Privacy Policy

Last updated: 24 October 2026

Gevu (formerly Custodia) is a trading name of Seawolf Facilities Services Ltd, a company registered in England & Wales (no. 15028189) (“Seawolf”, “we”, “us”, or “our”). This Privacy Policy explains how we collect, use, store, and share personal data when you use the Gevu platform. We are committed to handling personal data responsibly and in compliance with the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025).

1. Data controller and processor

When Gevu is used by a business customer (“Customer”), that Customer is typically the data controller for the personal data of their staff, clients, and contacts held in their workspace. Seawolf Facilities Services Ltd acts as data processor on the Customer’s behalf for that data. For data relating to Customer account holders, billing contacts, and platform usage, Seawolf Facilities Services Ltd acts as data controller. Where a Customer connects a third-party integration (such as an accounting package) to their workspace, or generates an employment transfer document for a staff member, Seawolf acts as a processor facilitating that transfer; the receiving service or incoming employer becomes a separate controller for the data once received.

2. Data we collect

We collect and process the following categories of personal data:

• Account data: name, email address, role, and authentication credentials.
• Public staff profile data: a Customer may generate a shareable public page (a digital business card) for one of their staff members, which can display that person’s name, phone number, email address, job title, photo, a short bio, and any social media links they choose to add. Access requires the specific link; these pages are not indexed by search engines.
• Company data: business name, registered address, contact details, and staff count.
• Ownership verification data: if someone asks to take over as the main owner of a workspace (for example because the current owner has died, left the business, or can’t be reached), we collect what we need to confirm they are entitled to: a copy of their photo ID, Companies House records, supporting documents such as a death certificate or a letter from the company’s solicitor or accountant, our notes of the checks, and a recording of the verification video call (or a note of the in-person meeting if they prefer not to be recorded). Only the small number of our staff who handle these cases can see it.
• Prospective customer data: if you register interest in Gevu before creating an account, we collect your name, email, phone number, company name, Companies House number, job title, and any message you provide. Our team reviews these requests in Gevu and in our internal website-reporting app (see Cloudflare in section 5).
• Sales prospect data: to find cleaning businesses that may want Gevu, we use the public Companies House register (company name, number, registered area, business type and date registered) and the company’s own website (a general email address such as info@, and a business phone number). We don’t take directors’ names or personal email addresses from Companies House or websites. We hold a contact’s name, direct email or phone number only when that person gives it to us (for example on our website, in our 60-second check, or when we speak), or when someone who knows them introduces us. If we contact someone on LinkedIn, we keep a link to their public LinkedIn profile and a note that we messaged them. If you answer our 60-second check and give your email address, or open it from a trial link, we keep your answers with your record so we can show you where you could save time. If we send you a trial link, we record when it is opened and which of our public web pages are then viewed from the same network, so we know whether the invite was useful. We tell you where we got your details in our first message.
• Operational data: shift records, timesheets, job schedules, task completions, site visit logs, and compliance audit results.
• Employment and payroll data: for staff a Customer adds, their pay rates, contracted and worked hours, signed timesheets, payslips, holiday allowance and bookings, and absence records with the type of absence (for example sickness, holiday or parental leave). A record that someone was off sick is health information, which is special category data under UK GDPR; it is visible only to that staff member and the managers their company allows to see it.
• AI receptionist call data: where a Customer connects its own Retell AI account to answer its business phone line, we receive and store, for that Customer only, each caller’s phone number, the reason for the call, a summary and a transcript of the call. Callers are told at the start of every call that they are speaking to an AI assistant and that the call is recorded; that notice cannot be edited out. The call itself is handled by Retell under the Customer’s own agreement with Retell.
• Survey and meeting recordings: a Customer’s owners, admins and managers can record the conversation during a site survey walk-round, a voice note about one area of a site, or a meeting, using the mobile app or a browser. A recording is audio of what was said, so it can include the voices and words of the Customer’s clients, staff and anyone else present. Before a survey or meeting recording starts, the person recording must confirm that everyone present has been told it is being recorded and why, and we keep the time they confirmed it. When they choose to transcribe a recording, the audio is sent to Google’s Gemini API to produce a transcript and a summary (and, for meetings, suggested action points that a person reviews before any become tasks). Survey recordings are visible to the Customer’s owners, admins and managers; a meeting is visible only to the person who recorded it unless they share it with those roles. Cleaners and client logins never see recordings.
• CRM mailbox data: where a Customer connects a Gmail or Outlook mailbox to the CRM, we copy the emails exchanged with that Customer’s CRM contacts (sender, recipients, subject, body and dates) so they appear on the contact’s record. Other emails in the mailbox are not copied. Copies are deleted after 24 months by default.
• Employment transfer (TUPE/ELI) data: where a Customer is transferring staff to a new employer, it can complete an Employee Liability Information (ELI) dossier through a one-time-passcode-verified form. Per transferring employee, this can include date of birth, sex, pay and contract terms, holiday entitlement, notice period, trade union membership, working-time opt-out status, restrictive covenants, health notes, and attendance record, together with supporting documents (contract, right-to-work document, rota, payslip, pension documents). At company level it can also include disciplinary, grievance, redundancy, discrimination, and litigation history. This includes special category data (health information and trade union membership) under UK GDPR, processed on the basis of the Customer’s legal obligation to disclose Employee Liability Information under TUPE. The completed dossier is shared directly with the incoming employer, who becomes a separate data controller for it on receipt.
• Subcontractor applicant data: if you apply for a one-off job through our Subcontractor Procurement board (/subcontracting), we collect your name, company name (if any), phone number, and any logo you upload, together with any insurance certificate you provide (the file itself is retained) and a self-declaration of whether you hold a DBS check. We do not store DBS certificate copies — only the certificate number and expiry date you provide.
• Job posting data (Gevu Connect): if you post a cleaning job or subcontract listing through Gevu Connect, we collect your business name, contact name, email, phone number, site address, and any photos you upload of the premises. Your exact contact details and address are only released to a company after it pays to unlock the listing; until then, other companies see only an approximate area.
• Location data: GPS coordinates collected during active clock-in sessions (mobile app only, with user consent). For staff enrolled in Smart lone-worker monitoring, we also collect periodic background location, motion, and geofence signals (roughly every 15 minutes while armed) to confirm their wellbeing during a shift; for vehicles with trip tracking enabled, GPS-derived driving events such as harsh braking or acceleration; for staff who log business journeys, the route, distance and times of each journey while it is tracked, and, where they turn on automatic journey detection in the mobile app, a rolling record of the last 10 minutes of locations the phone has already determined, kept only on the phone and deleted after 10 minutes, so that a detected journey can include the stretch driven before detection. Automatic journey detection is optional: a staff member can decline it, turn it off at any time, and still log journeys by hand. For staff assigned to a vehicle, the mobile app also tells their company whether automatic journeys are switched on and whether location is allowed “all the time” on that phone, with the phone type (iPhone or Android) and when it last checked, so managers can see whose journeys cannot be logged automatically. This is a setting, not a location; only the latest check is kept, and staff are told about it in the app; where your browser or device permits it, your approximate location at the moment you submit a site audit, to help the Customer verify it was completed on-site; and, when a staff member presses SOS, their location at that moment and then about every 20 seconds (including while the phone is locked, where they have allowed background location), with speed and direction, until the SOS is closed or for at most 6 hours, shown to their company’s managers on the SOS screen together with the nearest street address.
• Emergency medical information: optional, and only if a staff member adds it themselves: allergies, medical conditions, medication and notes for paramedics. This is special category data (health information) under UK GDPR. It is shown to their company’s managers only while an SOS that staff member raised is open, never otherwise, and every time it is viewed is recorded with who viewed it and when. The staff member can change or clear it at any time, and clearing it deletes it.
• Emergency contact data: a Customer can record a next-of-kin or emergency contact for a staff member, including that person’s name, phone number, email address, and relationship to the staff member.
• Communication data: messages sent through the in-app messaging system and email notifications.
• Site feedback data: if you complete a feedback form after scanning a QR code at a client site, we collect your rating, category, and any comments or photo you submit, plus your email address only if you choose to leave one. Where your browser or device permits it, we also record your approximate location at the time of submission and its distance from the site, used only to help the company judge whether the feedback is genuine.
• Financial data: billing metadata, invoice records, and subscription status (payment card details are handled exclusively by Stripe and never stored by Gevu).
• Document engagement data: when a client opens an invoice, quote, or proposal inside the client portal, or clicks certain links in an email we send on the Customer’s behalf (for example a payment reminder or review request), we record that the document or link was opened and when. This is shown only to the Customer that sent the document, most commonly to help them judge whether to chase an unpaid invoice.
• CRM email engagement data: when a Customer sends an email to a sales contact from the CRM with tracking switched on, the email contains an invisible image and links that pass through Gevu. When the recipient’s email app loads that image or the recipient clicks a link, we record that it happened, when, which link was clicked, and a short label for the type of email app or device (for example “Gmail” or “iPhone”). We do not store the recipient’s IP address. This is shown only to the Customer that sent the email, which is the data controller for it, and is deleted on the same schedule as the Customer’s copied CRM emails (24 months by default). If you received such an email and want to stop it, you can block images in your email app, or ask the sender to stop tracking or to delete the data.
• Device and security data: device identifiers, IP addresses, browser type, session tokens, and MFA verification records. If you enable biometric login (fingerprint or Face ID) on our mobile app, your biometric data is processed entirely on your device by its operating system — we never receive or store it; only your login credentials, protected by your device’s secure storage, are unlocked by it.
• AI-assisted analysis data: site survey photos and related notes may be sent to Google’s Gemini API to help generate cleaning task lists, methodologies, and hazard/COSHH guidance; TUPE/ELI transfer data (see above) may also be analysed by the same service to flag employment-transfer risks for the Customer’s review. Other AI-assisted features — including an in-app AI search assistant, proposal and marketing content drafting, and operational insights — may also send relevant operational, client, staff, or financial data to Gemini when a Customer uses them; see our AI Usage Policy for the current list of AI features. We log the resulting output for quality and dispute-resolution purposes, but underlying photos are not retained in that log beyond the analysis.
• Cleaning Manager assistant data: a Customer’s owner or admin can enable an in-app AI assistant, named by the Customer, that answers questions about their own workspace and can report a new incident on the Customer’s behalf. When enabled, questions asked to it and the operational data needed to answer them — staff names and schedules, hours worked, job/site details, incident reports, and revenue/cost figures — are sent to Google’s Gemini API to generate a response. It cannot see individual pay rates, does not process payroll or invoicing, and cannot delete records. Conversations and every action it takes are logged and reviewable by the Customer’s owners and admins. This feature is off by default and only sends data for the one Customer workspace that enabled it — it has no access to any other Customer’s data.
• Staff verification badge data: a Customer can generate a public, link-only ID verification page for a staff member, showing their name, photo, role, current employment status, and DBS check status (whether checked, the check type, and expiry date) — used for on-site identity verification, for example by a client confirming who is attending their premises.
• Staff document vault data: alongside the DBS, right-to-work, and TUPE supporting documents described above, a Customer’s staff document vault can also store proof-of-address documents, National Insurance evidence, and PPE records for a staff member. A Customer can also record a staff member’s driving licence expiry date where relevant to their role (we do not store the licence number).
• Device media access (mobile app): with your permission, our mobile app can read photos from your device’s photo library so you can attach an existing photo as task or document evidence, and can save a copy of photos taken in the app (such as site survey photos) back to your device’s photo library. It uses the microphone only while you are recording a survey, voice note or meeting, and can save a copy of a recording to a folder you choose or to your Files app when you ask it to.
• Support data: information provided when contacting support.
• Website live chat data: if you use the chat on our public website, we collect your name, your email address if you give one, your messages, the page you started on, and a one-way hash of your IP address (used only to limit abuse). An AI assistant may answer your messages first: it is always labelled as AI, and your messages in that chat are sent to Google’s Gemini API to generate its replies, using only our public website content. Our team reads every chat and can take over at any time. If you leave an email address, we use it only to reply to your chat. Chats are deleted 90 days after the last message.
• Website usage data: for visitors to our public marketing pages, we record page(s) visited, referring site, approximate location (country/city derived from your IP address at the moment of the request — the IP address itself is not stored), device type, and browser, tied to a random session identifier that is cleared when you close your browser tab, plus a one-way hash derived from your IP address (keyed with a server-side secret, and not reversible to the address) so we can recognise a returning visit. Used only for internal traffic reporting, which our team views in Gevu and in our internal website-reporting app (see Cloudflare in section 5); see our Cookie Policy for details.
• Introducer programme: if you apply to be an introducer, we keep your name, contact details, business details and how you know cleaning businesses, plus your sign-in links and payout records, to run the programme. If your company signed up through an introducer’s link or code, that introducer can see, in their introducer account, your company name, when you signed up, when you started paying, and the commission each of your payments earns them (which shows what you paid). They cannot see anything else about your account. Cookie choices: when you save a choice in our cookie settings, we keep a record of it (a random id, what you chose, when, and on which page, never your IP address) for 25 months, so we can show what you agreed to.
• Services Directory data: for businesses listed in our public Services Directory, we hold the details they publish (business name, contact details, photos of their work, links to work they’ve done, offers) and, privately, the name and email of whoever applied and the email address that manages the listing. When a listing has a website, those emails must be on the website’s domain. Managers sign in with one-time email links; we keep only a scrambled (hashed) copy of each link. Photos are re-saved when uploaded, which removes hidden details such as the location they were taken. The business sees daily totals of how its listing is used (views, and taps on call, email, website, social links, work examples and its offer code), and where views came from: search, social, our own pages, the app, or the address of another website that linked to it (its site and page only, never anything after a ? in the address); these are counts only and never say who did what. A business can also link its Google listing: we store only Google’s ID for it, and our server fetches its Google rating and the reviews Google shares live each time the listing is viewed, without keeping them, so your browser doesn’t contact Google for it.
• Review data: if you review a business in the Services Directory, we collect your star rating, review, any headline, quick-tap words, price range and month of use you add, your name, your company if you give it, and your email address. We publish your first name and the first letter of your surname, your company and your review; your email address is never shown. We use it to confirm your review, to allow one review per business, and to contact you if your review is reported. The business is told when it gets a new review but is not given your email address. See our Review Policy.
• Earlier Directory contact records: a previous review process recorded when a browser opened a contact link from a listing, if the visitor had allowed the review shortcut. We no longer create or use these records to verify reviews. Existing records are deleted by routine retention within one year, and any related dir_engaged cookie expires automatically.
• Blog views and “Was this useful?”: when you read a blog post for a few seconds we add one to its view count, and if you tap “Yes, useful” or “Not quite” we count that too. To count each reader once we use a one-way scrambled form of your connection’s IP address and browser (keyed with a server-side secret, not reversible, and never the address itself), kept for 2 days for views and a year for answers. Nothing is saved on your device except your own answer, so the post remembers it. If you tell us what was missing, we keep that line of text; it includes your name or contact details only if you type them. Totals may be shown on the post once it has enough readers; the “Not quite” answers and notes are seen only by our team, in Gevu and in our internal website-reporting app (see Cloudflare in section 5).
• Directory reports: if you report a listing or review, we collect your reason and details, and your name and email address only if you give them (so we can reply). We use a one-way scrambled form of your connection’s IP address and of your message, kept only for a day, to stop repeated or automated reports.
• Referral source data: if you apply to a job on the Subcontractor Procurement board (/subcontracting) after following a shared link, we record which type of link you arrived from (for example, that it was shared from the job board or from a specific listing) so we can measure whether sharing job listings is effective. This does not identify who shared the link with you, and is not used for advertising or shared with any third party.

Where we get personal data from

Most personal data comes from you, or from the Customer you work for or with. A Customer adds its own staff, clients, sites and contacts, and staff may add details about other people, such as an emergency contact; the Customer is responsible for telling those people. We also receive data from public sources and services a Customer uses: UK Companies House (company and officer details for CRM research), DVLA and DVSA (vehicle tax and MOT status), address lookup services (the address for a postcode), and any accounting, calendar, mailbox or phone service the Customer connects.

3. Legal bases for processing

We rely on the following legal bases under UK GDPR:

• Contract: processing necessary to provide the Service you have subscribed to.
• Legitimate interests: security monitoring, fraud prevention, platform reliability, and product improvement, where these do not override your rights.
• Legal obligation: compliance with applicable laws, including tax records and lawful requests from authorities.
• Consent: for location data collection and any optional communications. Where a location feature relies on consent, such as automatic journey detection, staff can refuse or withdraw it at any time without giving a reason, and the app offers another way to do the same task (for example logging a journey by hand).
• Legitimate interests (selling to cleaning companies): contacting cleaning businesses that may want Gevu. We only send unrequested emails to limited companies, at general business addresses, with a way to opt out in every message, and we screen phone numbers against the Telephone Preference Service registers before any sales call.
• Legitimate interests (ownership verification): checking the identity and authority of anyone who asks to take over the main owner role of a workspace, so that nobody can take control of a business’s staff, payroll and client data by pretending to be its owner, and keeping a record in case the change is disputed later.
• Legitimate interests (journey setup status): showing a staff member’s company whether automatic journeys and “all the time” location are switched on for them, so that business mileage and vehicle records stay complete. Only the setting is shared, never a location.
• Explicit consent and vital interests (special category data): emergency medical information is processed on the basis of the staff member’s explicit consent, given by choosing to add it, and is only shown when it may be needed to protect their vital interests during an SOS.
• Employment law obligation (special category data): where TUPE/ELI transfer data includes health information or trade union membership, this is processed on the basis that it is necessary for compliance with employment law obligations relating to a transfer of employment. Sickness absence records are processed on the same employment law basis, for the Customer to manage absence and statutory sick pay.
• Legitimate interests (our website and sales): answering website chats and enquiries, and contacting businesses we reasonably believe could use Gevu. Every such email lets you opt out, and we keep a record of opt-outs so you are not contacted again.
• Legitimate interests (Services Directory and reviews): running a directory people can trust: publishing listings businesses ask us to publish, checking that reviews come from genuine customers, stopping fake reviews and misuse of the report forms, and keeping a record of moderation decisions, as the Digital Markets, Competition and Consumers Act 2024 expects of a site that publishes reviews. You can object at any time, and we will remove your review if you ask.
• Consent (analytics): product analytics and session replay on our websites each run only after you switch them on in cookie settings (or choose “Accept all”), and stop if you switch them off.

Automated decisions and AI

We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects on them. Our AI features draft, suggest, summarise and answer questions; a person at the Customer reviews AI output before it is used, and payroll figures calculated by the platform only become payslips after the Customer approves them. Automatic alerts, such as a missed clock-in, a lone-worker check or an SOS escalation, tell a person to look at something; they do not decide anything about the staff member. See our AI Usage Policy.

Staff monitoring

Location, clock-in and lone-worker features let a Customer see where and when its staff work. The Customer, as the employer and data controller, decides which of these features to use and is responsible for telling its staff, for using them only where justified, and, where the monitoring is likely to be high risk, for carrying out a data protection impact assessment, in line with the ICO’s guidance on monitoring workers.

Recordings

The Customer, as data controller, decides whether its people record surveys and meetings and is responsible for having a lawful basis for it (usually its legitimate interest in recording what was agreed accurately), for telling everyone present before recording starts, for not recording anyone who objects, and for not recording health, disciplinary or other sensitive conversations. Anyone who was recorded can ask the Customer for a copy of the recording or transcript, or for it to be deleted.

4. How we use data

We use personal data to: provide and operate the Service; authenticate users and enforce role-based access; send operational notifications (shift reminders, invoice alerts, security events); generate reports and analytics within your workspace, including whether a sent invoice, quote, or proposal has been opened by its recipient; measure whether shared job listings on the Subcontractor Procurement board lead to applications; operate the Gevu Connect and Subcontractor Procurement marketplaces, including matching job postings with applicants; sync data with accounting or messaging integrations a Customer chooses to connect; detect and prevent fraud, abuse, or security incidents; improve reliability and develop new features; and meet legal and regulatory obligations.

5. Sharing and subprocessors

We do not sell personal data or share it for advertising. We share data only with the service providers below. Where a provider processes personal data on our behalf (a “subprocessor”), we have a data processing agreement with it. Free public lookup services (such as OpenStreetMap, postcodes.io and OSRM) are used on their published terms and receive only search text, a postcode or map coordinates, never a name. Integrations a Customer connects to its own account (accounting, calendar, mailbox, WhatsApp or Retell) are that Customer’s own providers, used on its instruction.

• Supabase — database hosting and authentication infrastructure.
• Stripe — payment processing and subscription management.
• Firebase (Google) — push notification delivery to mobile devices.
• Postmark (ActiveCampaign) — transactional email delivery (invoices, MFA codes, portal invites, and other account notifications).
• Google (Gemini API) — AI-assisted document generation features, transcribing and summarising survey and meeting recordings when a user asks, the optional Cleaning Manager assistant where a Customer has enabled it, and the AI assistant in our website live chat.
• Vercel — web application hosting and delivery.
• Cloudflare — hosts our internal website-reporting app, which our team uses to view the website usage data described in section 2 (pages visited, referring site, approximate location, device, browser and the one-way visitor hash, never an IP address). It also shows our team the register-interest requests described in section 2 (name, company, job title, email, phone and message), and blog view and answer totals with readers’ “what was missing” notes. It reads these from Gevu over an authenticated connection when the team opens them and does not keep a copy.
• PostHog — product usage analytics, hosted in the EU.
• Sentry — error tracking and diagnostics, including session replay for debugging (text fields are masked and media is blocked by default).
• FreeAgent, Xero, and Sage — accounting sync, only where a Customer connects one of these to their own account; can include client contact details and staff timesheet data.
• WhatsApp Business (Meta) — sends WhatsApp notifications, only where a Customer enables this.
• Microsoft (Microsoft Graph / Microsoft 365 Calendar) — syncs booking and site-visit calendar events, only where a Customer connects this.
• Google (Sign in with Google and Google Calendar) — signs you in with your Google account if you choose that option, and syncs calendar events, only where a Customer connects Google Calendar.
• ipapi.co and Open-Meteo — the weather shown on the dashboard and client portal: your browser asks ipapi.co for an approximate location based on your IP address, then asks Open-Meteo for the weather there. We do not store either.
• DVLA and DVSA (UK government) — vehicle tax and MOT history lookups by registration number, for vehicles a Customer adds to their fleet.
• Google Maps/Places, Komoot, OpenStreetMap, postcodes.io, OpenRouteService, and OSRM (Open Source Routing Machine) — address lookup, autocomplete, and route/distance calculation between sites; your search text or site coordinates are forwarded to whichever provider is available and are not stored by us beyond short-term rate-limiting.
• Browser and device push services (Google, Mozilla, Apple) — where Firebase is not used, browser push notifications are delivered directly through your browser vendor’s own push infrastructure; we send only the notification content, not your identity, to that service.
• UK Companies House — company name/number lookups and officer/filing information, used to enrich CRM prospect research.
• Trustpilot — retrieval of a company’s own public review data, where this feature is used.
• Apple (Apple Push Notification service and Sign in with Apple) — delivers notifications to iPhones, and signs you in with your Apple ID if you choose that option.
• Google (Gmail API) and Microsoft (Outlook through Microsoft Graph) — reads and sends CRM emails, only where a Customer connects a mailbox to the CRM.
• Retell AI — answers a Customer’s phone line with an AI receptionist, only where that Customer connects its own Retell account.
• OpenAI, Anthropic, or Google (Gemini API) on the Customer’s own account — run that Customer’s AI features, only where the Customer connects its own AI provider key. The data sent is the same as described for the Gemini API above, and the provider handles it under the Customer’s own agreement with it, not ours.
• getAddress.io and Ideal Postcodes — find the addresses for a UK postcode when you type one; they receive the postcode only.
• Ship24 — tracks supplier deliveries from their tracking numbers; it receives the tracking number and carrier, not who ordered.

We may disclose data to law enforcement or regulators where required by law or to protect the rights and safety of users.

6. International transfers

Our database and file storage are hosted in the European Union (Ireland), which the UK recognises as adequate. Some processing happens outside the UK and EU: our application servers (Vercel) run partly in the United States, and several providers above, such as Google, Stripe, Apple and Sentry, are based there. For these transfers we rely on the UK–US data bridge where the provider is certified under it, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the provider’s security measures. You can ask us for details of the safeguard used for a particular provider.

7. Retention

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires. Unless a Customer chooses a different period in its settings:

• Account and workspace data: for as long as the subscription is active. When a workspace is deleted, its data is removed within 30 days, except records we must keep by law (for example our own invoices and tax records, kept for 6 years).
• Deleted records: anything a Customer deletes is held in a recovery archive for 90 days, then permanently removed.
• GPS location pings: 30 days by default (the Customer can change this). The location trail of an SOS is deleted after 90 days; the first and last positions stay with the incident record.
• Audit logs: personal details are removed from audit entries after 90 days by default.
• Quality-check photos: 90 days by default. Photos on closed site issues: 12 months by default.
• CRM email copies: 24 months by default.
• Survey and meeting recordings: the audio is deleted 30 days after it is transcribed, or 90 days after it was recorded if it is never transcribed. The transcript and summary are kept until the Customer deletes the note or meeting. A copy a user saves to their own device is outside our systems and is the Customer’s responsibility.
• Website live chats: 90 days after the last message.
• Services Directory reviews: published reviews are kept while the listing exists, or until you ask us to remove yours. Reviews never confirmed are deleted 7 days after their confirmation link expires.
• Directory contact records: one year after your last contact through a listing (the cookie itself expires after a year).
• Directory reports: 12 months after our team closes them. The scrambled IP and message copies used to stop repeat reports are kept for 24 hours.
• Listing sign-in links: deleted once used or expired (links last 30 minutes, sign-ins 14 days).
• Emergency medical information: until the staff member clears it or their account is deleted.
• Sales prospect records: deleted 12 months after the last contact if the company never signs up. If a company asks us not to contact it again, we keep only its email address and company number on a do-not-contact list, so we never contact it by mistake.
• Ownership verification data: 6 years after the case is closed, which is how long a change of owner could be challenged in court, then permanently deleted. This includes ID copies and call recordings.
• Payroll and employment records: the Customer, as employer, decides how long to keep these to meet its own legal duties (HMRC generally expects payroll records to be kept for at least 3 years).

Backups are encrypted and kept on a rolling basis for a limited period (database copies for up to 35 days, deleted files for up to 90 days), so deleted data also leaves our backups once they roll over.

8. Your rights

Under UK GDPR, you have the right to: access your personal data; correct inaccurate data; request deletion of your data (subject to legal obligations); restrict or object to processing, including an absolute right to object to direct marketing; request data portability; not be subject to a decision based solely on automated processing that significantly affects you; and withdraw consent at any time where processing is consent-based. We reply within one month, which can be extended by two further months for complex requests (we will tell you if so). If you are a staff member, client or contact of a Customer, that Customer controls your data in its workspace, so please contact it first; if you contact us, we will pass your request to it promptly and help it respond. To exercise any of these rights, contact us at support@seawolfservices.co.uk. You can also export and delete your account data from the platform settings. If you submit a written complaint about how we have handled your personal data, we will acknowledge it within 30 days. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been mishandled.

9. Security

We apply technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest, database row-level security that keeps each Customer’s data separate, role-based access controls, multi-factor authentication, audit logging, and regular security reviews. No system is entirely secure. If a personal data breach is likely to put people at risk, we report it to the ICO within 72 hours of becoming aware of it, tell affected Customers without undue delay so they can meet their own duties, and tell affected people directly where the risk to them is high.

10. Cookies

We use essential cookies and browser storage for authentication and session management, and analytics only if you accept them on our cookie banner. See our Cookie Policy for details.

Change cookie settings

11. Children

Customer accounts and our website are for adults: you must be 18 or over to open an account. A Customer may add staff aged 16 or 17 whom it lawfully employs; it is responsible for doing so in line with employment law and for explaining to them how their data is used. We do not knowingly collect data from children under 16. If you believe a child’s data has been submitted, contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top shows the latest version. We will tell Customers about material changes by email or in-app notice before they take effect.

13. Contact

For privacy enquiries or to exercise your rights, contact: support@seawolfservices.co.uk
Seawolf Facilities Services Ltd, England & Wales (no. 15028189).

← Back to policies