The short version
- Your card goes straight to Stripe. We never see or keep the card number.
- The website sets no cookies. Its analytics count visits without working out who you are.
- Crew hand over a lot: right-to-work documents, a National Insurance number, bank details. The law and the job need them. Clients never see any of it.
- Crew location is used while the on-the-way screen (after they tap “Leave now”) or the on-shift screen is open, when the client watches it live on a map, and when a crew member goes live, opens the app while live (at most every 10 minutes) or presses “Update where I am”, to offer them work near where they are that day. The client never sees that one.
- Clients never see where crew live, whether they’re live or how many crew are live. A client sees their crew member’s position only once they’re booked and on the way or on shift. Details below.
- We don’t sell your data. We don’t run ads.
- We keep each kind of data for a set time, listed in how long we keep it. Deleting your account removes it sooner.
Who we are
Gaffr is a trading name of GAFFR LTD, a company registered in England and Wales (company number 17461178), registered office 66 Paul Street, London, England, EC2A 4NA. We decide what personal data is collected through gaffr.uk and the two apps and what it’s used for, which makes us the controller under UK data protection law.
Anything about this policy, including using your rights: hello@gaffr.uk. Post to the registered office works too. We haven’t appointed a data protection officer; a person at Gaffr reads that inbox.
This policy covers gaffr.uk, the Gaffr app and the Gaffr Live app. It replaces the Crew Privacy Notice v1.0 inside Gaffr Live, which is wrong in places (it says we don’t hold bank details, for one). Where the two disagree, this page is right.
Website visitors
The website waitlist (closed)
Gaffr and Gaffr Live are in the App Store and on Google Play, so since 3 November 2026 the site has no waitlist form. If you joined it before then, we still hold what you gave us: whether you book crew or are crew, your name, your email address, your company or discipline if you gave it, who brought you to Gaffr if you said, and the tags of the link you came from. It’s in our inbox, hello@gaffr.uk, and in Gaffr’s waitlist database, which only Gaffr’s team can see. We use it only to tell you the apps are out and, if you named who brought you, to pay them £50 once you’ve worked 5 shifts on Gaffr (Bring your crew). We delete it 12 months after you signed up. Want it gone sooner? Email us. Lawful basis: your consent, which you can take back any time.
Analytics
We count visits with Vercel Web Analytics. For each page view it records the page, the site that sent you, your country, your browser, operating system and type of device. It sets no cookies and stores nothing on your device. Vercel tells visits apart with a code built from your request and throws that code away after 24 hours, so it can’t follow you from one day to the next or across other sites. We see totals, never individuals.
Lawful basis: legitimate interests, in knowing which pages get used so we can make the site better. Don’t want to be counted? A content blocker stops the analytics script and the site works exactly the same without it.
Hosting
Vercel hosts the site. Like any web server, it sees your IP address, your browser details and the pages you ask for, and uses them to deliver the site and protect it from attacks. Pages come from the Vercel data centre nearest you. Lawful basis: legitimate interests, in running a website that works and stays up.
Share links
A crew member can share Gaffr with a link or a QR code. It opens a page on gaffr.uk with the app store links, and the end of its address is a code that stands for that crew member. The page also shows who sent it, so you know it’s from them: their first name, their Gaffr photo, the roles they work, how many shifts they’ve done on Gaffr and their star rating once they have three. It never shows their surname, contact details or checks, and it shows nothing of them if they’ve switched it off. Our website asks Gaffr’s back end for this when you open the page, with nothing about you in the request. The photo is a small resized copy with its hidden details, such as where it was taken, removed, and it comes inside the page, so your browser never contacts our back end or our file storage for it. The page’s title and the preview a chat app makes of the link show only Gaffr, never their name or photo.
When the page shows who sent it, it also shows their Gaffr code (the end of the link’s address), so you can type it in when you sign up, and links that open Gaffr or Gaffr Live at sign-up with it filled in. The code is only kept if you sign up with it, as the app says.
When the page opens, and when you press one of its store buttons, your browser tells us, and we add one to that crew member’s count for the day: how many times their link was opened, and which store button was pressed (which app, iPhone or Android). We keep nothing about you with it, or with showing the crew member: not your IP address, your device, a cookie or the time of day. Your browser’s description of itself is read once, to leave out link previews and search engine crawlers, and isn’t kept. The page isn’t counted in our analytics. As with every page (see Hosting), Vercel sees the requests themselves, the code in the address included, both yours to the website and the website’s to our back end. Lawful basis: legitimate interests, in knowing how Gaffr gets shared and who shares it.
Everything else
No ad tags, social media pixels, embedded videos or chat widgets. Our fonts are served from gaffr.uk, so your browser never contacts Google to fetch them. The cookies page has the full list of what the site and the apps store on your device.
Emailing us
Email to hello@gaffr.uk lands in our Google Workspace mailbox. We use what you send to answer you. Lawful basis: legitimate interests, or our contract with you if it’s about your account.
Clients: the Gaffr app
Clients are the producers, venues and crew chiefs who book crew through the Gaffr app. This is what the app collects and why. You can’t book without an account and a card on file; everything else is part of making a booking work.
What we collect
Your account
- Data
- Your name, email address, company name and a password. Supabase, our sign-in provider, stores the password scrambled; nobody at Gaffr can read it. You can sign in with a one-time email link instead. While we check a new account, a phone number and, if you tell us, what you book crew for. Only Gaffr sees those two; crew never do.
- Why
- To run your account and your bookings, and to check a new account before it books real crew (until then it works in demo mode, with made-up crew and nothing charged). We may also hold an account on our waitlist before it can use Gaffr; we keep that it is waitlisted and since when.
- Lawful basis
- Contract.
The app waitlist
- Data
- Sign-up tells you where Gaffr is live and doesn’t ask for your postcode. Booking somewhere else? You can join our app waitlist from sign-up, or from a booking whose venue we don’t cover: a name, an email address and where you need crew (a town or a postcode). No phone number. The email can be a colleague’s; nothing is sent to it unless we open there.
- Why
- To tell you if Gaffr opens where you need crew.
- Lawful basis
- Legitimate interests.
Sign-up checks
- Data
- Your IP address and your device’s user agent (the string that names your app or browser version) at sign-up, plus the two halves of your email address.
- Why
- A daily check compares these across accounts to catch duplicates and fakes. A match flags the account for a person at Gaffr to look at. It never blocks anyone on its own.
- Lawful basis
- Legitimate interests: preventing fraud and abuse.
A crew member’s code
- Data
- If you put in a crew member’s Gaffr code when you sign up (or the app fills it in from their link): which crew member it belongs to, how you gave it and when. If the code isn’t a crew member’s, we keep nothing.
- Why
- For Gaffr’s records of which crew member brought you. Nobody is paid for it.
- Who sees it
- Our team only. The crew member isn’t told, and the app doesn’t show it to you after sign-up. If you ask for a copy of your data, it says you signed up with a crew member’s code and gives the code, nothing more about them.
- Lawful basis
- Legitimate interests, in knowing how clients find Gaffr.
- How long
- While both accounts are open. Deleted when either is.
Your card
- Data
- Your card goes straight to Stripe, which stores it. We keep Stripe’s customer reference for you, a reference to your saved card (never the card number) and whether billing is set up. The app uses your camera only if you choose to scan your card.
- Why
- To hold and take payment for bookings. Stripe also uses your card and device details to prevent fraud, as a controller in its own right.
- Lawful basis
- Contract.
What you agreed to
- Data
- Which version of the fee structure and the payment terms you accepted, and when.
- Why
- So both sides can prove what was agreed.
- Lawful basis
- Legitimate interests.
Your bookings
- Data
- Venue address and postcode, the map pin and whether it came from the address or you placed it, access instructions, notes for crew (up to 500 characters), the site contact’s name, phone and email, your health-and-safety answers, times, your maximum rate, card holds, charges, extensions and any cancellation fee owed.
- Why
- To find crew, run the booking and charge for it.
- Lawful basis
- Contract, and legal obligation for the accounting records.
Ratings, reports and disputes
- Data
- Ratings you give and get (stars, comment, would book again), feedback about the app (free text and a 0–10 score), “Problem with this match” reports, “Crew didn’t show” claims, and “Block or report”: the reason and detail you give go to our team, and the block keeps you and that crew member apart for good. Reporting a past conflict with a crew member blocks them the same way. If you dispute a charge with your bank, we keep a copy of Stripe’s record of it.
- Why
- Fairness, safety, and sorting out problems and disputes.
- Lawful basis
- Legitimate interests, and contract.
Messages
- Data
- Messages you send and receive in the app: with the Gaffr team, and with your crew member on a booking. Each message is kept with who sent it, which conversation it is in, when it was sent and when you last read the conversation. Messages are plain text. We don’t open or follow links in them. If you report a conversation, we keep which conversation, the reason you pick and your note, never a copy of the messages.
- Why
- To let you and the person you’re working with sort out the day (where to go, how long, what’s changed), and to let our team help you.
- Lawful basis
- Contract, and our legitimate interests in running the service safely and settling complaints.
- Who sees it
- You and the other person in the conversation. A conversation with the Gaffr team can be read by anyone on our team; the messages show as from “Gaffr”, not a named person. Our team can also read a conversation between a client and a crew member when they need to: to deal with a safety concern, a complaint, a “Crew didn’t show” claim or a dispute about a booking. We record every time someone on our team reads one. If you report a conversation, our team reads it to deal with the report; and blocking someone stops messages between you, and any new offers or bookings between you. Messages are stored by Supabase (our database host). Supabase Realtime tells your phone a new one has arrived, with none of its words in it.
- Notifications
- When you get a message we send a notification to your phone through Google (Android) or Apple (iPhone). It shows the sender’s first name, or “Gaffr”, and up to the first 100 characters of the message. Nothing else about anyone is in it. Your phone may show it on your lock screen, depending on your settings.
- When you can message
- A client and their crew member can write to each other from 24 hours before the call time until 12 hours after the shift ends, or until the booking is cancelled. After that the conversation can still be read, but not added to.
- How long
- 365 days after the conversation closed. A conversation between a client and a crew member closes when the booking ends or is cancelled; we keep it longer only while that booking is still in question (a dispute, a card dispute or a “Crew didn’t show” claim not yet settled). A conversation with the Gaffr team is kept 365 days after its last message. A report you send about a conversation is kept as long as the conversation is, and deleted with it.
Notifications
- Data
- A push token from Apple (iPhone) or Google (Android), so we can send notifications to your phone.
- Why
- To tell you when crew accept, arrive or finish.
- Lawful basis
- Contract.
Your location
- Data
- Only if you tap “Use my current location” while choosing a venue: one reading of where your phone is, sent to our server, which asks Mapbox for the nearest street address. We don’t save it or log it.
- Why
- To fill in the venue’s address for you.
- Lawful basis
- Legitimate interests.
Approvals. When someone at Gaffr approves your email address before you sign up, we keep it, and your company name and a short internal note if we added them, so we can email you and approve your account once you confirm that address. If you don’t sign up, we delete it 12 months after we last sent or changed it. If you do, we keep it with your account and delete it when your account is deleted.
What crew see about you
- Every crew member offered your booking sees your name, your company name, the venue postcode, the skills needed and your health-and-safety answers. Not the street address.
- The crew member who accepts gets the full booking: venue address, access instructions, notes, the site contact’s name and phone number, and your name and company.
- Vetted crew near a booking who weren’t offered it may see its day, the part of the day (morning, afternoon, evening or night) and the role (and, for the last week, whether it was taken), never the time, its length, your name, company, venue, address or postcode. If their rate is above the most you’ll pay an hour, it may also say the booking pays less than their rate: never your maximum or any amount.
- Once a booking has happened, crew who’ve joined Gaffr in the same area (the letters the venue’s postcode starts with, such as B for Birmingham) may see its weekday, the part of the day and the role during the following week (Monday to Sunday), while their own documents aren’t approved yet, never the time, its length, your name, company, venue, address or postcode. Never your maximum or any amount of yours.
- After the shift you rate each other. Neither of you sees the other’s rating until both are in, or 14 days pass. Then the crew member can read your stars and comment on their profile, with the month of your rating and the role they worked, never your name or company. You can read theirs in the Gaffr app (Settings, Feedback from crew) the same way: their stars and comment, the month and the role, never their name. Once a rating is showing, the shift can no longer be rated. Gaffr can hide a piece of feedback, and records why (a comment that names someone else, for example). Hidden feedback leaves the apps and every star average shown in them; we keep it.
Crew: the Gaffr Live app
Crew find and work shifts through Gaffr Live. Sign-up is by invite. We ask crew for far more than clients, because the law and the job demand it: we have to check you can work in the UK, report your earnings to HMRC, and pay you.
You don’t have to give us any of it, but without the required parts (your legal name, date of birth, home address, mobile number, NI number, right to work, photo ID, insurance, bank details and a Stripe payout account) we can’t offer you work.
What we collect
Who you are
- Data
- Your email address (you sign in with it, and it’s the one we invited), display name, legal first and last name, mobile number, date of birth and profile photo.
- Why
- To run your account and show clients who’s coming. Your date of birth is checked on our server to confirm you’re 18 or over, and goes in the HMRC report.
- Lawful basis
- Contract, and legal obligation (HMRC reporting).
Your home address
- Data
- Your home address, the date you confirmed it, and a map point for it, which Mapbox works out from the address or you place by hand.
- Why
- To offer you work within reach, estimate your travel time and when to leave, set up your Stripe payout account, and report to HMRC, which asks us to reconfirm it every 36 months.
- Lawful basis
- Contract, and legal obligation (HMRC reporting).
Home address changes
- Data
- The dates your home address changed (a move, or a new postcode in another postcode area, such as from B to CV), and any flag our daily check raises about them. Not the old addresses or where they were.
- Why
- To spot anyone using the app to work out where bookings are. A daily check looks for frequent changes. A pattern flags the account for a person at Gaffr to look at. It never blocks anyone on its own.
- Lawful basis
- Legitimate interests: preventing fraud and abuse.
National Insurance number and UTR
- Data
- Your National Insurance number, which you need to finish sign-up. Your Unique Taxpayer Reference, if you choose to give it.
- Why
- The UK’s digital platform reporting rules make us collect and check your NI number and report it to HMRC each year. We encrypt it before we store it. It appears in full only in the HMRC report, which only Gaffr admins can download, and every download is logged. If you give your UTR, it goes in that report too. It’s stored without the NI number’s extra encryption, and our team can see it.
- Lawful basis
- Legal obligation.
Bank details
- Data
- Account holder name, sort code and account number. We encrypt them before storing them and keep the last four digits readable so you can recognise the account. Each payout keeps its own copy: the payee name and last four digits readable, the rest encrypted.
- Why
- To pay you. Crew are paid through Stripe. If a Stripe payment can’t go through, a person at Gaffr can pay you by bank transfer from our account at Tide using these details instead. A second person has to approve each of those payments, and every time someone at Gaffr views your full account number, it’s logged.
- Lawful basis
- Contract.
Your Stripe payout account
- Data
- Crew are paid through Stripe, and you need a Stripe account that can receive payments before you can go live or accept work. To set it up we send Stripe your legal name, date of birth, address, phone number, email, bank account and a short description of your work. You confirm them and accept Stripe’s terms on Stripe’s own pages. We keep Stripe’s status for your account: what it still needs from you, and whether payouts are on.
- Why
- To pay you. Stripe runs its own identity and anti-money-laundering checks as a controller in its own right, and may ask you directly for ID.
- Lawful basis
- Contract.
Your work profile
- Data
- Your skills, your hourly rate and its history, your default availability, whether you take scheduled work, and your crew code, which you give a colleague who wants you to cover a booking for them.
- Why
- To match you with work you can do, at your rate.
- Lawful basis
- Contract.
Your documents
- Data
- Right to work (a screenshot of your share code from gov.uk or, for British and Irish citizens, the photo page of your passport), photo ID, public liability insurance and any licences, such as PASMA or IPAF. Plus expiry dates, whether each was approved or declined and why, and the reference from the government’s online right-to-work check. Right-to-work documents show your nationality or immigration status.
- Why
- To confirm you can work in the UK, that you are who you say, and that you’re insured and qualified for the work you take.
- Lawful basis
- Right to work: legal obligation where the law puts the check on Gaffr (how far it does isn’t settled yet), and otherwise legitimate interests in keeping illegal working off Gaffr. The rest: contract and legitimate interests (safety).
Terms and legal pages
- Data
- Which version of the crew terms you accepted, when, and whether you scrolled to the end; when you opened the legal pages.
- Why
- So both sides can prove what was agreed.
- Lawful basis
- Legitimate interests.
Going live
- Data
- Whether you’re live and until when, when the app last checked in, and, on iPhone, whether the app detects that the phone has been jailbroken.
- Why
- To offer work only to crew who are available, and to protect accounts.
- Lawful basis
- Contract, and legitimate interests (security).
Location on a shift
- Data
- Your position, its accuracy, your speed and heading, and the time, while the on-the-way screen (after you tap “Leave now”) or the on-shift screen is open. Also whether your phone reports a faked location, and a flag if you seem to move impossibly fast.
- Why
- The client’s live map and ETA, the arrival check, spotting faked locations, and settling “Crew didn’t show” claims. More in Location.
- Lawful basis
- Contract, and legitimate interests (fraud and safety).
Offers, bookings and releases
- Data
- Offers sent to you and what happened to them, bookings you accepted, and bookings you released, with the reason you picked (Ill or injured, Family emergency, Travel disruption, Clash with other work, Something else), whether you marked it as an emergency or out of your hands, and an optional note of up to 300 characters. Only Gaffr sees the reason and the note. If you name a colleague to cover a booking, we keep that too.
- Why
- To run bookings, reopen a released one to other crew, and look at releases in context. Declining an offer is free and isn’t held against you.
- Lawful basis
- Contract, and legitimate interests (reliability).
Attendance
- Data
- Your estimated travel time from home, the time you need to leave by, signals that you’re at risk of being late, “Crew didn’t show” claims and how they ended, and notes our team writes about them.
- Why
- To warn early when a shift is at risk, and to settle claims.
- Lawful basis
- Legitimate interests.
Incidents
- Data
- Incident reports (how serious, what kind, what happened, photos), your reply and photos if a client says you didn’t show, and “Block or report” on a client: the reason and detail go to our team, and the block keeps you and that client apart for good.
- Why
- Safety, and hearing your side of a dispute.
- Lawful basis
- Legitimate interests.
Messages
- Data
- Messages you send and receive in the app: with the Gaffr team, and with your client on a booking. Each message is kept with who sent it, which conversation it is in, when it was sent and when you last read the conversation. Messages are plain text. We don’t open or follow links in them. If you report a conversation, we keep which conversation, the reason you pick and your note, never a copy of the messages.
- Why
- To let you and the person you’re working with sort out the day (where to go, how long, what’s changed), and to let our team help you.
- Lawful basis
- Contract, and our legitimate interests in running the service safely and settling complaints.
- Who sees it
- You and the other person in the conversation. A conversation with the Gaffr team can be read by anyone on our team; the messages show as from “Gaffr”, not a named person. Our team can also read a conversation between a client and a crew member when they need to: to deal with a safety concern, a complaint, a “Crew didn’t show” claim or a dispute about a booking. We record every time someone on our team reads one. If you report a conversation, our team reads it to deal with the report; and blocking someone stops messages between you, and any new offers or bookings between you. Messages are stored by Supabase (our database host). Supabase Realtime tells your phone a new one has arrived, with none of its words in it.
- Notifications
- When you get a message we send a notification to your phone through Google (Android) or Apple (iPhone). It shows the sender’s first name, or “Gaffr”, and up to the first 100 characters of the message. Nothing else about anyone is in it. Your phone may show it on your lock screen, depending on your settings.
- When you can message
- A client and their crew member can write to each other from 24 hours before the call time until 12 hours after the shift ends, or until the booking is cancelled. After that the conversation can still be read, but not added to.
- How long
- 365 days after the conversation closed. A conversation between a client and a crew member closes when the booking ends or is cancelled; we keep it longer only while that booking is still in question (a dispute, a card dispute or a “Crew didn’t show” claim not yet settled). A conversation with the Gaffr team is kept 365 days after its last message. A report you send about a conversation is kept as long as the conversation is, and deleted with it.
Money
- Data
- Your payouts and the client charges your pay came from. Gaffr never charges crew a fee.
- Why
- To pay you and keep the books.
- Lawful basis
- Contract, and legal obligation (tax and HMRC).
Sharing Gaffr
- Data
- If you open Bring your crew: a share code made for you (random, and used for nothing else); for each day, how many times your link was opened and how many times someone pressed an app store button from it (which app, iPhone or Android), with nothing about who they were; and whether your link’s page shows you.
- Why
- To see how Gaffr gets shared, and who shares it, and so the person you share it with knows it’s from you. Our team sees the counts; the app tells you your link is counted.
- Who sees it
- Anyone who opens your link sees your first name, your Gaffr photo, your roles, how many shifts you’ve done on Gaffr and your star rating once you have three. Never your surname, contact details or checks. It’s off until you’ve seen the Bring your crew screen that says so, and you can switch it off there, after which the page shows only Gaffr. Link previews, such as in WhatsApp, show only Gaffr.
- Lawful basis
- Legitimate interests.
- How long
- While your account is open. Deleted with it.
Bring your crew
- Data
- If you tell us who brought you to Gaffr, when you sign up in Gaffr Live (or did when you joined our website waitlist, before 3 November 2026): what you typed (a name, or their Gaffr code), and which crew member that is, once their code or our team has matched it, or once you’ve said yes when Gaffr Live asks whether someone brought you. If someone names you: that they did, and the £50 we pay you for it. If a client signs up to Gaffr with your code: which client, for our records only.
- Why
- To pay the crew member who brought you £50 once you’ve worked 5 shifts that were done and paid. Our team counts those shifts.
- Who sees it
- Our team, and the crew member who brought you: Gaffr Live shows them your first name and how many of your shifts count towards it so far, and whether their £50 is on its way or paid. Never your surname, photo, dates, venues, clients or which shifts. A client who signed up with your code isn’t shown to you. If someone named you and you ask for a copy of your data, it says how many people named you, not who, and how many clients signed up with your code.
- Lawful basis
- Legitimate interests, and contract for the payment.
- How long
- While both accounts are open. If you named someone, it’s deleted with your account. If you’re the one named, the link to you is removed when your account is deleted. A payment we made is kept with your other payouts for HMRC.
Weekly emails about work you missed
- Data
- Each Monday while one of your documents is still yours to sort out (to upload, or to replace once it’s expired): whether we emailed you about last week’s shifts in your area that fit your skills (we do when there were five or more), when, and how it went. How many we’ve sent since your documents were last all approved. Your choice to stop them, if you press Unsubscribe on the page the email links to. Nothing about the shifts it named.
- Why
- To show you the work you’re missing until your documents are in. At most four in a row, and never while we’re checking documents you’ve sent.
- Lawful basis
- Legitimate interests.
- How long
- Each Monday’s record: six months. How many we’ve sent, and your choice to stop them: while your account is open. All of it is deleted with your account.
Sign-up checks, waitlist and notifications
- Data
- The same sign-up checks as clients (IP address, user agent, the two halves of your email). If we don’t cover your area yet, your email, name, postcode and phone go on our app waitlist. A push token from Apple (iPhone) or Google (Android) for notifications.
- Why
- Catching duplicate accounts, inviting you when we reach you, and sending you offers.
- Lawful basis
- Legitimate interests, and contract.
Health information
Picking “Ill or injured” when you release a booking, or describing an injury in an incident report, tells us something about your health. The law treats health data as a special category, which needs a legal condition on top of a lawful basis. We haven’t settled which one applies to us yet. We use it only to handle that release or incident, and it never goes to clients. You don’t have to give a health reason: “Something else” works, and the note is optional.
What clients see about you
- Before anyone books: nothing about you. Clients don’t see your name, where you live, whether you’re live, or how many crew are live near them.
- From confirmation to the end of the shift: your first name, photo, mobile number (so the client can call you), the skill booked, the fixed labels “Right to work verified”, “ID checked” and “Insurance on file”, how many jobs you’ve completed, your average rating once you have at least three, and, under “Checked for this shift”, the name and level of any document of yours the shift asks for that we’ve approved and that is in date for it, such as “IPAF 3a, 3b”, for the document types we’ve chosen to show.
- While you’re on the way and on shift: your live position on a map, and your ETA.
- After the shift: your first name and photo.
- Your rating of them: once you’ve both rated, or 14 days after the shift, the client can read your stars and comment in the Gaffr app, with the month and the role you worked, never your name. Gaffr can hide it, and records why.
- Never: your date of birth, age, nationality, which right-to-work document you used, immigration status, email address, legal name, home address, tax or bank details, or the number, dates or photo of any document you send us.
The booking’s site contact can mark you as arrived. A colleague you give your crew code to can name you to cover a booking for them.
Crew who’ve joined Gaffr in your area and whose documents aren’t approved yet may see a shift you worked there the week before (Monday to Sunday) as its weekday, the part of the day and the role, never you. When five or more shifts there that week were booked under one of their skills (each shift counted under one skill only), they may also see the lowest and highest hourly rate the crew booked on them were paid, in whole pounds, never which shift or who. To show the same thing all week, we keep a copy of that week’s shifts in the area (when each started, the skills, whether someone was booked and their hourly rate; nothing that names anyone) and delete it two weeks after the week ends.
Site contacts
When a client books, they can name a site contact: a name, phone number and email address. They come from the client, not from you. We email the site contact a sign-in link, sent through MailerSend. Opening it creates a sign-in record for that email address with Supabase, our sign-in provider, and lets them mark the crew member as arrived for that booking and nothing else. The crew member who accepts sees their name and phone number so they can find them on the day (their app also receives the email address; see the note under clients). The details stay with the booking.
Lawful basis: legitimate interests, the client’s and ours, in getting crew onto site. Don’t want to be a site contact? Tell the client, or email hello@gaffr.uk. The rights further down this page are yours too.
Google and Apple sign-in
What we receive
- Google: your name, email address, Google account ID and a link to your Google profile picture.
- Apple: an ID for your Apple account, your email address and, the first time only and only if you choose to share it, your name. If you pick Hide My Email, Apple gives us a private relay address that forwards to your real inbox, and we never see the real one.
- We don’t get your Google or Apple password, your contacts, calendar, files or anything else in those accounts.
What we do with it
- We use your email address to sign you in and match you to your Gaffr account. We don’t use your profile picture.
- Crew accounts are by invite, tied to the address we invited. If the address Google or Apple gives us doesn’t match it, sign in with an email link to your invited address instead.
- It’s stored with your sign-in record at Supabase, our sign-in provider, and deleted when your Gaffr account is deleted.
- We don’t share it with anyone else, sell it, or use it for ads. Gaffr’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- With a relay address, our emails go through Apple. Turn forwarding off and you’ll miss sign-in links and booking emails.
- To disconnect, remove Gaffr in your Google Account’s security settings or under Sign in with Apple in your Apple Account settings. That stops that way of signing in; it doesn’t delete your Gaffr account. Do that in the app.
Biometric unlock
An optional Face ID, Touch ID or fingerprint lock. It’s off until you turn it on (in Gaffr, in Settings; in Gaffr Live, on the You tab), and if the check fails it falls back to your phone’s passcode. It locks when the app opens and after 5 minutes in the background. Your phone does the check. Your face or fingerprint never leaves the phone and Gaffr never receives it.
Location
Crew: foreground only
Gaffr Live uses your location while the on-the-way screen (after you tap “Leave now”) or the on-shift screen is open, and our server rejects location from any booking that isn’t under way. It also takes a reading when you press Go live and while you’re live (see below). We never ask for background location, so nothing is tracked between shifts or with the app closed. “I’m here” takes a single reading when you tap it. If there’s no signal, the app keeps that reading and the time you tapped on your phone until it can send them. If your phone can’t get a GPS reading at the meeting point, you can still start: the client sees that your location wasn’t confirmed and can confirm you’re there, and if the app gets a good reading at the venue while the on-shift screen is open, that confirms it, unless an earlier reading put you somewhere you couldn’t have started from; then a person decides. We use this to settle “Crew didn’t show” questions and to check a shift before we pay it, never to rank or offer you work.
When you go live. When you press Go live, Gaffr Live takes a single reading of where your phone is, if you’ve let it use your location. We keep that point, rounded to about 100 metres, as where you were that working day. For that day, on-demand offers are measured from there instead of from your home, and so are the arrival time we check against a client’s latest arrival and your leave-by time. Bookings further ahead can count it as well as your home. Going live again replaces it, and going live without a reading (location off, no signal, or a reading less accurate than 2 km) removes it, so offers are measured from home. Clients and site contacts never see it, and it plays no part in which venues can be booked. Gaffr’s team sees it on our live map, rounded to about 1 kilometre, with the time it was taken. Lawful basis: contract.
While you’re live. Gaffr Live also takes one reading when you open the app (at most every 10 minutes) and one when you press “Update where I am”. Each replaces that day’s reading, so offers follow you. None is taken in the background. Who sees it, how long we keep it and the lawful basis are as above.
The client sees where you are while you’re on the way and during the booked hours of the shift, never after the booked end time.
When you start a shift. Each time you press start, or ask Gaffr to start it for you, we keep a record of it: when you pressed it on your phone, when it reached us, whether it was sent later because there was no signal, the single location reading your phone had at that moment (with its accuracy, and whether the phone said it came from a location-faking app), how far that was from the meeting point, and how the start was checked afterwards. If Gaffr starts the shift for you, the record also holds why, and a short note from the person who did it.
Who sees it. The client sees only how your shift was started and whether it has been confirmed, never where you were or how far away. The site contact is told only that their “They’re here” tap was taken. Gaffr’s team sees the distances and times, to settle a “Crew didn’t show” question or check a shift before paying it. We never use it to rank you or decide which work you’re offered.
What your location on a shift is used for:
- the client’s live map and your ETA; Mapbox calculates the ETA from your position while you’re on the way;
- our team’s live map of shifts under way;
- checking you’ve arrived at the venue;
- spotting faked locations and impossible speeds, which raise an incident for a person to review;
- settling “Crew didn’t show” claims.
Your home point sets which offers are within reach and goes to Mapbox to estimate your travel time and leave-by time. Clients never see it. Mapbox also turns your typed address into that point.
Gaffr’s team sees your home area on our live map: your home point rounded to about 1 kilometre or, until you’ve added your full address, the centre of your postcode’s outward code (such as B12). Clients and site contacts never see either.
Clients
The Gaffr app uses your phone’s location only when you tap “Use my current location” while choosing a venue: one reading, sent to our server to find the nearest street address through Mapbox. We don’t store it or log it.
Mapbox
Our maps come from Mapbox. When a map loads, your phone fetches map images from Mapbox, so Mapbox sees your IP address and the area you’re looking at. Mapbox’s map software in the apps also sends Mapbox its own usage data, which can include your phone’s location if you’ve let the app use it, under Mapbox’s privacy policy. We don’t switch that off for you, because Mapbox’s terms leave that choice to you: tap the ⓘ in the corner of a map for Mapbox’s options, including turning its usage data off.
Decisions the system makes
Some decisions are made by software, with no person looking at your individual case. You have the right to ask for a person to look at any of them again, to give your side, and to challenge the result. Email hello@gaffr.uk.
Who gets offered work
Dispatch picks which crew get each offer. You’re in the running if your account is active, not paused and not being deleted, you’ve accepted the current crew terms, home is within range (for a booking a few hours away or less, where you were when you went live or last updated that day, if we have it), you have the skill, your documents are verified, Stripe can pay you, your NI number is on file, your rate is at or under the client’s maximum, you have no clashing booking, you haven’t already turned down, released or been stood down from that booking, and neither you nor the client has blocked the other. For a booking a few hours away or less you also have to be live; for one further ahead, you have to take scheduled work and be reachable by notification.
Offers go out in batches. Crew who haven’t had an offer for that booking come first, then crew whose app has checked in recently (or, for bookings further ahead, who can get a notification), then whoever is closest (to where they went live or last updated that day, for on-demand work, otherwise to home), then whoever joined Gaffr first. It never ranks you on ratings, declines, your rate, releases or problem reports. Saying no to an offer costs you nothing. Because this decides who gets paid work, we treat it as a decision that significantly affects you.
“Crew didn’t show”
When a client says their crew member didn’t turn up, the system checks the booking’s record. If the crew member never tapped “Leave now”, never arrived, and sent no location from inside the venue’s arrival zone, the claim is accepted automatically: the client pays nothing, the crew member isn’t paid for that booking, and it’s recorded as a no-show. Anything else goes to a person before anything is charged or paid.
If a crew member started without their location being confirmed, the client can still say they didn’t show, until an hour after the later of the start and the booked end. That always goes to a person, and nothing is charged or paid until then.
A start made without GPS, or sent late because there was no signal, is a sign you were there, not proof. A person weighs it with the rest.
Crew: if nobody has confirmed your start by the end of the shift, your pay for it waits until a person at Gaffr has looked. It goes through on its own if the client or the site contact confirms you were there, or the app gets a good reading at the venue during the shift, unless a reading put you somewhere you couldn’t have started from; then a person decides.
Crew: if an automatic no-show is wrong (your phone died, say), ask a person to look at it. In Gaffr Live, tap “Ask us to look again” on the booking, or under No-shows on the Pay tab, and tell us what happened. Or email hello@gaffr.uk. A person checks it against the booking’s record and what you tell us, then tells you the answer and why. If it wasn’t a no-show, it comes off your record. You can ask once for each decision.
Expired documents
If your right-to-work document or your insurance expires, your account pauses automatically and you can’t go live. We warn you 30 days before. The pause lifts itself once an approved, in-date replacement is on file.
Running late
If you haven’t tapped “Leave now” by your leave-by time, or you’re on your way and more than 15 minutes past the time you’re due (or your ETA is), the app warns you, then tells Gaffr and the client. If you haven’t set off, or set off only after the time you were due, the client is offered a replacement search. The client decides. If they take it, you’re stood down from that booking and aren’t offered it again. Once you’re on your way in time, the client can’t replace you. If they tell us after the shift that you arrived late, a person at Gaffr checks the booking’s times and your location trail, and may refund the client part of what they paid. It never affects which other offers you get.
Flagged for a person, never decided by the system
The duplicate-account check, the home-move check and faked-location detection only flag things for our team. Invites and document approvals are made by people.
Where it’s stored
Our database and file storage are in London (UK), and so are the website waitlist sign-ups we still hold. The test version of the apps, which only our team and the testers we invite use, keeps its data in Frankfurt, Germany. UK law treats the EU as giving adequate protection, so no extra safeguard is needed for that.
Some of the companies above are in the USA or can reach the data from there: Vercel, Stripe, Mapbox, MailerSend, Sentry, Anthropic, Google, Apple, Expo and Supabase. For those transfers we rely on the company being certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), or on the UK’s International Data Transfer Addendum to the EU standard contractual clauses in that company’s data processing terms. Email hello@gaffr.uk for a copy of the safeguard that applies.
How long we keep it
While your account is open
We keep your account, your past bookings and the record of what our team has done on your account. Some things go sooner, on a timer, even while your account is open: see Set periods below.
When you delete your account
In Gaffr: Settings → Delete account. In Gaffr Live: You → Privacy and your data → Delete your account. You get 14 days to change your mind: sign back in and the app offers to cancel it. After that, a nightly job deletes your account, your documents and their files, bank details, NI number, rates, ratings you wrote, incident reports, offers, location history, any copy of your data we prepared for you, your invite, the record of our weekly emails about work you missed and your choice to stop them, and your Stripe customer record or payout account. It also strips your ID and email address out of our internal message logs.
Financial records stay, with your name taken off them: payouts (with the payee details wiped), charges, and the bookings they belong to.
Crew we have paid: deleting your account keeps one record for HMRC. It holds your name, home address, date of birth, National Insurance number and UTR (if you gave them) and what we paid you in each calendar year. It’s kept encrypted, and nothing else about you goes with it: no email, phone, photo, bank details or location. We keep it because HMRC’s digital platform reporting rules require it (The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023, regulation 3). That’s a legal obligation, so the right to erasure doesn’t reach it (UK GDPR Articles 6(1)(c) and 17(3)(b)). We keep it for five years from the end of the last calendar year we paid you in, then delete it. If we have never paid you, deleting your account keeps none of this.
Your data export (in Gaffr: Settings → Your data; in Gaffr Live: You → Privacy and your data → Get a copy of your data) tells you whether this record would be kept, what it holds, why, and the earliest date it can be deleted.
Also left behind, with no timer on them yet: our team’s audit log of changes they made to your account, which can repeat details from it; copies of the payment notifications Stripe sends us; and any duplicate-account flag raised about you. A home-move flag is deleted with your account.
When deletion waits
- While you’re still owed pay, or a cancellation fee owed to you is still being collected.
- While Stripe won’t close your payout account, usually because it holds a balance or has an open dispute.
- Clients: while one of your bookings is still running, or its payment, a dispute or a question about it isn’t settled. Once it is, we delete your account and keep only the booking and payment records the law requires, without your name or contact details. If you owe us money for a booking, we wait until it’s paid, or, if it isn’t, six months after it fell due or after you asked us to delete your account, whichever is later (sooner if we stop collecting it). We email you what we kept and why.
What the law makes us keep
- Records for HMRC’s platform reporting: five years from the end of the last calendar year we paid you in, even after you delete your account (see above).
- Tax and accounting records: six years.
- Stripe keeps its own records for its own legal duties.
Set periods
These are the periods we’ve set. When one runs out, we delete the data.
- Crew location from a job: 180 days after the shift. Longer only while a card dispute, a no-show claim or a no-show review on it is open.
- Start-of-shift readings: as crew location, 180 days after the shift.
- Where you were when you went live or last updated it: 30 days after that day.
- Messages: 365 days after the conversation closed (the booking ended or was cancelled, or the last message with the Gaffr team), longer only while a booking it belongs to is in question. A report you made about a conversation goes with it.
- The dates your home address changed: 90 days after each change. A flag about them: 90 days after the latest change it counts.
- Each Monday’s record of whether we emailed you about work you missed: six months after it. How many we’ve sent, and your choice to stop them: while your account is open.
- Right-to-work, photo ID and insurance files: two years after your latest activity (your last shift, upload, time switched on, or offer). Never sooner than two years after upload. Never while you’re booked, have an open offer or are switched on. We keep a record that the check was done, not the file. If you come back after that, you upload them again.
- Incident photos: six years. The written report is kept.
- Bring your crew: kept while both accounts are open, with no time limit; deleted with the account of the person who named someone.
- A client’s crew member’s code: kept while both accounts are open; deleted with either.
- The HMRC record for crew we have paid: five years from the end of the last calendar year we paid you in, then deleted (SI 2023/817, regulation 3).
- Clients who delete their account after paying for bookings: we delete the account and your personal details, and keep only the booking and payment records the law requires, without your name, contact details or the venue address, for seven years. We tell you this when we delete the account.
- We review these periods and update this page when they change.
Everything else
- Website waitlist sign-ups (the list closed on 3 November 2026): 12 months after you signed up, then deleted from our inbox and the database.
- The app waitlist, for people outside our area: kept for 12 months, then deleted. Deleting your account deletes it too. Ask us and we’ll remove you sooner.
- Site contacts’ details: kept with the booking they were given for, for as long as the booking is kept.
- Emails to us: no automatic deletion.
Data we get from others
Most of what we hold comes from you. The rest comes from:
- Clients: ratings of crew, “Problem with this match” reports, “Crew didn’t show” claims, reports and blocks, and site contacts’ details.
- Crew: ratings of clients, incident reports, reports and blocks, and the colleague they name to cover a booking.
- Our team: crew invites (we invite you by email), decisions on documents, and notes.
- Stripe: your payout account’s status; payment, refund and dispute details.
- The Home Office: the result of an online right-to-work check.
- Mapbox: map points for addresses, and travel times.
- Your phone: push tokens, a jailbreak check on iPhone, and whether it reports a faked location.
- Google or Apple, once sign-in with them is switched on.
Your rights
UK data protection law gives you these rights. Using them is free. We answer within one month; if a request is complicated we can take up to two more months, and we’ll tell you if we need to. We may ask you to prove who you are first.
- See your data. In Gaffr: Settings → Your data. In Gaffr Live: You → Privacy and your data → Get a copy of your data. A person at Gaffr prepares a copy and emails it to you. It includes every conversation you’re in, with every message in it, and the reports you made about a conversation. Messages from other people are marked as from “the other person” or “Gaffr”, without their name. The app says 14 days; the legal limit is one month. The export doesn’t cover everything yet: location history, your home map point, the document files themselves, skills, rates, offers, bank details, your Stripe status, push tokens, which legal pages you opened and our internal records are missing. Ask and we’ll send those too. Website visitors: email us.
- Correct it. Change what the app lets you change; email us for the rest.
- Delete it. In Gaffr: Settings → Delete account. In Gaffr Live: You → Privacy and your data → Delete your account. See how long we keep it for what stays. We delete your conversation with the Gaffr team, every message you sent and every report you made about a conversation. Messages the other person sent you on a booking stay with them for the time above, without your name or account attached.
- Object to anything we do on the basis of legitimate interests, and restrict what we do while a complaint is sorted.
- Take it with you in a machine-readable format.
- Withdraw consent for a website waitlist sign-up we still hold.
- Ask a person to review a decision the system made about you.
For anything the app doesn’t do, email hello@gaffr.uk.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d like the chance to put it right first, but you don’t have to come to us before you go to them.
Keeping it safe
- NI numbers and bank details are encrypted (AES-256-GCM) before they reach the database.
- Documents sit in private storage. Only Gaffr admins can open them, through links that expire.
- Our team signs in with Google Workspace accounts that require two-step verification, and every admin action is written to an audit log.
- Everything travels encrypted over HTTPS.
- On your phone, the app keeps you signed in using the app’s own private storage. The cookies page has the detail.
If a breach puts you at risk, we’ll tell you, and the ICO, as the law requires.
Age limits
Crew must be 18 or over; our server checks your date of birth before you can go any further. Clients book as producers, venues and crew chiefs; we don’t ask their age. This website isn’t aimed at children.
Changes to this policy
When this policy changes, so does the date at the top. If a change affects how we use data you’ve already given us, we’ll email you about it.