Effective date: 10 September 2026
This register identifies material third parties used to operate Orchard. A provider may be a processor, sub-processor or independent controller depending on the service and applicable law. The corresponding provider terms determine its precise role.
| Provider | Service and data | Primary processing location | Role and safeguards |
|---|---|---|---|
| IONOS group Contracting entity identified for the production account: IONOS Inc. | Application, database, backup and storage hosting; content delivery; server and error logs; transactional email. May process Customer Data, account data, message content and technical logs. | European Union for Orchard's configured hosting, database, backup and email services. | Processor/sub-processor under applicable IONOS data-processing terms. Provider infrastructure includes physical and platform security, backup and availability controls. IONOS hosting privacy information. |
| Trustpilot A/S | Neutral service-review invitations for eligible Orchard managers. Receives the manager's name and email address and an opaque experience reference; the invitation locale is configured in Trustpilot Business. Orchard retains subscription tier and qualification evidence locally and does not send property, tenancy or financial details. | Denmark, the European Economic Area and other locations used by Trustpilot and its documented providers. | Processor for Orchard's invitation instructions and independent controller when a reviewer creates or manages a Trustpilot review. Transfers and security are governed by Trustpilot's business terms and Data Processing Agreement. Trustpilot DPA and Privacy Policy. |
| Cloudflare, Inc. | Turnstile bot and spam protection for abuse-sensitive public forms. May process IP address, user agent, TLS/browser signals, site key, origin and challenge result. | Global Cloudflare infrastructure. | Processor for Orchard's website-protection instructions and a separate controller where Cloudflare uses data to improve Turnstile. Restricted transfers are addressed through Cloudflare's DPA, Standard Contractual Clauses and applicable UK transfer safeguards. Cloudflare DPA and Privacy Policy. |
| Stripe Payments UK Limited and relevant Stripe affiliates | Subscription Checkout, Billing Portal, invoices, payment status, fraud prevention and Stripe Tax. Receives manager contact, plan, billing, tax, device and payment information. Stripe—not Orchard—stores full card credentials. | United Kingdom, EEA, United States and other locations used by Stripe and its providers. | Processor for certain business services and independent controller for regulated payment and fraud activities. Transfers are addressed by Stripe's DPA and Data Transfers Addendum, including the UK Addendum where applicable. Stripe DPA and Privacy Policy. |
| OpenAI, L.L.C. and relevant OpenAI affiliates | Read-only Orchard AI answers requested by property managers. Receives the manager's question and compact, manager-scoped structured results needed for the answer; uploaded file contents, private manager notes and screening scores are excluded from this workflow. | United States and other locations used by OpenAI and its providers, subject to contracted data controls. | Processor/sub-processor for API services. API data is not used to train OpenAI models by default. Orchard sends requests with provider-side response storage disabled; default abuse-monitoring retention may still apply. Restricted transfers must be covered by OpenAI's DPA and applicable UK/EU transfer safeguards. OpenAI DPA and Privacy Policy. |
| Google LLC and Google Ireland Limited | Google Maps Platform and Places for requested address search, coordinates and map display. Requests may include IP address, device/browser data, API credentials and map/search terms. Orchard's interface fonts are self-hosted and do not use Google Fonts at runtime. | Global Google infrastructure. | Service-provider/controller roles depend on the product. Google contractual transfer safeguards apply where required. Maps security and compliance, Google Privacy Policy. |
No current analytics or advertising provider
Orchard does not currently deploy a third-party product-analytics, behavioural-advertising, customer-support or external tenant-screening provider. Trustpilot is used only for neutral service-review invitations and reviews, not behavioural advertising. Orchard AI is an operational assistant requested by authenticated managers, not an analytics or advertising service. A material provider added later will be recorded here before or when it begins processing, subject to any required consent and customer notice.
Changes and objections
Orchard gives Customers at least 30 days' advance notice of a new material sub-processor, normally by email or in-Service notice and an update to this register. A Customer may object during that period on reasonable data-protection grounds by emailing privacy@orchardpms.com. Orchard will consider a commercially reasonable alternative; the DPA explains the available outcome if none is feasible.