Privacy Policy

Effective date: 13 August 2026 Version: 2.5

1. Who is responsible for your data

Gwithva Software Limited ("we", "us") is the controller of personal data we process about you when you use Gwithva, except where stated otherwise in section 10. We are registered with the Information Commissioner's Office (ICO) under registration number ZC224032. For any privacy question, contact us at [email protected] or by post at Gwithva Software Limited, Unit A, 82 James Carter Road, Mildenhall, IP28 7DE.

2. The personal data we collect

Account and profile data: name, email, phone number, postcode/service area, password (stored encrypted), and, for Service Providers, business details, profile description and pricing.

Sign-in with Google or Apple: if you choose to sign in with Google or Apple, we receive your name and email address from that provider. Sign in with Apple lets you share a private relay email address instead of your real one; messages we send to it are forwarded to you by Apple. If you sign in with Apple, we also keep a token issued by Apple, used only to revoke Gwithva's access to your Apple ID when you delete your account.

Booking and service data: addresses where work takes place, dates and times, job descriptions, messages between users, reviews and ratings.

Payment data: we use a third‑party payment processor; we receive limited information such as the last four digits of a card and the payment status. We do not store full card numbers. Service Providers give their bank details for payouts directly to the payment processor; we do not see or store the full account number.

Tax reporting data (Service Providers only): when a Service Provider sets up payouts, we collect their legal name, date of birth, home address and tax reference number (National Insurance number or Unique Taxpayer Reference), because UK digital platform reporting rules require us to report these to HMRC together with their earnings through the Platform.

Photos and images: profile photos, photographs of completed work, photos of your property that you add to a quote request or booking (shared only with the cleaner you send them to, and stored privately), and images of receipts, certificates or other documents. Photos are optional, except that some cleaners ask for photos of the property before they will give a quote or accept a booking; you can always choose a different cleaner instead.

Files you upload: where a Service Provider imports a client list or similar file, we process the contents of that file to provide the Platform. This is covered by section 10.

Usage and device data: how you use the Platform, device and browser type, IP address, a device identifier used to deliver push notifications if you enable them, technical error reports (what went wrong and where in the app) when something fails, information collected through cookies (see our Cookie Policy), and, where you consent, behavioural analytics and session-replay data (for example via Microsoft Clarity).

Communications: records of your contact with us and your marketing preferences.

3. Where we get it

From you directly; automatically as you use the Platform; from other users (for example a Service Provider about a Customer in connection with a booking); from our service providers such as the payment processor; and from Google or Apple, if you choose to sign in with them.

4. Why we use it and our legal basis

Where we rely on legitimate interests, we have weighed those interests against your rights; you can ask us about this at [email protected].

5. How long we keep it

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Specific periods are set out in our internal Data Retention Policy and summarised here: account data is kept while your account is active and for a reasonable period afterwards; transaction and tax records are kept for 6 years; consent and acceptance records are kept for as long as needed to evidence them.

6. Sharing your data

We share personal data with:

• Other users, as needed to provide a booking (e.g. a Customer's address and contact details are shared with the Service Provider doing the job, and vice versa);
• Service providers (sub‑processors) who process data on our behalf under contract, including Stripe (payments), our hosting provider (Cloudflare), our database provider (Supabase), email/communications provider (Brevo), and automation tooling (Make.com), together with Notion (internal content and operations) and Google (Firebase Cloud Messaging, to deliver push notifications if you enable them);
• Microsoft, as an independent controller, via Microsoft Clarity — where you consent to behavioural analytics and session replay, we use Microsoft Clarity to see how the Platform is used. Microsoft is not our sub-processor for this data: Microsoft processes it under its own privacy statement and terms, for Microsoft's own purposes as well as ours (for example to improve Microsoft's products), and decides its own purposes for that processing rather than acting solely on our instructions. We have not enabled Microsoft Advertising within our Clarity account. See Microsoft's Privacy Statement for how Microsoft itself uses this data. Microsoft Clarity runs on our website only — it is not present in the Gwithva mobile apps.;
• Google and Apple, when you choose to sign in with them, to confirm your identity. Each is an independent controller of the data it holds about your Google account or Apple ID, under its own privacy policy;
• Address and map look-up services, used only while you are entering a booking address: Postcodes.io (we send the postcode alone to confirm it exists and find its town), OpenStreetMap's Nominatim (we send the house number and postcode from our server, not your device, to place the map pin on the right property), and the OpenStreetMap tile service (which receives the map coordinates in order to draw the map). We do not send your name, contact details or account identifiers to any of these;
• HM Revenue & Customs, to whom we must report Service Providers' tax reporting data and earnings under the UK digital platform reporting rules;
• Authorities or third parties where we are required by law, or to protect our rights, users or the public.

We do not sell your personal data. Where a provider (such as Microsoft, for Clarity) determines its own purposes for processing rather than acting solely on our instructions, that provider is an independent controller, not our sub-processor, and is responsible for its own compliance in that capacity.

7. International transfers

Some of our providers process data outside the UK (for example, Microsoft Clarity, and providers hosted in the United States). Where personal data is transferred outside the UK, we rely on an appropriate safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, so your data stays protected.

8. Security

We use appropriate technical and organisational measures designed to protect your personal data against unauthorised access, loss, misuse or alteration — including access controls, encryption of data in transit, secure hosting, and restricting who can access personal data. No system can be guaranteed completely secure, but we take reasonable steps to keep your data safe and to respond promptly to any security incident. Our internal Security Policy and Data Breach Notification & Response Policy govern how we do this.

9. Your rights

Under UK data protection law you have the right to: access your data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent at any time where we rely on it. If you have a data protection concern, please raise it with us first at [email protected] so we can address it; you can also complain to the ICO (ico.org.uk). To exercise any right, contact [email protected]. We will respond within one month.

Deleting your account: You can permanently delete your Gwithva account and personal data at any time — from Settings in the app, or, if you no longer have the app installed, at gwithva.app/delete-account. We delete your login and personal data and anonymise your past bookings, keeping only the anonymised financial record we are required to retain for tax (see section 5). If you signed in with Apple, we also ask Apple to revoke Gwithva's access to your Apple ID.

10. Data that cleaners upload about their own clients

When a Service Provider uploads and manages their own client details using Gwithva purely as a tool, the Service Provider is the controller of that data and we act as a processor on their behalf, processing it only to provide the Platform. A separate Data Processing Agreement governs this relationship. For customers who are introduced or invited by a Service Provider and who book or transact through the Platform, our role (controller or processor) depends on the actual processing relationship and purposes and is determined on that basis — we do not assume either role simply because a Service Provider introduced the customer.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

12. Changes to this policy

We may update this policy. We will post the new version with an updated effective date and, for material changes, notify you.

13. Contact

[email protected] · Gwithva Software Limited, Unit A, 82 James Carter Road, Mildenhall, IP28 7DE