Privacy Policy
Last updated: 17 September 2026
1. Who we are
Guv is a job management app for trade businesses. It is operated by Glebefish Limited, a company registered in England and Wales (company number 14038854), whose registered office is at 1 Johns Road, Woolston, Southampton, SO19 9BW ("we", "us").
For privacy questions, or to exercise any of the rights in section 8, contact us at hello@guvguvguv.com.
2. Two different kinds of people, and who is responsible for their data
This distinction matters, because Guv holds personal data about people who never use the app.
Guv users — the business owners, admins and workers who sign in and use the app. For their account data, we are the data controller.
Customers of those businesses — the homeowners and clients whose name, address, phone number, email and signature a trade business records against a job. These people do not have Guv accounts and typically never interact with us. For their data, the trade business using Guv is the data controller and we act as a data processor on that business's instructions.
In practice: if you are a customer of a business that uses Guv and you want your data corrected or deleted, please contact that business directly — they control it. We will assist them, but we cannot act on their data without their instruction.
3. What we collect
From people who use the app
| Data | Why |
|---|---|
| Email address | Sign-in credential and account identifier |
| Password | Authentication. Handled entirely by Google Firebase Authentication; we never see or store it |
| Name | Shown to colleagues so jobs and messages are attributable |
| Phone number (optional) | So colleagues can reach you about a job |
| Your role, and which company you belong to | Controls what you are allowed to see and do |
| Notification token | To deliver push notifications about your jobs. Tied to your device |
| Where your phone was at the moment you tapped a stage — only where your employer has turned this on | So the office can see that a job stage was recorded at the job address. One reading, taken at the instant you press the button, and nothing in between. The app tells you before this is ever switched on for you. See section 4 for exactly what it does not do |
About the trade business's customers, entered by its staff
| Data | Why |
|---|---|
| Customer name, phone, email | Identifying and contacting the customer about the job |
| Job address, and its map coordinates | Locating the job and providing directions |
| Signature, and the name of the person signing | Proof the customer accepted the completed work |
| Job details, notes and photographs | The record of the work itself |
| A record of each job email sent to them, and what became of it | Only where the trade business has turned job emails on. We keep the address it went to, when, and whether it arrived, bounced or was reported as spam — bounces and spam reports are what get a sending address blocked, and they arrive silently |
| The fact that they asked us to stop emailing them | Kept so that we do not email them again. It is the record that makes an unsubscribe stick |
| What they were quoted and charged, and the billing name and address on the invoice | Quoting the work and invoicing for it. An issued invoice also records the VAT position — whether VAT was charged, at what rate, and where the domestic reverse charge applies, the amount the customer must account for to HMRC themselves. See section 7: an issued invoice is a VAT record and is kept for six years, including where a deletion is requested |
Photographs are taken by workers to document work. They may incidentally show the inside or outside of a customer's property.
Collected automatically
| Data | Why |
|---|---|
| Crash reports — error details, device model, operating system version | Diagnosing crashes. Provided by Google Firebase Crashlytics |
| Usage data — which screens are opened, and actions such as creating a job or completing a sign-off | Understanding which parts of the app are used, and where people get stuck. Provided by Google Analytics for Firebase |
| An app instance identifier | Used by the above to group events from the same installation. Reset if you reinstall the app |
| Your user ID, attached to the above | So we can diagnose a fault affecting a specific user who reports one |
Crash and usage reporting is on by default.
4. What we deliberately do not collect
- We do not track your location, and the difference from what we do collect matters. Where your employer has turned it on, the app records where your phone was at the single moment you tap a stage — and that is all. It does not follow you. It reads nothing while the app is closed or in your pocket, nothing between one tap and the next, nothing on your way to or from work, and nothing at all on a day you tap nothing. There is no trail, because there is nothing to join up: a job with four stages has at most four readings on it, each one taken at a moment you chose by pressing a button. The app has no background location permission and no always-on location service — not as a setting we have switched off, but because it does not ask the operating system for either. If your employer has not turned this on, or you have not granted location permission, the app records no position of yours at any time. The other use of the permission is unchanged: to place a job on a map, the job address is sent to Google to be converted into coordinates and to draw the map. That is the address someone typed, not anyone's location. And when a worker taps “Open in Maps”, the job address is handed to whichever navigation app they pick — Google Maps, Waze or Apple Maps. That app is then working for them, not for us, and what it does with the address is covered by its own terms rather than by this policy. Nothing else about the job goes with it.
- We do not use your data for advertising, and we do not sell it.
- We do not share your data with third parties for their own purposes. Google Analytics offers a setting that would let Google use the data we collect to improve its own products; we have turned it off, so Google handles that data only on our instructions. See section 6.
5. Legal basis for using this data (UK GDPR)
- Performance of a contract — providing the app to businesses that have signed up for it, and to their staff.
- Legitimate interests — keeping the app secure, diagnosing crashes, and understanding usage to improve it. We have considered the impact on you and believe these uses are ones you would reasonably expect. Analytics data is not used to make decisions about individuals.
Where we act as a processor (see section 2), the trade business is responsible for establishing its own legal basis for holding its customers' data.
6. Who your data is shared with
Guv is built on Google Firebase, and Google acts as our sub-processor for authentication, database storage, file storage, push notifications, crash reporting and analytics. Google's handling of that data is governed by its own terms.
Data is stored in Google's London (europe-west2) region. Some Google services — including crash reporting and analytics — may process data outside the UK. Where that happens, it is covered by Google's data transfer safeguards.
Google Analytics data sharing is turned off. Analytics offers a setting that lets Google use the data to improve its own products; enabling it would make Google an independent user of that data rather than a service acting on our instructions. We have disabled it, along with the options that contribute to industry benchmarks and that give Google's sales staff access. The one option we have left on lets Google's technical support staff look at the data when diagnosing a fault.
We also use Resend as a sub-processor to send email on our behalf. It is used only to send email and for no other purpose. Messages are sent from Ireland; Resend's own infrastructure is in the United States, covered by standard contractual clauses and the UK Addendum. There are two kinds of message:
- Invitations. When a trade business invites someone to join it on Guv, we pass that person's email address and the name of the person inviting them, so the invitation can be delivered.
- Job updates to a trade business's own customers — only if that trade business turns them on. This is off unless a trade business chooses to switch it on, and it can be sent either from our own address on their behalf or, if they have connected their Microsoft or Google account to us, from their own mailbox. Where it is on, we pass that customer's name and email address, and what the message says about their job — its title, its reference, the address and, when it is complete, who signed for it. Every one of those emails carries a link the customer can use to stop them.
This changed on 6 September 2026. Until then this section said no job or customer data was sent to Resend, which was true of the service as it stood. It is written this way before the feature can be used rather than after, so this page is never describing something narrower than what the software can do.
Our map server — added 17 September 2026, before the feature reaches anyone. Working out the real driving distance of a job runs on a machine we rent from Hetzner Online GmbH and run ourselves. It is sent map coordinates — the points a job starts and finishes at — and nothing else: no name, no address in words, no phone number, no email address. The map it reads is open data held on that same machine. It is in Germany, so the data stays in the EU and no transfer safeguards are needed.
Address lookup. When a postcode is typed and an address picked from the list that comes back, that postcode is sent to Ideal Postcodes, in the United Kingdom, which returns every address at it. The postcode on its own is all they get — nothing about the customer, the job or who was asking.
Two further services support the app without receiving job or customer data:
- Expo builds the app and delivers updates to it. When your phone checks whether a newer version exists, Expo sees its IP address and the app version.
- Cloudflare hosts our website and forwards email sent to our contact address, so anything you email us passes through it.
Anthropic — in use since 3 September 2026. Anthropic Ireland, Limited is on our sub-processor list as of 1 September 2026 for one feature: importing an existing customer list from a spreadsheet, where the column headings and a sample of up to twenty rows are sent so the layout can be worked out. It was listed here, and you were told by email, before it was switched on — which is the point of listing it. Anthropic’s agreement with us states that they may not train models on our data and treats it as confidential. We also read their own supplier list on 1 September 2026 to check nobody reads it by hand — there is no data labelling or human review arrangement on it, which is what would put a person in front of your file. Nothing else in Guv sends data to an AI or machine learning service. What we send is deleted within 30 days — that is Anthropic’s standard period for business customers. We asked them on 1 September 2026 for the arrangement where it is not stored at all, and on 4 September 2026 they declined — they reserve custom retention arrangements for organisations large enough to meet their enterprise criteria, which we are not. So thirty days is the position rather than something pending, and we will ask again if that ever changes. Their agreement with us forbids training on it either way. The one exception, which we cannot switch off: if their automated safety systems flag something, they may keep it for up to two years.
A complete and current list, including what each service handles and where, is published at guvguvguv.com/subprocessors.
We do not share your data with anyone else, except where we are legally required to.
7. How long we keep it
- Job records, photographs and sign-offs are kept for as long as the trade business's account is active, because they are that business's working records. The business decides when to delete them.
- Account details are kept while the account is active.
- Invitations expire automatically after 7 days.
- A record that somebody asked us to stop emailing them is kept indefinitely, on purpose. Deleting it is how an unsubscribe gets undone by accident. It is the address and the date, and nothing else.
- An issued invoice is kept for six years from the date it was issued, and a deletion request does not reach it. That is not our choice: HMRC requires VAT records to be kept for six years, and the UK GDPR right to erasure does not apply where the law requires the information to be held (Article 17(3)(b)). It is the invoice as it was sent — the billing name and address, the lines, the figures and the VAT. Added 7 September 2026, when invoicing was built. Everything else about the money goes: an unissued draft invoice is deleted, the link a customer was sent to view an invoice is deleted — which also stops that link working — and what a job was priced or quoted at is deleted with the job. Where a business closes its account entirely, all of it goes including the issued invoices, and it is that business's own responsibility to export its records first.
- The log of job emails sent — address, time and delivery outcome — is deleted automatically after 90 days, and sooner if that customer or the whole company is deleted. Ninety days is what the log is for: catching bounces and spam complaints, which is a question about now rather than a history worth keeping. Added 6 September 2026 — it had no expiry at all until then, which was said here before it was fixed rather than after.
- The position recorded when you tap a stage is kept with the job it belongs to, and is deleted when that job is. It is not held anywhere else and there is no separate log of it. We keep it with the job rather than expiring it sooner because it only means anything next to the stage it corroborates — a question about when a vehicle arrived somewhere is usually asked weeks later, and a stage time whose corroboration has been deleted underneath it is worse than one that never had any. The trade business decides when to delete its job records, and deleting the job deletes this with it.
- Crash and usage data is retained according to Google Firebase's own retention settings.
- Data waiting to be sent, held on the worker's phone. The app is built to work without a signal, so a photograph or a customer's signature captured on site is stored on that device until it can be uploaded. It is deleted from the device as soon as it reaches our servers. If it repeatedly cannot be sent, it is deliberately kept on the device rather than discarded — a customer's signature is the record that the work was done, and losing it would be worse than holding it — and the app shows the worker that it is still waiting. It is removed if the app is uninstalled.
8. Your rights
Under UK data protection law you have the right to: access a copy of your data; have inaccurate data corrected; have your data deleted; restrict or object to how we use it; and receive your data in a portable format.
One thing the right to deletion does not reach, and we would rather say so here than when you ask. An invoice that has been issued to you is a VAT record and the law requires it to be kept for six years — see section 7 for what that covers and what is deleted alongside it. Nothing else about the money survives a deletion request.
To exercise any of these, contact hello@guvguvguv.com. We will respond within one month.
If you are a customer of a business that uses Guv, please contact that business — see section 2.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
9. Security
Access is controlled by server-enforced security rules, so a business's data can only be read by members of that business. Passwords are handled by Google Firebase Authentication and are never visible to us. Data is encrypted in transit and at rest by Google. Changes to user roles and permissions are recorded in an audit log.
No system is completely secure, and we cannot guarantee absolute security.
10. Children
Guv is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
11. Changes to this policy
If we make significant changes we will update the date at the top and, where the change materially affects you, notify you in the app.