Privacy Policy

1. Who we are

GafferPay ("we", "us", "our") is Thomas Waye trading as GafferPay, of 1 Lochtybank Cottages, Thornton, Fife, KY1 4DE. We can be contacted at privacy@gafferpay.co.uk.

We provide an invoicing and payment-collection tool for UK tradespeople and their businesses. This policy explains what personal data we collect, why, and what your rights are — for both business owners using GafferPay, and the customers those businesses invoice through it.

2. Two kinds of data we hold

Your data (if you're a tradesperson with a GafferPay account): your name, email, phone, business address, VAT and company registration numbers, and bank details you choose to display on your invoices.

Your customers' data (if you're a business owner, about the people you invoice): names, email addresses, phone numbers, and billing addresses you enter into GafferPay. For this data, you — the business — are the data controller under UK GDPR, and we act as your data processor. Your own privacy obligations to your customers are separate from, and in addition to, this policy.

3. What we collect and why

• Account and business details — to create your account, put your business's details on the invoices you send, and calculate VAT correctly.
• Customer and invoice details — to generate and send invoices on your behalf, and to send payment reminders when you've turned that on.
• Payment information — handled entirely by Stripe, our payment processor; we never see or store card numbers. See "Who we share data with" below.
• Account activity (e.g. when a reminder was sent, when an invoice was viewed) — to make the product work correctly and to show you accurate invoice statuses.
• Cookies — only functional ones needed to keep you logged in (via Supabase authentication). We don't use advertising or tracking cookies.

4. Our legal basis for processing

Mostly performance of a contract — we need this data to actually provide the invoicing/payment service you've signed up for. Where that doesn't apply (e.g. some account activity logging), we rely on our legitimate interests in operating and improving the service securely.

5. Who we share data with

We use a small number of specialist providers to actually run the service:

• Stripe — processes card payments and, for Pro subscribers, billing. Money paid by your customers goes directly to your own connected Stripe account, not through us. See Stripe's privacy policy.
• Resend — sends invoice, receipt, and reminder emails on your behalf.
• Supabase — hosts our database and handles account authentication.

These providers only process data to deliver the service to you — none of them may use it for their own marketing. We don't sell personal data to anyone, ever. Some of these providers may process data outside the UK/EEA; where they do, they provide appropriate safeguards (such as Standard Contractual Clauses).

6. How long we keep data

We keep account and invoice data for as long as your account is active, plus a reasonable period afterward for accounting, tax, and legal purposes (invoicing records are typically expected to be kept for at least 6 years under UK tax rules). You can ask us to delete your account and data sooner, subject to those legal retention requirements.

7. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you
• ask us to correct inaccurate data
• ask us to delete your data (subject to our legal retention obligations above)
• ask us to restrict or object to certain processing
• receive your data in a portable format
• complain to the Information Commissioner's Office (ICO) if you think we've mishandled your data

To exercise any of these, email privacy@gafferpay.co.uk. If your request is about data a business holds about you as their customer, we may need to direct you to that business first, since they're the data controller for that information.

8. Children

GafferPay is a business tool and isn't directed at, or intended for, children.

9. Changes to this policy

If we make material changes, we'll update the date at the top of this page and, where appropriate, let you know directly.

10. Contact

Questions about this policy? privacy@gafferpay.co.uk