Draft. This page has not been reviewed by a solicitor yet and must be reviewed before Gaffio takes real customers.
Privacy policy
Last updated 13/10/2026
This policy explains how Kavra Enterprises Ltd, trading as Gaffio, uses personal data. We are the controller for the data of people who use Gaffio. For contact details that members add to Gaffio, the member is the controller and we act as their processor.
What we collect
Account data: your name, email address, company name, country and a hashed password.
Usage data: the jobs, clients, subcontractors, leads, quotes, photos and documents you add, and your wallet and plan activity.
Technical data: sign in sessions, IP address and browser type, kept for security and rate limiting.
Payment data: card payments are handled by Stripe. We never see or store full card numbers.
Why we use it
To run your account and the service you ask for (contract).
To keep the service secure and prevent abuse (legitimate interests).
To send service emails such as verification, invites, reminders and receipts (contract and legitimate interests).
To meet our legal and tax duties (legal obligation).
Contact data you add
When you use Lead Finder, outreach, ads or campaigns, you may add or collect business contact details. You decide who to contact and you must have a lawful basis to do so. Our acceptable use policy sets the rules for email. Leads that come from ads are shared with the member whose campaign produced them.
Who we share data with
Service providers who help us run the product: hosting and database (Supabase), payments (Stripe), email delivery (Resend and outreach mailbox providers), advertising (Meta), lead data (Apify and Companies House) and maps and postcodes.
We do not sell personal data. We share data with authorities only when the law requires it.
How long we keep it
We keep account data while your account is open and for a limited time after, so we can deal with disputes and meet tax rules. Financial records are kept for six years. You can ask us to delete other data sooner.
Your rights
You can ask to see, correct, delete, restrict or move your personal data, and object to how we use it. Email hello@gaffio.com. You can also complain to the Information Commissioner's Office at ico.org.uk.
Transfers outside the UK
Some providers may process data outside the UK. Where they do, we rely on UK approved safeguards such as adequacy regulations or the international data transfer agreement.
Cookies
We use essential cookies only. See the cookie notice for details.
Changes
We will post changes on this page and update the date at the top.