Watch demo

Tools

Enquiry forms & Estimates

Stay on top of your heat pump enquiries and cut out the time-wasters

Quote & Proposal

Professional proposals that showcase your expertise and are easy to approve

Quality Management System

Be fully MCS compliant with our in-built QMS system

Pipework & Drawings

New

Draw new & existing piping runs, and generate detailed CAD-style drawings

Survey, Heat loss & Design

Speed through surveys to system designs and create beautiful reports

Install & Handover

Every document pre-filled and ready - from DNO to installation to handover

Sub-processor List

Version 1.0

21 September 2026

Previous versions are listed at the foot of this page as they are superseded.

These Sub-processors process personal data on behalf of Subscribers as part of the Services. Clause 9 of the Data Processing Agreement (including the 14-Business-Day objection right) applies; changes are notified by email to each Subscriber’s notice address. Spruce’s primary production systems are hosted in the UK (London) with encrypted backups in the EEA (Frankfurt).

Sub-processors

DigitalOcean

Legal entity and country: DigitalOcean, LLC (US)
Service: Cloud infrastructure hosting
Personal data processed: All platform data
Location: Compute and databases: UK (LON1). Object storage and backups: FRA1 (Frankfurt, EEA)
Transfer mechanism: Storage and processing in the UK/EEA. US support and administrative access: EU-US Data Privacy Framework and UK Extension (certified); EU SCCs and UK Addendum incorporated in the DigitalOcean DPA
Privacy contact: privacy@digitalocean.com

Browserless

Legal entity and country: Browserless.io, Inc. (US)
Service: Server-side document rendering (proposals, reports)
Personal data processed: Transient rendering of document content, including homeowner names, addresses and property data; nothing held at rest
Location: UK (London region endpoint)
Transfer mechanism: Data processed in the UK (London region endpoint) and not stored at rest. Spruce is finalising Browserless’s data processing terms (EU SCCs and UK Addendum) for any US support access and will update this entry on completion
Privacy contact: support@browserless.io

Postmark

Legal entity and country: ActiveCampaign, LLC, operating as Postmark through AC PM LLC (US)
Service: Transactional email delivery
Personal data processed: Recipient names, email addresses and message content; message content retained 45 days
Location: United States
Transfer mechanism: EU-US Data Privacy Framework and UK Extension (ActiveCampaign — certified); EU SCCs and UK Addendum incorporated in the ActiveCampaign DPA
Privacy contact: privacy@activecampaign.com

Sentry

Legal entity and country: Functional Software, Inc. (US)
Service: Application error monitoring
Personal data processed: Error records, which may include limited personal data from the platform (for example a homeowner name or address within an error) needed to diagnose an issue; retained 6 months
Location: United States
Transfer mechanism: EU-US Data Privacy Framework and UK Extension (certified); EU SCCs and UK Addendum incorporated in the Sentry DPA
Privacy contact: legal@sentry.io

PostHog

Legal entity and country: PostHog, Inc. (US)
Service: Product analytics
Personal data processed: User-action event data, which may include personal data entered into the platform; retained 60 days, then aggregated statistics only
Location: EU — PostHog Cloud EU (Frankfurt)
Transfer mechanism: Data at rest in the EEA; US support access under the EU-US Data Privacy Framework and UK Extension (certified); EU SCCs and UK Addendum incorporated in the PostHog DPA
Privacy contact: privacy@posthog.com

Google Workspace

Legal entity and country: Google Cloud EMEA Limited (IE) / Google LLC (US)
Service: Business email and documents
Personal data processed: Personal data only where customers include it in email or shared files sent to Spruce
Location: United States
Transfer mechanism: EU SCCs incorporated by reference in the Google Cloud Data Processing Addendum (with UK GDPR coverage); Google LLC is certified under the EU-US Data Privacy Framework and UK Extension
Privacy contact: Google’s Cloud Data Protection Team via the Workspace admin console (privacy.google.com/businesses)

Slack

Legal entity and country: Slack Technologies, LLC, a Salesforce company (US)
Service: Internal communications
Personal data processed: Incidental personal data in support and operations discussion
Location: United Kingdom (UK data residency)
Transfer mechanism: Data at rest in the UK; US support access under the EU-US Data Privacy Framework and UK Extension (Salesforce — certified); EU SCCs and UK Addendum in the Salesforce Data Processing Addendum
Privacy contact: privacy@salesforce.com

Notion

Legal entity and country: Notion Labs, Inc. (US)
Service: Internal documentation
Personal data processed: Incidental business contact data; homeowner personal data is not permitted in Notion under Spruce policy; listed out of caution
Location: United States
Transfer mechanism: EU-US Data Privacy Framework and UK Extension (certified); EU SCCs and UK Addendum in the Notion Data Processing Addendum
Privacy contact: privacy@makenotion.com

Linear

Legal entity and country: Linear Orbit, Inc. (US)
Service: Project and incident tracking
Personal data processed: Incident and project metadata and incidental business contact data; homeowner personal data not permitted in tickets under Spruce policy (DPA Annex B); listed out of caution
Location: United States
Transfer mechanism: EU SCCs and UK Addendum deemed entered into under the Linear DPA
Privacy contact: security@linear.app

Notes

Postmark, Sentry, Google Workspace, Notion and Linear are US-hosted; Spruce relies on the transfer mechanisms above together with data minimisation (message content retained by Postmark for 45 days; limited diagnostic data in Sentry with 6-month retention and no homeowner personal data in Notion or Linear by policy, both of which are contractual commitments in Annex B of the Data Processing Agreement). Grafana is self-hosted by Spruce in the UK and is not a Sub-processor. Mixpanel and Cosmic Velocity, listed in Spruce’s 2024 terms, are no longer used.

Spruce’s own service providers

These providers process personal data for which Spruce is the Controller (for example account, billing and business-contact data). They are not Sub-processors and clause 9 of the Data Processing Agreement does not apply to them; they are listed here for transparency and are described in the Privacy Policy and the Cookie Policy.

Stripe

Legal entity and country: Stripe Payments Europe, Ltd (IE) / Stripe Payments UK, Ltd (UK)
Service: Payments (card and direct debit)
Location: EU/UK; intra-group transfers under the EU-US Data Privacy Framework and SCCs

Attio

Legal entity and country: Attio Ltd (UK)
Service: CRM
Location: EU/UK

Woodpecker

Legal entity and country: Woodpecker.co S.A. (PL)
Service: Business outreach
Location: EU

Framer

Legal entity and country: Framer B.V. (NL)
Service: Website platform
Location: EU

Website analytics and advertising tools

Legal entity and country: Fathom Analytics, Microsoft Clarity, PostHog, Segment, Meta, LinkedIn, Google, Microsoft Advertising
Service: As described in the Cookie Policy
Location: As described in the Cookie Policy

Previous versions

Version 1.0 (21 September 2026) is the first published version of this list. Sub-processors were previously listed in Annex A of the Data Processing Agreement (versions 2.0 and 2.1) and in Spruce’s 2024 terms; copies of those documents are available from Spruce on request.