Privacy Policy
This policy explains what personal data Gaff collects, why, who it is shared with, and what you can do about it. It covers the Gaff mobile app and getgaff.co.uk.
Who we are
Gaff is operated by Jonathan Cramer, trading as Gaff, of Flat 8, 10 Canfield Gardens, Camden, London NW6 3JS, United Kingdom. We are the data controller for the personal data described here, for the purposes of the UK GDPR and the Data Protection Act 2018.
For anything in this policy, contact privacy@getgaff.co.uk.
What we collect
Account details
If you sign up with an email address, we store that address, your name, and your password. The password is only ever stored as a hash, which cannot be turned back into what you typed.
If you sign in with Google or Apple instead, we receive your name and email address from that provider and never see a password at all. We use that information only to create your account, sign you in and contact you about the Gaff service. If you use Apple and choose to hide your email, we only ever see Apple's private relay address, and that is what we use to contact you.
What you tell us about the home you want
The heart of the product: your requirements in your own words. That means your must-haves, your nice-to-haves, your budget range, minimum bedrooms, earliest move-in date and the areas you are looking in. Please avoid putting anything you would not want shared with a letting agent into these fields (see below).
Activity in the app
Which properties we have matched to you, and the status of each: for example whether you have applied, whether an agent has been contacted, or whether a viewing is booked.
Technical data
To keep you signed in and to keep the service working, we store session records including your IP address and device/browser user agent, plus diagnostic and crash reports.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating your account and keeping you signed in | Performance of a contract |
| Matching you to properties, and introducing you to letting agents | Performance of a contract |
| Understanding your written requirements using automated text analysis | Performance of a contract |
| Diagnosing crashes, preventing abuse, and improving the service | Legitimate interests: running a reliable, secure service |
| Marketing emails, if we ever send them | Consent, which you can withdraw at any time |
Automated analysis of what you write
To turn your description of the home you want into something we can match against, we send the text you write about your requirements to a third-party AI service, which returns a structured list of criteria. Your name and email are not needed for this and are not sent with it.
This analysis only ever orders and filters the properties you see. It makes no decision producing a legal or similarly significant effect about you, and it never decides whether you can rent a property. That decision belongs to the agent and the landlord. Your original words are always kept as written and are never overwritten by this process.
Who we share it with
Letting agents
This is the point of Gaff, so please read this part carefully. When we introduce you to a specific property, we send that property's letting agent the details needed to make the introduction: your name, contact details, and the relevant parts of your requirements, such as your budget, move-in date and what you are looking for. Each agent receives this in connection with a specific property.
Once an agent has your details, they act as an independent data controller and their own privacy policy applies to what they do next. We cannot delete data from an agent's systems on your behalf.
Service providers
We use third parties who process data on our instructions: cloud hosting and database providers, an AI provider for the text analysis described above, analytics and crash reporting, and email delivery. They may only use the data to provide their service to us.
We do not sell your personal data, and we do not share it with data brokers or advertisers.
Transfers outside the UK
Some of those providers are based outside the UK, so your data may be processed abroad. Where that happens we rely on UK adequacy regulations or on the International Data Transfer Agreement / Addendum with appropriate safeguards.
How long we keep it
We keep your account data for as long as your account exists. If you delete your account, we delete your personal data (your profile, your requirements and your matches) from our live systems without undue delay, and in any event within 30 days. Backups are overwritten on a rolling basis. We may keep a minimal record where the law requires it.
Introductions already sent to letting agents cannot be recalled, as described above.
Deleting your account
You can delete your account and its data at any time from within the app: open the Profile tab and chooseDelete account. It takes effect immediately and does not require you to contact us.
Your rights
Under UK data protection law you have the right to:
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it, including profiling;
- receive your data in a portable format;
- withdraw consent at any time, where we relied on consent.
To exercise any of these, emailprivacy@getgaff.co.uk. We respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office atico.org.uk, though we would appreciate the chance to put it right first.
Children
Gaff is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Security
Sessions are held in your device's secure keychain, traffic is encrypted in transit, and access to production data is limited. No system is perfectly secure, but we take this seriously.
Changes to this policy
If we change how we use your data we will update this page and the date at the top. Significant changes will be notified in the app.