Privacy

Who we are

Gaffy is a trading name of FORTYFOUR8 LTD, company number 17474844. Registered office: 44 Rivington Street, London, England, EC2A 3QP. We are the controller for the information described on this page. Email contact@gaffy.co or use the contact form. FORTYFOUR8 LTD is registered with the Information Commissioner's Office (ICO), registration number ZC283034. We do not quote a VAT number.

What we hold

• Landlord account details. The email address you sign up with, and a password stored hashed by our authentication provider. Profile and team membership for people you invite onto the portfolio.
• Property and tenancy information. Property names and addresses, units, tenancies, occupancy, contacts, tasks, notes, and income or expense entries you log.
• Tenant names, phone numbers and emails. Details you save, and the name, mobile number and optional email a tenant gives when they submit a repair through a property link.
• Repair photos. Images attached to a repair report. A report can include up to 5 photos, 10 MB each.
• Uploaded compliance documents. Files you put in the document vault, such as gas safety certificates, EPCs, EICRs, leases and licences, with the file name, type and any expiry date you enter. The product also stores other files you upload, including inventory photos and finance receipts.

While you are signed in, the app can record which screens you use (product analytics). You can turn that off in Settings. It is separate from advertising cookies.

Why we use it

We use account, property, tenancy, repair and document data to provide Gaffy under our contract with the landlord. We use a tenant's repair report, including their name, phone number, email and photos, so we can pass that report to their landlord. Signed-in product analytics is so we can see which parts of the app are used; you can opt out in Settings. Advertising measurement runs only after you accept cookies. We do not sell personal data.

Where it is stored

The database, sign-in (authentication) and uploaded files are hosted with Supabase in London, UK (AWS eu-west-2).

Who else processes it

• Supabase. Database, authentication and file storage.
• Lovable. Builds and serves this website. It does not hold the database, sign-in records or uploaded files. The host injects its own platform scripts, /~flock.js and /__l5e/events, for hosting and platform analytics. Those scripts are not controlled from this site's consent banner.
• Resend. Delivers email on two paths. Application mail is sent by this app through Lovable's connector gateway (connector-gateway.lovable.dev), which passes the message to Resend. That covers a landlord notification for a new repair, a draft that is ready, a task that is due or a warranty that is ending; a compliance reminder; a team invite; a trade draft when the landlord presses Send; the website contact form and an in-app support message, both delivered to contact@gaffy.co; a signup notice to contact@gaffy.co; and a lifecycle email sent as Gaffy from contact@gaffy.co when that job is switched on. If the lifecycle job is not switched on, it records what it would send and does not send it. If sending is not configured, a notification or reminder stays in the in-app activity record instead of being emailed. Sign-up confirmation, a resent confirmation, a password reset and a one-time sign-in link are sent by Supabase Auth over SMTP. Resend delivers those from contact@gaffy.co. A trade draft or a letter opened in the landlord's own email app is sent by that app. Gaffy only records that it was opened.
• Google Ads. The tag AW-18470628537, loaded through gtag, only after you accept cookies. It measures which ads lead to sign-ups.

How long we keep it

We keep this information while the account is open. The account owner can delete the account in Settings, which removes the portfolio records that deletion covers and closes the sign-in. To ask for a copy of your data, or to ask us to delete personal data, email contact@gaffy.co. We respond within one month.

Your rights

You can ask for a copy of your data, correction, deletion, restriction, or object to processing. Email contact@gaffy.co and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk). How files are served, and how tenant links are limited, is described on the security page.

Cookies and similar storage

Signing in uses a session stored by the browser. Your cookie choice is saved in this browser under the key gaffy_consent. Google Ads cookies are not loaded until you accept. You can change that choice from Cookie settings in the footer. Product analytics for a signed-in account is switched off from Settings, not from the cookie banner.