Privacy

Who we are

GAFFY is operated by PROJECT X 44 LTD (Companies House 16175190, VAT GB500722246). We are the data controller for the information described here. Contact us any time at graham@project44.london.

What we store

• Account details. Landlord email address and password (stored hashed by our authentication provider). Tenants sign in with a one-time email link — no password is kept.
• Tenants. Name, mobile number (required so we can route maintenance to the right property), and optional email. Tenants can also give name, mobile, optional email and photos when they submit a maintenance request via a property link.
• Maintenance requests. Issue description, urgency, the name and contact detail a tenant chooses to give, photos they attach, plus the landlord's own notes, vendor and repair cost.
• Property documents. Files a landlord uploads — leases, gas safety CP12s, EPCs, EICRs, insurance, invoices and receipts — with the file name, type tag and any expiry date.
• Properties and units. Property name, address, unit labels and vendor contact details.
• Unmatched messages. When an inbound maintenance message comes from a number we do not recognise, we temporarily hold the phone number and message content in a landlord "Needs linking" queue until the landlord assigns it to a tenant and property.

Why we store it (UK GDPR)

We rely on contract to run the service for landlords who sign up, and on legitimate interests to pass a tenant's maintenance report to their landlord. We do not sell data, we do not run advertising profiling, and we do not carry out credit or background screening.

Phone routing and "Needs linking"

We use the tenant mobile number so inbound maintenance — and, when WhatsApp is live, WhatsApp messages — can be filed against the correct property. If a message arrives from a number we do not recognise, it goes into the landlord's "Needs linking" queue as an unmatched message until the landlord assigns it. The purpose is solely to route maintenance to the correct property, not for marketing.

Who can see what

Documents remain landlord-only. A tenant using a property link can submit a request and see the thank-you screen; they do not see the document vault or other tenants. Tenants who sign in with an email link can see only requests raised with their own email address. Our hosting and database provider processes this data on our behalf inside the UK/EU or under equivalent safeguards.

How long we keep it

Account, tenant, request, unmatched-message and document data is kept while your account is open, and deleted within 30 days of you asking us to close or delete the account. Uploaded documents and request photos are removed from storage at the same time.

Your rights

You can ask for a copy of your data, correction, deletion, restriction, or object to processing. Email graham@project44.london and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We only store what is needed to keep you signed in. No advertising or analytics tracking cookies are used during early access.