Privacy Policy
Last updated: 12 October 2026
1. Who we are
Guv is a job management app for trade businesses. It is operated by Glebefish Limited, a company registered in England and Wales (company number 14038854), whose registered office is at 1 Johns Road, Woolston, Southampton, SO19 9BW ("we", "us").
For privacy questions, or to exercise any of the rights in section 8, contact us at hello@guvguvguv.com.
2. Two different kinds of people, and who is responsible for their data
This distinction matters, because Guv holds personal data about people who never use the app.
Guv users — the business owners, admins and workers who sign in and use the app. For their account data, we are the data controller.
Customers of those businesses — the homeowners and clients whose name, address, phone number, email and signature a trade business records against a job. Most never interact with us. If the trade business turns on its customer portal and gives a customer access, that customer can sign in to see their own jobs, quotes and invoices. For their data, the trade business using Guv is the data controller and we act as a data processor on that business's instructions.
In practice: if you are a customer of a business that uses Guv and you want your data corrected or deleted, please contact that business directly — they control it. We will assist them, but we cannot act on their data without their instruction.
3. What we collect
From people who use the app
| Data | Why |
|---|---|
| Email address | Sign-in credential and account identifier |
| Password | Authentication. Handled entirely by Google Firebase Authentication; we never see or store it |
| Name | Shown to colleagues so jobs and messages are attributable |
| Phone number (optional) | So colleagues can reach you about a job |
| Your role, and which company you belong to | Controls what you are allowed to see and do |
| Notification token | To deliver push notifications about your jobs. Tied to your device |
| The phones you sign in on: the model and when it was last used | To tell you if your account is also signed in on another phone. Only you can see it. Deleted when you sign out on that phone, or with your account |
| Which of the company's vehicles you are assigned to, and any odometer reading you enter, only where your employer keeps its vehicles in the app | So the office knows who drives which vehicle and when it is due its MOT, tax, insurance or service. A reading is only ever one you type in yourself |
| Where your phone was at the moment you tapped a stage — only where your employer has turned this on | So the office can see that a job stage was recorded at the job address. One reading, taken at the instant you press the button, and nothing in between. The app tells you before this is ever switched on for you. See section 4 for exactly what it does not do |
About the trade business's customers, entered by its staff
| Data | Why |
|---|---|
| Customer name, phone, email | Identifying and contacting the customer about the job |
| Job address, and its map coordinates | Locating the job and providing directions |
| Signature, and the name of the person signing | Proof the customer accepted the completed work |
| Job details, notes and photographs | The record of the work itself |
| A record of each job email sent to them, and what became of it | Only where the trade business has turned job emails on. We keep the address it went to, when, and whether it arrived, bounced or was reported as spam — bounces and spam reports are what get a sending address blocked, and they arrive silently |
| The fact that they asked us to stop emailing them | Kept so that we do not email them again. It is the record that makes an unsubscribe stick |
| What they were quoted and charged, the billing name and address on the invoice, and on each job line the delivery address, the contact the job was for and the name of whoever signed for it | Quoting the work and invoicing for it. An issued invoice also records the VAT position — whether VAT was charged, at what rate, and where the domestic reverse charge applies, the amount the customer must account for to HMRC themselves. See section 7: an issued invoice is a VAT record and is kept until six years after the end of its tax year, including where a deletion is requested |
| The email address a customer signs in to the customer portal with, and when they signed in | Only where the trade business has turned its customer portal on and given that customer access. They sign in with a one-time link emailed to them, so no password is ever created. The address and sign-in record are held by Google Firebase Authentication |
Photographs are taken by workers to document work. They may incidentally show the inside or outside of a customer's property.
Collected automatically
| Data | Why |
|---|---|
| Crash reports — error details, device model, operating system version | Diagnosing crashes. Provided by Google Firebase Crashlytics |
| Usage data — which screens are opened, and actions such as creating a job or completing a sign-off | Understanding which parts of the app are used, and where people get stuck. Provided by Google Analytics for Firebase |
| An app instance identifier | Used by the above to group events from the same installation. Reset if you reinstall the app |
| Your user ID, attached to the above | So we can diagnose a fault affecting a specific user who reports one |
Crash and usage reporting is on by default.
4. What we deliberately do not collect
- We do not track your location, and the difference from what we do collect matters. Where your employer has turned it on, the app records where your phone was at the single moment you tap a stage or take the delivery photo — and that is all. It does not follow you. It reads nothing while the app is closed or in your pocket, nothing between one tap and the next, nothing on your way to or from work, and nothing at all on a day you tap nothing. There is no trail, because there is nothing to join up: a job with four stages has at most four readings on it, each one taken at a moment you chose by pressing a button. The reading at the delivery photo is used to remember where the door is, so the next fitter to that address is taken to the door rather than the road. It is saved against the customer's address without your name or the time. The app has no background location permission and no always-on location service — not as a setting we have switched off, but because it does not ask the operating system for either. If your employer has not turned this on, or you have not granted location permission, the app records no position of yours at any time. The other use of the permission is unchanged: to place a job on a map, the job address is sent to Google to be converted into coordinates and to draw the map, or to Apple on an iPhone. Both do this as independent controllers under their own terms; see section 6. That is the address someone typed, not anyone's location. And when a worker taps “Open in Maps”, the job address is handed to whichever navigation app they pick — Google Maps, Waze or Apple Maps. That app is then working for them, not for us, and what it does with the address is covered by its own terms rather than by this policy. Nothing else about the job goes with it.
- We do not use your data for advertising, and we do not sell it.
- Apart from the map, address and card payment services named in section 6, we do not share your data with third parties for their own purposes. Google Analytics offers a setting that would let Google use the data we collect to improve its own products; we have turned it off, so Google handles that data only on our instructions. See section 6.
5. Legal basis for using this data (UK GDPR)
- Performance of a contract — providing the app to businesses that have signed up for it, and to their staff.
- Legitimate interests — keeping the app secure, diagnosing crashes, and understanding usage to improve it. We have considered the impact on you and believe these uses are ones you would reasonably expect. Analytics data is not used to make decisions about individuals.
Where we act as a processor (see section 2), the trade business is responsible for establishing its own legal basis for holding its customers' data.
6. Who your data is shared with
Guv is built on Google Firebase, and Google acts as our sub-processor for authentication, database storage, file storage, push notifications, crash reporting and analytics. Google's handling of that data is governed by its own terms.
Data is stored in Google's London (europe-west2) region. Some Google services — including crash reporting and analytics — may process data outside the UK. Where that happens, it is covered by Google's data transfer safeguards.
Google Analytics data sharing is turned off. Analytics offers a setting that lets Google use the data to improve its own products; enabling it would make Google an independent user of that data rather than a service acting on our instructions. We have disabled it, along with the options that contribute to industry benchmarks and that give Google's sales staff access. The one option we have left on lets Google's technical support staff look at the data when diagnosing a fault.
We also use Resend as a sub-processor to send email on our behalf. It is used only to send email and for no other purpose. Messages are sent from Ireland; Resend's own infrastructure is in the United States, covered by standard contractual clauses and the UK Addendum. There are two kinds of message:
- Invitations. When a trade business invites someone to join it on Guv, we pass that person's email address and the name of the person inviting them, so the invitation can be delivered.
- Job updates to a trade business's own customers — only if that trade business turns them on. This is off unless a trade business chooses to switch it on, and it can be sent either from our own address on their behalf or, if they have connected their Microsoft or Google account to us, from their own mailbox. Where it is on, we pass that customer's name and email address, and what the message says about their job — its title, its reference, the address and, when it is complete, who signed for it. Every one of those emails carries a link the customer can use to stop them.
This changed on 6 September 2026. Until then this section said no job or customer data was sent to Resend, which was true of the service as it stood. It is written this way before the feature can be used rather than after, so this page is never describing something narrower than what the software can do.
Our map server — added 17 September 2026, before the feature reaches anyone. Working out the real driving distance of a job runs on a machine we rent from Hetzner Online GmbH and run ourselves. It is sent map coordinates and nothing else: the stops on a job, and, for a business that keeps its vans in the app, the business's own address as the start and end of each van's day. No name, no address in words, no phone number, no email address. The map it reads is open data held on that same machine. It is in Germany, so the data stays in the EU and no transfer safeguards are needed.
Drive times in traffic, added 28 September 2026. When a job is raised on the office dashboard, how long it will take to drive in the usual traffic for the day and time it leaves is worked out by HERE Europe B.V., in the Netherlands. Only on a business whose jobs are priced by the mile on the dashboard, which is Vanround's; a Guv job is never sent to it. It is sent map coordinates and the day and time the job leaves, nothing else: no name, no address in words, no phone number, no email address. The drive time that comes back is deleted from the job after 30 days. HERE has confirmed that requests are processed in the EU, on Amazon Web Services in Frankfurt and Ireland.
Following a job, added 5 October 2026. A firm can choose to give its customers a page that follows their job, on a link only they have. It is off until the firm switches it on. The page shows the stage the job has reached and when it got there. It never shows a map, a position or anything about the worker, and nobody's position is used for it. The link stops working after three days, and switching the page off stops every link already sent. The link comes with a short tracking code the customer can type in at guvguvguv.com/track instead, with the job's delivery postcode. The code is kept with that postcode so the two can be checked together, and both are deleted a day after the link stops working.
Maps and addresses, corrected 30 September 2026. Turning a typed job address into coordinates is done on our own map server, from the postcode in it, using Ordnance Survey's open postcode data: the server is sent the postcode and nothing else. Drawing a map in the app is done by Google's Maps service on Android phones and by Apple's on an iPhone, which see the device's IP address and the area on screen. Changed with the October 2026 update: before it, the typed address went to Google, or on an iPhone to Apple, to be turned into coordinates. Google and Apple do this as independent controllers, under their own terms, rather than on our instructions. The maps on the office dashboard are drawn from the OpenStreetMap Foundation's tile servers, which see the office computer's IP address and the area on screen, under the Foundation's own privacy policy. Until 30 September this section did not name Apple or OpenStreetMap, or say that Google does this as a controller.
Address lookup. When a postcode is typed and an address picked from the list that comes back, that postcode is sent to Ideal Postcodes, in the United Kingdom, which returns every address at it. The postcode on its own is all they get — nothing about the customer, the job or who was asking.
Card payments, added 29 September 2026, before they are switched on. When a customer pays an invoice by card, the payment is taken by Stripe Payments UK Limited into the business's own Stripe account. Stripe is sent the invoice amount and reference, the business's name and the customer's email address. The customer types their card details into Stripe's own page, so they never pass through us. Stripe takes the payment under the business's own agreement with Stripe, which it accepts when it connects its account. Stripe is also an independent controller for its own purposes: fraud checks, identity and money-laundering checks, choosing the banks and card networks a payment goes through, and improving its own products. Corrected 30 September 2026: this said Stripe was an independent controller for the card details, which is only true for those purposes. It processes in the UK, the EU and the United States, under the EU Standard Contractual Clauses and the UK Addendum. Nobody can pay by card yet.
Load exchanges, added 30 September 2026. A business can connect its own Courier Exchange or SDCN membership. The exchange then works for the business, under the membership and terms it already has, not for us. We hold the login it gives us, encrypted, and use it only when one of its admins asks to see its own loads and the quotes on them. What comes back is shown to that admin and not kept. Nothing is sent to an exchange except that login and the dates asked for. Disconnecting it deletes the login at our end.
Two further services support the app. Neither is sent a customer's name or contact details:
- Expo builds the app and delivers updates to it. When your phone checks whether a newer version exists, Expo sees its IP address and the app version. Expo's terms let it use aggregated, anonymised data to improve its own products.
- Cloudflare hosts our website and the dashboard, and forwards email sent to our contact address, so anything you email us passes through it. It also carries the requests to our map server described above, which hold map coordinates and nothing else.
Mistral AI, in use from 1 October 2026. Mistral AI, in Paris, is on our sub-processor list for three features. The first is importing an existing customer list from a spreadsheet, where the column headings and a sample of up to twenty rows are sent so the layout can be worked out. The second is reading a PDF booking confirmation you upload, where the whole document is sent so the customer and addresses can be picked out for you to check; it is off for your firm until one of your admins turns it on in Settings, and nothing is created from it until you have checked what was found. The third is Ask in the jobs search, where the words an admin types are sent, when they press Ask, so they can be turned into a search; nothing from your records is sent with them, and it too is off until one of your admins turns it on in Settings. What we send is not kept. Mistral has agreed with us that it is not stored or logged for any longer than it takes to produce the answer. It is processed in the EU, and Mistral’s terms with us say it may not train its models on it. It was listed here, and you were told by email, before it was switched on. Nothing else in Guv sends data to an AI or machine learning service.
Anthropic, until 1 October 2026. These two features were set up to use Anthropic Ireland, Limited from 3 September 2026. No customer data was ever sent to it, and it is no longer on our list.
A complete and current list, including what each service handles and where, is published at guvguvguv.com/subprocessors.
We do not share your data with anyone else, except where we are legally required to.
7. How long we keep it
- Job records are kept for as long as the trade business's account is active, because they are that business's working records. The business decides when to delete them.
- Photographs and the signature image from a sign-off are deleted automatically 12 months after the job they belong to is finished (completed or cancelled). This runs on a schedule, whether or not the business asks. The rest of a sign-off record — who signed, when, and whether a photo was taken — is kept with the job, because that is the audit trail a business needs to answer a dispute, and none of it is an image.
- Account details are kept while the account is active.
- Invitations expire automatically after 7 days.
- Customer portal sign-in links expire after an hour, or as soon as they are used.
- A customer's portal sign-in is kept until the customer, through the trade business, asks for it to be removed. Taking away their access stops them signing in straight away.
- A record that somebody asked us to stop emailing them is kept indefinitely, on purpose. Deleting it is how an unsubscribe gets undone by accident. It is the address and the date, and nothing else.
- An issued invoice is kept until six years after the end of the UK tax year it was issued in, and is then deleted automatically. A deletion request does not reach it before then. That is not our choice: HMRC requires VAT records to be kept for six years, and the UK GDPR right to erasure does not apply where the law requires the information to be held (Article 17(3)(b)). It is the invoice as it was sent: the billing name and address, the lines (each with the delivery address, the contact the job was for and the name of whoever signed for it), the figures and the VAT. Added 7 September 2026, when invoicing was built. Everything else about the money goes: an unissued draft invoice is deleted, the link a customer was sent to view an invoice is deleted — which also stops that link working — and what a job was priced or quoted at is deleted with the job. Where a business closes its account entirely, all of it goes including the issued invoices, and it is that business's own responsibility to export its records first.
- The log of job emails sent — address, time and delivery outcome — is deleted automatically after 90 days, and sooner if that customer or the whole company is deleted. Ninety days is what the log is for: catching bounces and spam complaints, which is a question about now rather than a history worth keeping. Added 6 September 2026 — it had no expiry at all until then, which was said here before it was fixed rather than after.
- The position recorded when you tap a stage is kept with the job it belongs to, and is deleted when that job is. It is not held anywhere else and there is no separate log of it. We keep it with the job rather than expiring it sooner because it only means anything next to the stage it corroborates — a question about when a vehicle arrived somewhere is usually asked weeks later, and a stage time whose corroboration has been deleted underneath it is worse than one that never had any. The trade business decides when to delete its job records, and deleting the job deletes this with it.
- A door position saved from a delivery photo is kept with the customer's address, without anyone's name or the time, until the customer is deleted or the office clears it.
- Crash and usage data is retained according to Google Firebase's own retention settings.
- Data waiting to be sent, held on the worker's phone. The app is built to work without a signal, so a photograph or a customer's signature captured on site is stored on that device until it can be uploaded. It is deleted from the device as soon as it reaches our servers. If it repeatedly cannot be sent, it is deliberately kept on the device rather than discarded — a customer's signature is the record that the work was done, and losing it would be worse than holding it — and the app shows the worker that it is still waiting. It is removed if the app is uninstalled.
8. Your rights
Under UK data protection law you have the right to: access a copy of your data; have inaccurate data corrected; have your data deleted; restrict or object to how we use it; and receive your data in a portable format.
One thing the right to deletion does not reach, and we would rather say so here than when you ask. An invoice that has been issued to you is a VAT record and the law requires it to be kept for six years — see section 7 for what that covers and what is deleted alongside it. Nothing else about the money survives a deletion request.
To exercise any of these, contact hello@guvguvguv.com. We will respond within one month.
If you are a customer of a business that uses Guv, please contact that business — see section 2.
You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
9. Security
Access is controlled by server-enforced security rules, so a business's data can only be read by members of that business. Passwords are handled by Google Firebase Authentication and are never visible to us. Data is encrypted in transit and at rest by Google. Changes to user roles and permissions are recorded in an audit log.
No system is completely secure, and we cannot guarantee absolute security.
10. Children
Guv is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
11. Changes to this policy
If we make significant changes we will update the date at the top and, where the change materially affects you, notify you in the app.