Privacy notice

Last updated 9 November 2026

This notice explains what personal data GaffFinder holds, why, who else handles it and how long we keep it. The GaffFinder team runs GaffFinder and is responsible for this data (the “controller”). Contact: [email protected].

If you visit the website

• No cookies from us, no accounts and no advertising. Your shortlist, hidden listings and last filters stay in your browser’s local storage, on your device.
• Usage records: pages viewed, searches, saves, shares and clicks, and the website that sent you here, with a visitor code that changes every day. These records do not contain your IP address.
• Server logs: each request, with your IP address and browser type, to protect the site from abuse and scraping and to find faults.
• Cloudflare delivers and protects the site and sees your IP address. The map on a listing page and the map of search results come from Google Maps: when one loads, Google sees your IP address and can read its own cookies in your browser, under the Google Privacy Policy.

We rely on our legitimate interests: to run the site, keep it secure and improve it.

If you use the bot

The bot runs on Telegram, by invitation, and on WhatsApp, where anyone can join. If you use it, we hold your chat ID or phone number, your name (the one you give us, or your Telegram name or username), what you are looking for and your settings, the alerts we send and your replies, the text of your messages, your searches, and a summary we build from your messages (what you are looking for and what you tell us about your move, such as who is moving, where you work or study, and the homes you liked or disliked), and records of how the bot is used. We keep these until you ask us to delete your data.

If you message the bot before you are invited, we keep your chat ID, name and the messages you send (30 days), so that we can decide whether to invite you. We keep a short note of who you are until you join, and we delete it when you join; if we do not invite you, we delete it 90 days after your last message. The bot also tells us in Telegram: it sends the operator your first name, username, chat ID and the first 80 characters of your first message, and the operator can list the start of each first message. Those copies stay in the operator’s Telegram chat after you join and after we delete your data, until the operator deletes them.

We use this to provide the alerts you asked for, and on our legitimate interest in keeping the bot working. Google’s Gemini AI service reads your messages and your description of what you want, to understand them and to match listings.

If you use GaffFinder on WhatsApp

We message you first only if you agreed to it, and never between 21:00 and 08:00. Reply STOP at any time; if you block our messages in WhatsApp, we treat that as STOP. We record when you agreed and when you sent STOP. The notice the bot sends the operator shows only the last four digits of your phone number. Incoming messages leave our inbox once processed (one we could not process is kept for 7 days), and a one-way fingerprint of each arrival is kept for 14 days to ignore repeats. Meta Platforms Ireland Limited carries WhatsApp messages for us, holds them for up to 30 days and may transfer data outside the UK; WhatsApp’s own terms apply to your use of WhatsApp.

Listing information

We show information that letting agents and landlords publish in property adverts: rent, address, rooms, photos, floorplans and advert text. Some of it can relate to a person, such as a private landlord. We use it on our legitimate interest in helping people find homes. If a listing is about you and you want it removed or corrected, email us the link.

Who else handles data

Hetzner (our servers, in Germany), Cloudflare, Telegram, Meta (WhatsApp), Google (Gemini AI and Google Maps) and OpenRouter, which passes your searches and messages to the AI models that read them. Some of them may handle data outside the UK. We do not sell personal data or use it for advertising.

Google Maps

GaffFinder includes Google Maps features and content: the map on listing pages and the map of search results. Your use of Google Maps features and content is subject to the current versions of the Google Maps End User Additional Terms of Service and the Google Privacy Policy.

How long we keep it

• Bot message text, your searches and the summary we build from your messages: until you ask us to delete your data. Messages from someone with no account: 30 days.
• The note of a person who is not invited: 90 days after their last message; its copies in the operator’s Telegram chat: until the operator deletes them.
• Usage records and records of WhatsApp messages we send: up to 400 days.
• Server logs with IP addresses: 1 year.
• Your bot account: until you ask us to delete it.
• Backups: 14 days.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it or limit its use. You can object where we rely on legitimate interests. Email [email protected]; we reply within one month. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.

Changes

We update this notice when what we do changes. The date at the top shows the last change.