House DeskVersion: 1.2
Last updated: 02/10/26
Provider: Stow Quill Ltd trading as House Desk
This list is for customers who use House Desk to process staff and workplace data. It explains which third-party services may process personal data when providing the platform. Staff end users are not asked to accept this list on login.
About this list
Where House Desk acts as a processor for your organisation, we use trusted subprocessors to host, secure and operate the service. Subprocessors only receive personal data where needed to perform their function.
This list should be read with our Data Processing Agreement, Privacy Notice, and Data Retention Policy.
We may update subprocessors from time to time. Where required by our DPA, we will give customers notice of material changes and a reasonable opportunity to object on legitimate data protection grounds.
Key subprocessors
| Service | Provider | Purpose | Data involved | Location |
|---|---|---|---|---|
Google Firebase / Google Cloud Hosting & infrastructure Provider privacy info | Google Ireland Ltd / Google LLC | Core platform: authentication, database (Firestore), file storage, serverless functions, web app hosting, operational logging and security. | Staff profiles, workplace records (rotas, clock-in, timesheets, training, incidents, messages, documents), account data, technical logs, authentication identifiers, AI conversation and memory records where the customer enables House Desk AI. | United Kingdom / European Economic Area / United States (subject to safeguards) |
Firebase Authentication Authentication & transactional email Provider privacy info | User sign-in (email/password, phone verification where enabled), session management, password reset and account security emails. | Email address, phone number, user ID, authentication events. | United Kingdom / EEA / United States (subject to safeguards) | |
Firebase Cloud Messaging (FCM) Push notifications | Deliver web push notifications to authorised users who opt in on their device. | Device push tokens, notification content, delivery metadata. | United Kingdom / EEA / United States (subject to safeguards) | |
Stripe Payments Provider privacy info | Stripe Payments UK Ltd / Stripe Inc | Process subscription payments, billing portal, invoices and payment status for customer accounts (business billing contacts). | Billing contact name and email, business name, subscription and payment metadata. House Desk does not receive full card numbers. | United Kingdom / United States / other Stripe processing locations |
OpenAI API Generative AI (optional feature) Provider privacy info | OpenAI, L.L.C. / OpenAI Ireland Ltd (as applicable) | Power House Desk AI (optional, owner-enabled): route questions, generate assistant replies, summarise short durable memory notes, and produce optional venue briefings. API requests are configured not to be stored by OpenAI for model training where the product integration sets store=false; processing still occurs on OpenAI systems to return a response. | User prompts and recent chat turns; page/module context labels; personality instructions; consented excerpts of operational or settings data selected for that question; short memory notes. Not a full account database dump. | United States / European Economic Area (subject to safeguards) |
Google Places API Maps & place data (optional) Provider privacy info | Help customers link sites to place names and addresses during setup; may fetch public place and review metadata where enabled. | Site/venue search queries, place identifiers, formatted addresses, and public review metadata (not routine staff HR records). | United Kingdom / EEA / United States (subject to safeguards) | |
Open-Meteo Weather data (optional feature) Provider privacy info | Open-Meteo (community weather API) | Provide weather summaries for rota planning and demand signals where a customer enables weather features for a site. | Site coordinates (latitude/longitude) sent to retrieve forecast data. No staff names are required for this integration. | European Union (API operator location may vary) |
Meta Graph API (Facebook / Instagram) Social platforms (optional Socials feature) Provider privacy info | Meta Platforms Ireland Ltd / Meta Platforms, Inc. | Where a customer enables Socials and connects a Facebook Page (and linked professional Instagram), House Desk syncs recent posts, can create boost campaigns on the customer's Meta ad account, and can receive/send Messenger and WhatsApp messages through AI Comms (House auto-reply or staff takeover). Tokens are stored server-side only. | Page/Instagram identifiers, usernames, OAuth tokens, cached post captions/media/permalinks, ad account ids and boost metrics, and Meta message content for connected venues. | European Economic Area / United States (subject to Meta terms and safeguards) |
Optional or customer-controlled
- Payroll exports: CSV or similar files generated in House Desk for download by your organisation. Exports are prepared for use in your own payroll systems (for example Xero or other providers you choose). Those systems are your responsibility and are not House Desk subprocessors unless we add a direct API integration and list it here.
- Weather and sports features: only used when enabled for a site. They generally process location or public event data, not routine staff identity data.
- Google Places: used during site setup or demand-signal configuration, not for day-to-day roster processing.
Changes and enquiries
To request a copy of this list, ask about international transfers, or object to a new subprocessor on data protection grounds, contact mike@housedesk.co.uk.