Privacy notice

Last updated 26 September 2026

This notice explains what personal data GaffFinder holds, why we hold it, who else handles it, how long we keep it, and what you can do about it. The GaffFinder team runs GaffFinder and is responsible for this data (the “controller”). You can reach us at [email protected].

If you visit the website

• No cookies. The website sets no cookies. It has no accounts, no advertising and no third-party analytics or tracking scripts.
• Your browser’s own storage. Your shortlist, the listings you hide, your last search filters and your choice of square feet or square metres are kept in your browser’s local storage, on your device, and are not sent to us. When you open your shortlist page, its web address carries the numbers of the saved listings so that our server can show them. You can remove all of this by clearing this site’s data in your browser.
• Usage records. Our server records how the site is used: pages viewed, the search filters and place names used, words typed in the keyword search (the first 60 characters), saves, hides, shares (which share button was used, never who with), clicks on links to other websites, and some technical errors. Each record carries a visitor code made from your IP address and browser type together with a random value that changes every day and is never stored. The code lets us count visitors on one day; it does not let us see your IP address or link your visits across days. We do not store your IP address in these records. We keep them for up to 400 days.
• Web server logs. Our web server logs each request (for example the page asked for, the time and the browser type) to keep the site secure and to find faults. The log keeps only the first part of your IP address (the first two of its four numbers for an IPv4 address), never the full address, and we delete it after 14 days.
• Cloudflare. All traffic to the website passes through Cloudflare, which delivers and protects the site and handles your IP address to do so.
• The map. The map view loads its map images directly from OpenStreetMap’s servers, so OpenStreetMap receives your IP address when you use the map. OpenStreetMap’s own privacy policy applies to that.

We use this data on the basis of our legitimate interests: to run the website, keep it secure and understand how it is used, so that we can improve it.

If you use the Telegram bot

The bot is open by invitation. If you use it, we hold:

• your Telegram chat ID and your name (the one you give us, or your Telegram name or username);
• what you are looking for, in your own words, and your settings: budget, bedroom and size limits, and the areas you choose;
• the alerts we send you, and your replies and feedback on them;
• the text of the messages you send the bot, which we keep for 30 days;
• records of how the bot is used (for example commands and failed deliveries), which we keep for up to 400 days.

If you message the bot before you are invited, we keep your Telegram chat ID, first name, username and the messages you send, so that we can decide whether to invite you. We keep those messages for 30 days, like all bot message text. We keep a short note of who you are (your first name, username and first message) until you join, and we delete it when you join. If we do not invite you, we delete that note 90 days after your last message to the bot. When you first message the bot, the bot also tells us in Telegram: it sends the operator a Telegram message with your first name, username, chat ID and the first 80 characters of your first message. The operator can also ask the bot, in Telegram, for the list of people who wait for an invitation, with the start of each first message. These messages stay in the operator’s Telegram chat after you join and after we delete your data, until the operator deletes them there. You can ask us to delete any of it sooner.

We use this data to provide the service you asked for: alerts about homes that match what you want. For your message text and usage records, we also rely on our legitimate interest in keeping the bot working and fixing faults.

To understand your messages and to judge which listings match what you want, we send your messages and your description of what you are looking for to Google’s Gemini AI service. All bot messages travel through Telegram, and Telegram’s own privacy policy applies to your use of Telegram.

To stop, ask us to delete your data, by email or in the bot. We then delete your account data (your settings, areas, alerts and message log) and remove your identity from the usage records. We keep a short record that the deletion happened.

Listing information

The website and the bot show information from property adverts that letting agents and landlords publish online: the rent, the address as advertised, the number of bedrooms, photos and floorplans. We also keep the text of each advert, which the keyword search uses. Some of this information can relate to a person, for example a private landlord. We use it on the basis of our legitimate interests, to help people find and compare homes to rent. We use Google’s Gemini AI service to read sizes from floorplans. We keep listing records after an advert ends, so that we can show a home’s price and listing history.

If a listing, photo or floorplan on GaffFinder is about you or belongs to you and you want it removed or corrected, email us the link to the listing and tell us what you want changed. See the contact page.

Who else handles data

• Hetzner Online hosts our servers and their backups in Germany.
• Cloudflare delivers and protects the website.
• Telegram carries the bot’s messages.
• Google (the Gemini AI service) reads bot messages and descriptions of what users are looking for, and reads floorplans and photos of listings.
• OpenStreetMap supplies the map images that your browser loads.

Some of these companies may handle data outside the UK. We do not sell personal data, and we do not use it for advertising.

How long we keep it

• Bot message text: 30 days.
• The note of a person who messages the bot before an invitation: until they join, or 90 days after their last message if we do not invite them. Its copies in the operator’s Telegram chat: until the operator deletes them.
• Website and bot usage records: up to 400 days.
• Web server logs: 14 days.
• Your bot account data: until you ask us to delete it, or until we close the service.
• Backups: our server keeps nightly backups for 14 days, and an encrypted copy is kept off-site. Data you ask us to delete leaves the backups as they are replaced.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, and ask us to correct it, delete it, or limit how we use it. You can object to our use of it where we rely on legitimate interests, and in some cases ask for it in a form you can take elsewhere. To do any of this, email [email protected]. We will reply within one month.

Complaints

If you are unhappy with how we handle your data, please tell us first at [email protected]. We will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Changes to this notice

We will update this notice when what we do with personal data changes. The date at the top shows when it last changed.