encrypted (HTTPS).
• Supabase stores passwords in hashed form, so no one at ÉireHome Flow can read them.
• Database rules (row level security) allow each signed-in person to read and change only their own progress.
• Supabase says it encrypts all stored customer data.
• Only the person who runs ÉireHome Flow can access the Supabase, GitHub and email accounts behind the site, and these accounts are protected with two-step verification.
• Calculator figures stay in your browser, so they cannot be exposed through our systems.

No system is completely secure. Please use a strong password that you do not use anywhere else, and sign out on shared devices. If a personal data breach is likely to put your rights at risk, we will report it to the DPC within 72 hours where the law requires. If the risk to you is high, we will also tell you without undue delay.

Children

ÉireHome Flow is for adults aged 18 or over. It is not aimed at children, and children should not create an account. If you think someone under 18 has created an account, please email us and we will delete it.

Changes to this policy

We may update this policy when our service, our providers or the law change. The date at the top shows when it was last updated. If we make significant changes, we will put a notice on the site before they take effect.

Contact us

If you have a question about this policy or your data, email eirehomeflow@gmail.com. You can also read our Terms of use.