Privacy policy

What we collect

Account data: your name, email address, company name, country and a hashed password.

Usage data: the jobs, clients, subcontractors, leads, quotes, photos and documents you add, and your wallet and plan activity.

Technical data: sign in sessions, IP address and browser type, kept for security and rate limiting.

Payment data: card payments are handled by Stripe. We never see or store full card numbers.

Call data: when a member logs a call, how it went and any note they add. When a member uploads a call recording or a voice note recap, the audio, its length, a transcript and notes written by AI. Calls made before October 2026 may also hold the numbers, length, a recording, a transcript and notes written by AI.

Why we use it

To run your account and the service you ask for (contract).

To keep the service secure and prevent abuse (legitimate interests).

To send service emails such as verification, invites, reminders and receipts (contract and legitimate interests).

To meet our legal and tax duties (legal obligation).

Contact data you add

When you use Lead Finder, outreach, ads or campaigns, you may add or collect business contact details. You decide who to contact and you must have a lawful basis to do so. Our acceptable use policy sets the rules for email. Leads that come from ads are shared with the member whose campaign produced them.

Calls

The Call buttons in Gaffio open the member's own phone. Gaffio does not place, record or listen to calls. The member can log how a call went and add a note, which is internal to the member's company.

A member can upload a call they recorded on their own phone, or a voice note recap of it. The member is responsible for telling the other person that the call is recorded. The audio is transcribed (Deepgram) and summarised by AI (Anthropic) for the member's own team. It is never used to train AI models and never used for automated decisions about anyone. The audio is deleted after 90 days. The transcript and notes stay on the member's lead until the member deletes the lead or the account closes.

Some calls made before October 2026 were recorded after a spoken notice to both sides, transcribed and summarised by AI. Those recordings, transcripts and notes are internal to the member's company, never used to train AI models and never used for automated decisions about anyone. They are deleted after 90 days by default, or the period the member's company set. The record that a call happened, its length and its charge are kept with the financial records.

If you were called by a member and want a copy of a recording or want it deleted, contact that company, or email hello@gaffio.com and we will pass your request on.

Who we share data with

Service providers who help us run the product: hosting and database (Supabase), payments (Stripe), WhatsApp messages (Meta), AI notes on calls and ads (Anthropic), voice note transcripts (OpenAI), uploaded call transcripts (Deepgram), email delivery (Resend and outreach mailbox providers), advertising (Meta), lead data (Apify and Companies House) and maps and postcodes.

We do not sell personal data. We share data with authorities only when the law requires it.

How long we keep it

We keep account data while your account is open and for a limited time after, so we can deal with disputes and meet tax rules. Financial records are kept for six years. Call recordings, transcripts and call notes made before October 2026 are kept for 90 days by default, or the period the member's company set, then deleted. Uploaded call audio is deleted after 90 days; its transcript and notes are kept with the lead. You can ask us to delete other data sooner.

Your rights

You can ask to see, correct, delete, restrict or move your personal data, and object to how we use it. Email hello@gaffio.com. You can also complain to the Information Commissioner's Office at ico.org.uk.

Transfers outside the UK

Some providers may process data outside the UK. Where they do, we rely on UK approved safeguards such as adequacy regulations or the international data transfer agreement.

Cookies

We use essential cookies only. See the cookie notice for details.

Changes

We will post changes on this page and update the date at the top.