Privacy Policy

GoSavis Limited ("GoSavis", "we", "our", or "us") provides a platform that connects people who need local services with the businesses and individuals that supply them. This Privacy Policy explains what personal information we collect when you use our customer site or the GoSavis Business operator surface, why we collect it, who we share it with, and the rights you have over it.

We have written this policy to be plain rather than legalistic. Where a section needs to be precise for legal reasons, we have tried to follow each precise statement with a sentence in ordinary language. If anything here is unclear, please get in touch using the contact details at the bottom of this page and we will do our best to explain.

This policy provides information about our processing; it is not a request for blanket consent. Where we rely on consent for a specific optional activity, we ask separately and you can withdraw it. We notify account holders about material changes where the change affects how their information is used.

The data controller for personal information processed through GoSavis is GoSavis Limited, registered in England and Wales under company number 12899784. Our registered office is 32 Eyre Street, Sheffield, England, S1 4QZ. We are registered with the Information Commissioner's Office under registration reference ZC244835. The individual accountable for data protection at GoSavis is Raymond Mawanda, and if you have any questions about how your information is handled you can reach him at privacy@gosavis.com. For statutory enquiries you may also contact the Information Commissioner's Office (ICO), which is the UK supervisory authority for data protection.

This policy covers the personal information for which GoSavis Limited (England and Wales, company number 12899784) is responsible. A signup made on our Ugandan pages is handled by Gosavis Ltd, our company in Uganda, as the controller; its Data Protection and Privacy Policy, linked beside that form, gives its contact details and explains how it uses the signup.

Information you give us directly: Invitations

When you create a personal invitation link while signed in, we record the originating account, creation time and kind of invitation. The link carries a random code. In this link-sharing flow we do not ask for or keep recipients’ email addresses and do not contact them. Accounts created through a valid link within its original 90-day period are recorded as introduced by that invitation, and joining counts are confirmed after email verification. Customer invitations show counts, not customers’ names, contact details or bookings.

The referral-credit programme is separate. A referred business receives the programme information and actively chooses participation before any programme place or named programme disclosure. Only then may its referrer see its business name and limited progress and aggregate credit balances. Those balances can permit estimates of GoSavis fees and inferences about activity, especially for a single business referral; they are not anonymous. Individual customer or booking records are not shared.

GoSavis-sent invitation emails remain paused. Any previously justified suppression record remains separate and is not revived into a new promotional address list by this programme. The existing ordinary invitation retention rules continue, subject to separately necessary minimum entitlement records.

GoSavis Credits records: collection

We record the identified legal credit owner and original earning account, referred-business and allocation identifiers, onboarding and final-approval times, programme participation choice and withdrawal, applicable terms, eligibility changes, earning periods, and amounts and dates of awards, releases, reservations, spends, refunds, corrections, expiry and surrender. We record effective relationship changes separately from when they are entered or reported.

Internally, necessary booking, payment, fee and refund references support reward calculation and settlement. Referrers do not receive those underlying records or a per-business reward calculation. We also record proportionate eligibility indicators, review evidence, decisions, reasons, notices, responses and appeals, with access restricted to authorised GoSavis reviewers and finance roles.

Account-access, credit entitlement, optional programme participation and personal-data rights are separate records. A ledger record is not automatically anonymous merely because a name or one link has been removed.

Information you give us directly

The information we collect depends on the features you use. It can include:

• Account details: Your name, the email address you sign in with, a phone number if you have provided one, and any password you set. Passwords are never stored in readable form

• Profile details: Your username, display photo, biography, contact and location visibility choices, service area, portfolio, favourites and other preferences

• Booking and service data: Listings, availability, booking times, service locations (for a courier, removal or other delivery, the address the goods are collected from, the address they are delivered to and, where you give them, the name and phone number of the person receiving them, which may be another person’s details), prices, cancellation conditions, notes, intake answers and booking history. Where a delivery is priced by its distance, we send the collection and delivery addresses only, without any name or phone number, to postcodes.io and OpenStreetMap’s Nominatim to find where they are, and estimate the distance between them

• Payment and payout records: Payment status, amount, currency, card brand and last four digits where returned by Stripe, tokenised payment-method and customer references, tips, fees, refunds, disputes and operator payout status. Stripe receives the raw card or bank details used in its payment components; GoSavis does not store raw card numbers

• Business billing records: Where a business adds a card or a Bacs Direct Debit in Billing for GoSavis to collect what it owes us under the Operator Agreement: for a Direct Debit, the last four digits of the bank account, the mandate reference and whether the mandate is pending, active or ended, and for a card, its brand, last four digits and expiry. We also keep a record of the authorisation given with the payment method: the text agreed to, the version of the Operator Agreement in force, the account user who gave it, when, the IP address and user agent it was given from, and when and why it ended. With these we keep the business’s statements, the collections made from its payment method and the emails we send about them. Stripe collects the card or bank details on its own form or page, and GoSavis never receives a card number, bank account number or sort code

• Ending an Operator Agreement: Where a business ends its Operator Agreement after rejecting a proposed change, in Settings or by email, the record of its instruction: when we received it, how it was given, the account user who gave it and the role they gave it under, or for an emailed instruction the email address it was sent from, its reference and the member of our team who recorded it, the versions of the agreement the business held and was offered, and what was still open at that moment. The address we record for an emailed instruction is the sender’s email address, not an IP address

• Accepting an agreement: When you accept our Terms of Use, or accept the Operator Agreement and the Data Processing Addendum for a business, the record of the acceptance: the documents and versions accepted, the exact statement you were shown, the business you accepted for and the name it was recorded under, the account user who accepted, when, the date from which the acceptance applies, and the IP address and user agent it was given from

• Notices of changes to our terms and policies: When we tell you about a change to our Terms of Use, this policy, the Operator Agreement, the Data Processing Addendum or the Cancellation and Refund Policy, a record of the notice: what it said, the address it was sent to, when it was sent, the reference our email provider gave the email and whether it was delivered, including any report from the provider that it bounced or was marked as unwanted and the reason given. With it we keep whether you saw the notice in the app and whether you accepted the change, and when

• Communications: Messages, comments, reviews, posts, reports, complaints, appeals, support enquiries, feedback and any media you upload. With these we keep whether a message request is waiting, accepted or declined, which covered photos you chose to view, whether you chose to receive updates about a report you made, and the moderation decisions about your content

• Invitations: when you create a personal invitation link while signed in, we record your account, when the link was created and the kind of invitation. The link carries a random code. We do not ask for or keep the address of anyone you share it with, and we do not contact them. Every new account created through your link within 90 days is recorded as having joined through your invitation. You may see how many invitation requests we accepted and how many people joined through your links, but not their names, addresses or what they book. Joining counts are confirmed once the new account’s email address is verified. We have paused the invitations we sent by email at a person’s request; for each address already invited, we keep only a one-way scrambled form so that it is never invited again

• Signing up for updates: when you sign up to hear from GoSavis, your email address and the other details the form asks for: your name and town or city and, for a business, its name, industry and type, a description and, if you choose to give one, a phone number. You can sign up for our newsletter, which we send from time to time until you unsubscribe, or for a one-off notice, such as when GoSavis opens or a service becomes available near you. We use these details only to send what you asked for, and never add you to other campaigns or to another GoSavis company’s list. We record the market whose pages you signed up on

• Business and verification details: We collect trading and legal names, registration and tax identifiers, business addresses, required licences and insurance, ownership or representative details, credential-review decisions and necessary payment-account status. Our payment provider carries out the identity and bank checks for the payment account; GoSavis does not collect a duplicate personal-identity application solely for payout verification.
  
  GoSavis reviewers assess the business registration evidence and the trade credentials required for the services a business offers. We record relevant validity and renewal dates, the reviewer, decision and reasons. Private documents are available only through restricted, time-limited access, with access auditing.
  
  Any right-to-work or right-to-trade checks are a separate purpose. Where applicable, we use the information needed for the appropriate prescribed check, including a right-to-work share code and date of birth for an eligible online check, and retain the necessary result and verification evidence. Payment-provider identity checks and a self-employment declaration do not substitute for that assessment. We explain the applicable process before collecting additional evidence.
  
  We retain credential and working-permission evidence only for the purpose and period applicable to that record. The removal of duplicate payout-identity collection does not remove separately applicable legal checks or justify retaining unrelated identity material.

• Optional special requests: Information you choose to put in booking notes or operator intake answers. This may reveal health, disability, religious or other sensitive information. Share only what the business genuinely needs to provide the service, and do not include another person's sensitive information without authority

• Sign-in security: If you add a passkey, we keep the public key and credential identifier, the authenticator or provider information it reports, any reported synchronisation status, its displayed name, and when it was added and last used. Your authenticator checks the local verification method, such as a fingerprint, face or device PIN; our passkey integration does not receive that fingerprint, face or PIN. Your provider may synchronise or recover a passkey under its own arrangements, which GoSavis does not operate.
  
  For an authenticator app, we keep its setup secret encrypted while the factor is active. Recovery codes are kept only in a form that cannot be read back. Removing a passkey at GoSavis prevents that credential being used with GoSavis, including its synchronised copies; it does not remove a copy stored in your password manager.

• Account recovery: When you request a two-factor reset, we record the request, the limited IP and browser information needed to investigate its security, the confirmations and checks performed, reviewer decisions and reasons, and the request’s status and relevant times. We use the current account email for the initial confirmation. If the email changed within the previous 14 days, an additional single-use confirmation is sent to a previously verified address identified from our own trusted change history, not an address supplied for the reset. That additional link is not sent to the current address. Multiple or uncertain recent changes require a trusted-history review rather than automatically trusting the last address entered.
  
  For a business that receives payouts or pays by Direct Debit, and people who manage its billing, ownership or team, authorised GoSavis reviewers perform the required independent checks and an outbound callback. We keep the onboarding phone number for that recovery purpose, separately from an ordinary editable profile number, and protect access to it. A replacement trusted recovery contact requires a separate verified process; a recent ordinary profile edit cannot establish it. Control of a phone number alone does not prove authority. Reviewer evidence records the necessary result and rationale, not unnecessary copies of identity information.

Information we collect automatically

We collect IP address, browser and device type, user agent, session and device identifiers, authentication and security events, approximate route information, timestamps, crash details and actions needed to prevent fraud or investigate a failure. If you ask to use your location, the browser supplies coordinates which we use to find nearby services and translate the coordinates into a place. Location preferences may remain on the device until you clear or change them.

Voice search: when you search by voice, your browser sends what you say to its own speech recognition service (Google's in Chrome, Apple's in Safari), which turns it into text under that company's own terms. GoSavis receives only the text, uses it to run your search as it would a typed one, and never receives or keeps the recording.

Counting views of a business profile

When you open a business’s profile or its link page, we count the visit so that the business can see how often its pages are seen and where its visitors come from. To count each visitor only once a day, we combine your IP address and browser type with a key that changes every day and is deleted within the hour after the day ends, and keep only the code that results, so your address cannot be recovered from it and your visits cannot be linked from one day to the next. A day is the business’s own, in its time zone. On a link page we also count which button or link is tapped, and we note what kind of place the visit came from (a scan of the business’s code, a social network, a search engine, the business’s own listing on a map or search service, the signature of an email the business sent, another website, GoSavis itself or a direct visit, with the name of any campaign the business put in its own link), keeping only that kind and never the address you came from. No cookie is used. We do not count the business itself or its team, automated visitors such as search engine crawlers and link previews, or a browser sending the Global Privacy Control signal. We rely on legitimate interests for this: giving businesses an accurate figure for how often their pages are seen and how their visitors use them. Each day’s codes are deleted after 8 days; the daily totals that remain, which say nothing about any one visitor, are deleted after 90 days.

Measuring our advertising to businesses

We advertise GoSavis to businesses on TikTok. If you allow Marketing in your cookie choices, the TikTok Pixel runs on our pages for businesses, the GoSavis Business information pages and the business sign-up form, and nowhere else. It records your visit to those pages and which sign-up buttons you choose and, when you create a business account, tells TikTok so. When you create a business account, and again when you submit your business for review, our server also tells TikTok, sending a scrambled (hashed) copy of your email address and of your GoSavis account identifier, the identifiers TikTok gave your browser and the advert you clicked, your IP address, your browser type and the address of the page. We send nothing else: not your name, your business’s details, bookings, payments or messages. We do this only for sign-ups in the United Kingdom, and we keep no copy of what we send.

Information from operators about their team

A business is the controller for workforce, rota, private customer-management and internal operational information it chooses to place in its private workspace. GoSavis acts as its processor only to the extent we host and handle that information on the business's documented instructions. The Data Processing Addendum governs that limited processor activity. GoSavis and the business otherwise act as independent controllers for their own purposes. In particular, GoSavis is a controller for platform accounts, marketplace discovery, booking orchestration, platform payments and fees, messages and reviews, security, fraud prevention, moderation, support, legal evidence and service administration. A business is a controller for providing its service, managing its workers, keeping its own records and communicating with its customers outside the platform. Team members and customers may contact either party; we will route a request to the party responsible for the relevant processing.

If you use the preview

The preview signs you into a sample account without creating one of your own, so we collect no name, email, or profile information from you. It uses a session cookie to keep you in the sample world while you look around, together with the same technical information described above; the session ends when you leave the preview or close your browser, and anything you did inside it stays in the sample world.

When you connect a calendar by link, GoSavis reads it to identify busy time. We keep the connection details, each busy interval, whether it lasts all day, a one-way occurrence identifier and the event title. Calendar links and imported titles are encrypted at rest. Only the person whose calendar is connected and people permitted to manage that business’s team can see its titles; other team members see only that the time is unavailable. We never keep imported descriptions, locations or attendees.

Titles are kept only with their busy intervals and are removed when those intervals are pruned, when the connection is deleted, when the member is removed from the business or when their account is erased. Your own subject access export includes your imported titles and manual blocked time notes. We use these records to provide the calendar connection you request: performance of our contract where you are a sole trader, and our legitimate interests in providing reliable availability and preventing double booking where you act for a company or another organisation. For private workforce information processed on a business’s instructions, the business determines its lawful basis and GoSavis processes it under the Data Processing Addendum.

A GoSavis diary link publishes service names, booking references, times and booking links, never customer names, to anyone holding the link until it is reset or revoked. The business or person creating the link chooses who receives it. We provide this requested sharing as part of our contract with a sole trader, or on our legitimate interests in providing the requested diary service where the user acts for another organisation. Private business diary information is processed on the business’s instructions under the Data Processing Addendum; the business is responsible for its lawful basis for sharing it.

Our hosting providers may record calendar link URLs in access logs. These URLs contain a private feed token. Access and retention are controlled under our security and retention arrangements. Resetting the link stops the old token working. We rely on our legitimate interests in securing and operating the service for these access records.

Lawful bases for referral credits

Where necessary to administer an individual’s or sole trader’s participation, entitlement and spending, we process the relevant information to perform our agreement with that person. Limited personal information about someone acting for a company or organisation is used in our legitimate interests in administering the organisation’s agreement and verifying authority. Financial records are retained to meet the specific statutory financial-record duties that apply.

We rely on our assessed legitimate interests in administering genuine referrals and preventing misuse for the limited programme-stage disclosure and proportionate eligibility review. Before named disclosure, the referred business makes an optional, informed commercial participation choice; it can join GoSavis without the programme and can withdraw prospectively. That choice is not blanket consent to unrelated data use. We explain the potential financial inference and provide an objection and review route.

These purposes are limited by the information, access and retention safeguards in this policy. Any further use of existing booking information is assessed for compatibility and lawfulness before it begins.

Under UK and EU data protection law we must rely on a specific lawful basis to process personal information. We rely on the following bases, depending on what we are doing with your data:

• Performance of a contract: To create and secure your account, display the profile or listing you requested, operate bookings, provide messaging, process a payment or payout, deliver support connected with the service, remind a business that has started setting up on GoSavis what is left to finish and tell it when it is open for bookings, and, where you are a customer or a sole trader, tell you about changes to your agreement with us and keep the record of what you accepted or ended

• Legitimate interests: To prevent fraud, recognise devices, secure the platform, diagnose failures, moderate content, investigate complaints, enforce our terms, keep the record of who acted for a company or other organisation in accepting or ending its agreement, keep limited information about notices that could not be delivered, send an invitation you ask us to send, recognise and thank the person whose invitation brought a new account to GoSavis, check that invitations are genuine, help a business that has started setting up on GoSavis to finish, and improve service performance. We assess whether those interests are overridden by your rights

• Consent: For our newsletter and any notice you sign up for, for optional external media and analytics technologies, and for measuring our advertising to businesses with marketing technologies. You can withdraw your consent at any time, including before we send you anything, by using the unsubscribe link in any email, by changing your cookie choices or by writing to privacy@gosavis.com. Withdrawing does not affect processing that was lawful before you withdrew

• Legal obligation: Only where a specific law requires the processing: to keep the accounting records the Companies Act 2006 requires and the records HMRC requires for tax, to answer an order or a lawful request from a court, the police or a regulator that we are required to answer, and to report child sexual exploitation and abuse content to the National Crime Agency where the Online Safety Act 2023 requires it. A promise we make in our terms is not, by itself, a legal obligation

• Vital interests: In a genuine emergency, where processing is necessary to protect somebody's life or physical safety

GoSavis does not ask customers to place medical records or other special-category information in ordinary booking notes. If a business genuinely needs sensitive information to provide a service, that business is responsible for identifying an Article 9 condition, giving an appropriate notice and collecting no more than necessary. GoSavis processes operator-configured intake answers to deliver the booking and restricts access to the relevant parties.

When a business pays us what it owes under the Operator Agreement, by card or by Bacs Direct Debit, we rely on performance of that agreement to take and manage its payment method and to collect from it, on legal obligation to keep its statements and collections as accounting records, and on legitimate interests to keep the record of its authorisation as evidence that the business agreed to be charged.

When you accept or end an agreement, we record the relevant agreement version, the instruction and its date, and the identifying and contact information needed to establish who acted. We also record whether contractual notices were successfully delivered and limited information about delivery failures. We use these records to administer agreements, manage communications and resolve disputes. Our retention schedule, under How long we keep your information, explains how long the different records are kept.

Our lawful basis for those records depends on who you are. Where you are a customer, or a sole trader administering your own business’s agreement, sending you notices and keeping the records of what you were told, accepted or ended is necessary for the performance of your contract with us. Where you act for a company or another organisation, the contract is the organisation’s, not yours, so we keep your contact details and the record of your authority and of what you accepted or ended for it on our legitimate interests in being able to show who acted for the organisation and on what authority; we have assessed that this is necessary for that purpose and that your interests do not override it, because the records are limited to what establishes who acted and are kept only for the period our retention schedule sets. We keep the limited information about a notice that could not be delivered, and any record that stops us writing again to an address that does not work, on our legitimate interests in reaching each account and in showing that it was told. We do not rely on a legal obligation for these records, because no law requires us to keep them.

How we use information: programme administration

We use attribution and participation records to allocate up to 1,000 valid Great Britain referral places, administer the opportunity from final approval, and honour the published eligibility, withdrawal and transition rules. Rewards are 10% of the recorded eligible net-fee basis for a qualifying completed wholly card-paid booking. That basis is calculated from GoSavis commission and the customer booking fee, taking account of fee refunds, reversals, paid contributions to the business’s card costs and processing costs borne by GoSavis. The business’s own processing costs do not reduce that basis. Each booking’s reward is rounded down to whole pence. Pending credits become available at release of the booking money. Earning and spending start together when the programme opens. We use the ledger to reserve and spend credits, fund the Business’s agreed entitlement on the actual-cost basis, restore genuine refunds and make justified correcting entries. A refund restoration is not applied against a negative rewards adjustment. Deactivation does not automatically end an allocated earning opportunity; minimum records support original-account reactivation and legitimate redemption. Erasure and voluntary surrender are processed separately.

For eligibility and abuse prevention we compare reliable legal-entity identifiers to identify duplicate claims and may compare necessary existing phone, address, payout-account or suitable payment-provider identifiers between a referrer and business. Shared details are indicators for review, not automatic findings. We do not routinely collect raw card data or identity-document copies solely for this programme. Patterns such as concentrated referrals or bookings can prompt a reasoned human investigation. Any hold is targeted; permanent reversal has reasons, an opportunity to respond and human appeal. Cleared outcomes are corrected and unrelated legitimate credits protected.

Authorised members of the GoSavis team reconcile financial movements and make review decisions within restricted, audited roles. Participants receive the limited programme view and neutral service notices, not another person’s review evidence, customer records or booking details. Existing invitation-recognition checks are not hidden extra reward conditions and this programme does not restart promotional invitation emails or authorise unrelated historical fee analysis.

We use personal information for the following purposes:

• Registering, authenticating and supporting accounts, including email verification, social sign-in, multi-factor authentication using eligible passkeys, authenticator apps and recovery codes, trusted-device controls, and the verified account-recovery process described here. Limited recovery evidence is also used to secure the service, investigate misuse and address disputes. The applicable lawful bases are explained in the policy’s purpose-and-basis information.

• Publishing profiles, listings, posts, reviews and other content according to the visibility choices you make

• Creating, administering, cancelling and evidencing bookings and the provider conditions that apply to them

• Processing online payments, refunds, disputes, platform fees and operator payouts, or recording an agreed pay-on-arrival method

• Collecting what a business owes us under the Operator Agreement, from its later card payments and from the card or Bacs Direct Debit it adds, and sending it statements

• Delivering messages and notifications between customers, businesses and their teams

• Reminding a business that has started setting up on GoSavis what is left to finish, at most three times and only while its onboarding reminders are turned on, telling it once when it is open for bookings, and letting a member of the GoSavis team contact it to help it finish

• Verifying businesses, protecting users, preventing fraud, moderating content and investigating reports or complaints

• Answering support requests, handling data rights and maintaining legal, consent and audit records

• Telling account holders about proposed changes to our terms and policies, recording what each was told and accepted and whether the notice was delivered, and recording how a business ended its Operator Agreement

• Measuring and improving the service where the relevant technology is permitted

• With your consent, measuring whether our advertising on TikTok leads businesses to join GoSavis

A card tip for a named team member is paid to the business’s own Stripe account and recorded as that member’s tip. The business passes it on in full. GoSavis takes no share, does not receive the tip and does not transfer it to the member. We keep the booking, payer, member, amount, currency, payment state and the date the business records that it passed the tip on, to administer the tip and its refund and to show the member what the business owes them. The member does not need a Stripe account for this route.

We count bookings cancelled by the business from the cancellation records we already hold, so that the business can review its cancellations and authorised members of the GoSavis team can administer the service. These counts are shown to people permitted to manage that business’s bookings in its own dashboards and to the GoSavis team in the administration console, not publicly. They do not include customer cancellations or no-shows and do not create a separate record of a booking.

While money for a booking is still held for release and no booking dispute is open, a request becomes due one hour after the service ends, asking the customer who made the booking whether the service was received or whether there was a problem, and asking the business to mark it as completed if it was provided. For the business, the request goes to the assigned team members who can receive booking messages, or otherwise to its usual booking contacts. It appears in the app and may be emailed according to notification choices. We use the booking, its timing, the held-payment state, contact details and the recorded answers to administer completion, handle issues and decide when payment can be released. We do not send a request to a side that has already answered, or repeat a request already sent. We close these requests if the booking is cancelled, is recorded as not attended or has an open dispute, or if no booking money remains held. These are service messages, not marketing.

We use ordinary invitation records to recognise introductions to GoSavis. Ordinary invitation counts and a business’s referral-link commission relief are separate from the optional Great Britain GoSavis Credits programme described here. That programme operates only when it opens and its participation conditions are met.

The GoSavis team may also calculate the net platform fees from the joined account’s bookings made during its first 12 months, to help us prepare a future reward programme. This calculation is paused while we complete our review of it, and we will update this policy before it resumes.

To make sure invitations are genuine, the GoSavis team reviews each account that joined through an invitation link: how many bookings it made or took during its first 12 months, and whether they were completed, paid, refunded or disputed; whether its saved card details, devices or sign-in network match those of the person who invited it or of others that person invited; whether many accounts joined through the same person in a short time; and whether its email address comes from a disposable email service. An account counts towards this ordinary invitation measure only once it has completed a booking whose GoSavis fee has been paid, through a card or mobile money payment on GoSavis or, for a booking paid in person, by the business settling what it owes us, that was not refunded or lost in a dispute, and that was with someone other than the person who invited it or others that person invited; a business must also be verified. The review flags an invitation for a member of the GoSavis team to look at; it never blocks an account or a booking by itself. Nobody who shares an invitation link sees any of this.

Search ordering, recommendations, fraud signals and moderation queues may use rules or scoring to prioritise information for review. GoSavis does not currently make a solely automated decision that produces a legal or similarly significant effect on you. Where a human moderator restricts content or an account, the applicable terms explain the notice, appeal and complaint routes. Recommendations and search leave out content under an open report until the report is decided, using the reports we already hold and no analysis of the content itself.

The proposed Cloudflare photo-checking feature is not currently enabled. Before introducing it, we will explain the processing in our Terms and Privacy Policy and complete the applicable notice and compliance steps. Our existing content-reporting and moderation arrangements continue.

We do not sell personal information. We do not give suppliers permission to use GoSavis account, booking or payment information for their own advertising. The one exception is the limited sign-up information described under "Measuring our advertising to businesses", which TikTok receives only if you allow Marketing and may also use under its own terms. Third-party services you deliberately open may process information under their own privacy terms, as explained below and in the Cookie Policy.

With your business referrer: sharing

After your business has actively chosen the Great Britain credits programme, we may show its referrer your business name and limited progress through eligible onboarding, final approval/trading and the end of participation. There is no named programme-stage disclosure before that choice. We do not reveal a refusal reason, an investigation allegation, your customers, individual bookings or booking payments.

The referrer sees aggregate pending and available credits across its referrals, not a separate earning figure for each business. The aggregate can nevertheless permit estimates of GoSavis fees and inferences about your activity, especially where yours is the only referral. We explain this before participation. After withdrawal, new progress disclosures stop and only necessary information about earlier legitimate credits continues; your withdrawal reasons are not shared.

Existing approved service suppliers receive only the records needed for the relevant hosting, communication or payment task under the applicable arrangements. This programme does not give advertising providers access to credit or eligibility-review records. Contact privacy@gosavis.com to exercise privacy rights or raise a concern about disclosure.

We share your personal information only when there is a clear reason to do so. The main categories are described below; outside these we do not share your data with third parties.

With other users to fulfil a booking

When a customer books a service, the relevant booking information (the customer's display name, the service requested, the time, and any notes the customer has chosen to share) is sent to the business that will fulfil it. Conversely, when a business confirms or updates a booking, the relevant information is shared back with the customer.

A signed-in member booking for another member can search by part of that member’s public display name or username. The lookup does not match separately held legal-name, first-name or last-name fields. Results show only the profile picture, public display name and username. Selecting a member links the Booking to that member’s account.

The lookup follows Show in public search (Settings, Privacy, Search and discovery). When it is off, your profile is not included in lookup suggestions or other GoSavis search results. Your public profile remains reachable by someone using your exact username; turning search off does not make that page private.

With our service providers

The suppliers used for a journey depend on the feature and environment. Our principal categories and providers are:

• Infrastructure and security: Cloudflare for web delivery, security challenges and object storage; Render for application hosting; Neon for the application database; and Azure Key Vault for managed secrets

• Payments and business onboarding: Stripe and Stripe Connect for card processing, payment-method references, refunds, disputes, identity or business verification and payouts, and for collecting what a business owes us by card or Bacs Direct Debit. Stripe collects each Direct Debit on our behalf and sends the Direct Debit emails, which confirm the instruction and give notice before each collection, in its own name

• Email and notifications: Amazon Web Services, including Amazon SES, for transactional email, and for its reports of an email that bounced or was marked as unwanted

• Error monitoring: Sentry, provided by Functional Software, Inc. and hosted in the European Union (Frankfurt, Germany), for the redacted error reports our API server sends when a request fails

• Identity: Google or Apple when you deliberately choose the corresponding sign-in option

• Maps and location: Mapbox, OpenStreetMap tile services and Nominatim when a map or location lookup is requested; and postcodes.io and OpenStreetMap’s Nominatim to find where an address is, when a business saves its own address or the place of an event or a car park, and when a delivery is priced by its distance, for its collection and delivery addresses. They receive the address only: postcodes.io receives the postcode and Nominatim the address, and neither receives a name or a phone number

• Optional measurement and media: Google Analytics where configured and permitted, TikTok when you allow Marketing on our pages for businesses, and YouTube, Vimeo or TikTok when you allow and load external media

GoSavis also operates an in-house crash-reporting endpoint. It receives a limited error message, bounded stack information, application route and technical context needed to diagnose a failure. It is designed not to collect form contents, booking notes, raw payment data or authentication secrets.

GoSavis sends limited, redacted reports of failures on its API server to Sentry, an error-monitoring service provided by Functional Software, Inc. and hosted in the European Union, in Frankfurt, Germany, so that we can detect and fix faults. A report includes the type of error and its message, the lines of our code it came from, the route and method of the request that failed, the response status, the request identifier, the software release and environment, and the technical headers of the request, which include your browser type. Before a report leaves our server, the signed-in account, the contents of the request, cookies and sign-in headers, the records of recent server activity and the values held in our code at the moment of the failure are removed from it, the address of the request is reduced to its route, and email addresses, sign-in tokens and card-length numbers are redacted from the error text. Reports are not sent with your IP address. We rely on legitimate interests for this: keeping the service working by finding and fixing faults. Errors that happen in your browser are reported only to our own crash-reporting endpoint, not to Sentry.

With TikTok, if you allow Marketing

TikTok Information Technologies UK Limited receives the information described under "Measuring our advertising to businesses". GoSavis and TikTok are jointly responsible for collecting it on our pages and sending it to TikTok. TikTok then decides how it uses it: to tell us which adverts led to sign-ups and, under its own terms, to deliver and improve its advertising, as its own privacy policy explains. You can withdraw your consent at any time in your cookie choices, and nothing more is sent from then on.

For legal and safety reasons

We may disclose information when we are required to by law, when we receive a valid legal request from a court or regulator, or when disclosure is reasonably necessary to protect the safety of our users, our staff, or the public. Where we can lawfully tell you about such a disclosure, we will.

Some providers operate internationally or permit authorised support access from outside the United Kingdom. We first use a UK adequacy regulation where one applies. Otherwise we use the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful transfer mechanism, together with a transfer-risk assessment and proportionate technical measures. The error reports our API server sends to Sentry are stored in Germany, where a UK adequacy regulation applies. TikTok may process the information it receives about our advertising outside the United Kingdom, under the safeguards its own privacy policy describes. You can ask

• Safeguard enquiries: Email privacy@gosavis.com for more information about the safeguard used for a particular provider and how to obtain a copy, subject to necessary redactions.

Retention: referral credits and programme reviews

Credit expiry is a spending limit, not a blanket data-retention period. We keep minimum original-account, owner, business, participation, terms, earning-window, balance and expiry records while an earning opportunity, pending or unexpired credit or related unresolved dispute remains. This can include a deactivated account, but not its whole profile merely to preserve credits.

Credit financial movements and essential supporting evidence are kept in a restricted archive for 6 years from the end of the last company financial year to which the record relates, or longer where a specific legal requirement or unresolved claim justifies it. We do not restart every record’s period merely because an unrelated account event occurs. Ending these programme records and identifying links does not erase separate booking and payment receipts kept under their own purposes and retention rules.

Unnecessary routine eligibility-check documents and detailed matching information are removed within 90 days after the final outcome and any appeal completes. A cleared final outcome stops blocking legitimate credits immediately. We retain only a necessary minimal outcome and time while an active condition or entitlement needs them, so an identical indicator does not recreate a cleared concern; that record is removed when its purpose ends. Open or appealed concerns do not become final merely with age. Minimum duplicate-allocation identifiers remain while admissions or relevant appeals are open; unnecessary identifiers are then removed within 90 days unless independently needed for an active entitlement or justified financial record.

For a deactivated account, unnecessary credit-related operational identifying links are removed within 90 days after the final entitlement and related dispute end, apart from specifically justified archive information. A separately active account remains subject to its own legitimate purposes. These are maximum cleanup limits; information is removed sooner where no longer necessary.

A longer hold identifies the information, reason, authoriser and next review date and is reviewed at least every 90 days. Passing a review date does not silently remove the protection: an overdue hold is brought back for human review. We assess erasure requests individually, explain necessary retention and inspect remaining identifying links. A financial ledger or pseudonym is not a blanket exemption from your rights.

We apply the following retention criteria and operational periods:

• Accounts and profiles: For the life of the account. A closure request disables access and ordinarily enters a 30-day deletion grace period, after which profile data is deleted or anonymised unless a legal, safety or dispute hold applies

• Short-lived authentication data: Email-verification and password-reset records normally expire after 7 days, and one-time sign-in codes after 10 minutes. Stale unverified accounts and routine authentication-event records are normally removed after 90 days

• Sign-in factors and remembered devices: Passkey and authenticator records remain while enrolled. Removing a factor or completing a reset immediately revokes its ability to authenticate; completion also revokes the old recovery codes, existing sessions and remembered-device trust. A previously trusted device is not trusted again simply because an old identifier remains on it. Usable revoked factor secrets and recovery material are not preserved as working credentials for the audit period.
  
  Minimal factor-event metadata may remain for the justified 90-day security audit period after removal, separately from usable authentication material. Revocation prevents use immediately; later deletion removes the remaining justified record. Unfinished authenticator setup continues to expire after 24 hours under the existing rule. These changes do not extend other sign-in, verification or password-reset records beyond their separately stated lifetimes.

• Invitation records: We keep accepted invitation request records for 12 months from the request and credited joining records for 24 months from verified joining, or erase them sooner if the account they relate to is deleted. An unverified account’s pending invitation link is kept for up to 24 months from account creation. Deleting either linked account removes the credited joining record. The scrambled value used to prevent another invitation is kept separately under our invitation suppression rules. Financial records keep their own stated retention period; removing invitation credit does not remove a payment record

• Newsletter subscriptions: Kept until you unsubscribe, and deleted as soon as you do. If we stop sending the newsletter, we delete the list within 30 days. A newsletter subscription made before 12 October 2026 keeps the rule that applied when it was made, unless you subscribe again: it is deleted 30 days after we send the first newsletter or after you open an account, whichever comes first, and 365 days after you subscribed if we never send one

• Signups for a one-off notice: Deleted 30 days after we send the notice you asked for or after you open an account, whichever comes first, and 365 days after you signed up if we never send it. A confirmation or administrative message does not count as the notice. If you ask us to stop, we delete your signup at once

• Advertising measurement: We keep no copy of what we send to TikTok. TikTok keeps what it receives for the periods its own privacy policy sets, and the cookies it sets in your browser last for up to 90 days

• Error reports: The record of a failure our server keeps is removed 90 days after the failure was last seen. A redacted report our API server sends to Sentry is kept for 30 days and deleted at the end of that period.

• Bookings, payments and legal evidence: For the period needed to perform the booking, resolve refunds or disputes, prevent fraud and meet tax, accounting, consumer and legal-claims requirements. Some transaction records may normally be retained for up to 6 years

• Business payment methods and authorisations: The record of the authorisation a business gave with its card or Direct Debit is kept while the payment method is in use and for six years from the end of the accounting year in which it ended. When the business’s account is deleted, we first collect what it still owes and cancel its Direct Debit with Stripe, and the IP address and user agent are then removed from the record, which is kept for the rest of that period. Its statements and collections are kept as transaction records

• Operator Agreement acceptances: When a business accepts the Operator Agreement, we record the version accepted, when, and the name of the person who accepted it on the business’s behalf. The record is the evidence of the agreement and is kept for six years after the business relationship ends. When the business’s account is deleted, the IP address and user agent are removed from the record and the rest, including that name, is kept for the rest of that period

• Notices of changes and agreement endings: The record of each notice of a change to our terms and policies, with whether it was delivered, is kept for the life of the account. When the account is deleted, a minimal proof of each notice, naming the document, the versions compared, when the notice was sent or found undeliverable and any decision our team recorded about it, is kept with the evidence of the agreement for six years and then deleted, and the address it was sent to, what it said and our email provider’s reference for it are deleted at once. The detailed report of an email that bounced or was refused, a notice of a change or an email about a booking, with the diagnostic our email provider gave, is removed 90 days after the failure, and only the fact that the email could not be delivered, and when, is kept. A record that stops us writing again to an address that does not work is kept only while it is needed: it is cleared when the email address on the account changes, so the notice is sent again to the new address, and our team reviews it in the list of notices that could not be delivered. The record of a business ending its Operator Agreement is kept as the evidence of how the agreement ended. Who gave the instruction, who recorded it, the email address an emailed instruction came from and its reference are kept for six years from the ending and then removed, and the rest of the record, including when and how the agreement ended, is kept; if the business’s account is deleted sooner, the address an emailed instruction came from is removed then. Our security audit log, which cannot be altered, also records the ending with the identifier of the account that gave the instruction

• Messages, content, reports and support: While the account or content is active and afterwards only for as long as reasonably needed to provide support, investigate a report, protect users, establish legal claims or comply with law. A moderation decision and any appeal against it are kept for three years from the decision, and a photo removed from a conversation after a report is kept privately as evidence for one year

• Verification records: For as long as required to complete verification, maintain trust and payout controls, investigate fraud or meet an applicable legal obligation. Raw documents are restricted and should be removed earlier than the resulting verification record where possible

A deletion request does not erase information another user needs as part of their own booking record or content which must be retained for safety or legal reasons. In those cases we remove or replace account identifiers where possible. Backups age out through their normal cycle and are not restored for ordinary use after deletion.

If the GoSavis service closes, we will tell the people whose personal information we hold, stop processing it and delete it within 90 days. The one exception is financial records that the law requires us to keep for six years: we keep those for that period and then delete them.

Recovery requests

The additional old-address confirmation link is single-use and valid for 72 hours from issue, subject to the request remaining valid. Every request deadline is measured from receipt of that request and is not restarted by sending another message or link. A request expires 14 days after receipt unless every required step is complete and the request has been approved within that period. The full 72-hour security wait begins only after the last required confirmation, independent review and callback has been completed. An approved request that has not completed expires 21 days after receipt. We do not shorten the wait to meet a deadline or revive an expired request with a new link.

Used or expired confirmation tokens are invalidated and their usable link material destroyed. The minimal closed-request record and its linked review audit are deleted 90 days after completion, cancellation, refusal or expiry. IP and browser details form part of that record only where justified for its security purpose. A specific legal requirement or unresolved claim may justify retaining limited identified information under a documented exception; it does not keep all request data indefinitely.

Your rights: programme records

You may ask for your credit record, correction of inaccurate attribution or a review finding, and an explanation and human review of a decision affecting your credits. Requests are handled through the existing privacy-rights and complaints routes and applicable time limits. Access does not entitle you to another person’s confidential bookings or evidence.

You may object to processing based on legitimate interests. We assess and explain the outcome under the applicable rules; commercial programme withdrawal is a separate, prospective choice. A request for erasure is not treated as surrender of credits. We distinguish necessary retained records from information that can be removed, and do not refuse simply because a record forms part of a ledger. Correcting financial movements does not prevent rectifying inaccurate personal data.

Any system making a solely automated decision with a legally or similarly significant effect must provide the applicable information, representation, intervention and challenge protections. Human review must have authority to change the outcome, not merely repeat an automated flag.

Depending on the processing and the law that applies, you may have the right to be informed, obtain access, correct inaccurate information, request erasure, restrict processing, object to processing based on legitimate interests, obtain portable information you supplied under consent or contract, and withdraw consent. You have an absolute right to object to direct marketing. These rights have legal limits, for example where we must keep a transaction record or another person's rights are affected.

Account settings provide some correction, visibility and closure controls. For access, restriction, objection, portability or anything unavailable in the product, email privacy@gosavis.com. We may ask for proportionate identity evidence. We normally respond within one calendar month and do not charge a fee unless a request is manifestly unfounded or excessive and the law permits it.

You have the right to complain to us, as the controller, about how we use your personal information. Write to privacy@gosavis.com or use our contact page; we acknowledge a complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/, or to the supervisory authority where you live or work. We would appreciate the opportunity to investigate your concern first.

We use measures designed for the sensitivity and risk of the information involved. These include restricted private storage for credential documents, tokenised payment components, least-privilege access, request and rate-limit controls, audit records and monitoring. Supplier security controls apply to information held in their systems.

No online service can guarantee absolute security. If a personal-data breach creates a legal duty to notify you or a regulator, we will do so within the applicable period and provide the information required by law.

Our security measures include TLS in transit, protected stored information, hashed passwords, HttpOnly session cookies, passkeys, multi-factor and step-up authentication, access controls and audit records. A passkey used to satisfy stronger authentication must meet the required user-verification checks; simple user presence alone is not treated as the same result.

Recovery requires the current-address confirmation, any required historical-address confirmation, the trusted-history review and applicable business callback and independent review. Where the recovery process calls for a second reviewer, that reviewer must approve independently before the full 72-hour wait begins. Sensitive changes are restricted for seven days from completion: payout destinations, the account email, adding owners, and granting or expanding team access. Ordinary payouts to the existing verified destination and existing authorised team access continue unless a separate justified security restriction applies. Security removals and attack-cancellation steps remain available through appropriate verification.

An exceptional recovery route for someone unable to complete the required contact checks is not currently available. The GoSavis team cannot bypass the checks or reset protections on the spot. We do not routinely request identity documents for this process. Any future exceptional route must be explained and introduced separately after its independent checks, second-reviewer controls and appropriate notices are ready. Data export and erasure requests during restrictions use a verified route; they are not opened automatically or refused merely because a restriction is active.

An account and a booking contract are intended for people aged 18 or over. Our children’s access assessment concludes that public pages, listings and user content are nevertheless likely to be accessed by children because they can be viewed without highly effective age assurance. We therefore treat those parts of GoSavis as likely to be accessed by children and apply the corresponding safety duties. If you believe a child has created an account or disclosed personal information, contact

• Child privacy report: privacy@gosavis.com

This section is for you if someone booked a service for you on GoSavis and gave us your details to do so. It explains what we hold about you, where it came from and what we do with it. You do not need a GoSavis account to use any of the rights it describes.

• Who we are: GoSavis Limited, registered in England and Wales under company number 12899784, with its registered office at 32 Eyre Street, Sheffield, England, S1 4QZ, is the controller of these details. You can reach us at privacy@gosavis.com.

• What we hold: Your name and the phone number or email address the person who made the booking gave us. Where they told us that you are below the age of majority where the service is delivered (18 in the United Kingdom), we also hold that fact. Where we emailed you about the booking, we keep a record of that email and whether it was sent.

• Where it came from: From the person who made the booking, not from you.

• Why we use it: So that the business can provide the service to you: it needs to know who it is serving and how to reach you. Where the contact given is an email address, we use it to email you when the booking is made, saying who booked what for you, with whom and when; again if the booking moves to another date or time, or is cancelled after the business has accepted it, so that you know where and when you are expected; if a request awaiting the business’s acceptance lapses, is declined or is withdrawn, to tell you that it was not confirmed and the appointment will not go ahead, without giving the reason, who acted or any payment details; and if the business records the booking as not attended, so that you can query that record. Where you were marked as below the age of majority, we also use that to protect you: the booking is held for the business to accept rather than confirmed automatically, the person who made the booking must confirm that a parent or guardian has agreed and we record that confirmation, and the business is told before it provides the service. We do not use your details for marketing.

• Our lawful basis: Legitimate interests: the interest of the person who made the booking, of the business and of you in the service reaching the person it was booked for.

• Who receives it: The business providing the service, and those of its staff who handle its bookings, see your name, the contact given and, where it applies, that you are below the age of majority. The suppliers that host GoSavis and send its email, listed under "How we share your information", handle these details for us.

• How long we keep it: With the booking record, for as long as that record is kept, as described under "How long we keep your information". If the person who made the booking closes their GoSavis account, your name and contact details are removed from the booking, and from our record of any email we sent you, when their account is deleted. Where you were marked as below the age of majority, that fact stays on the business's record of the booking without your name or contact details.

• Your rights: You have the rights described under "Your rights", including to see these details, to have them corrected or deleted, and to object to our using them; some have legal limits, which that section explains. You do not need an account to use them: email privacy@gosavis.com, naming the business and the date of the booking if you can. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/.

If you are receiving a delivery

This part is for you if someone booked a courier, removal or other delivery on GoSavis and named you as the person receiving the goods. You do not need a GoSavis account to use any of the rights it describes.

• What we hold: The address the goods are delivered to and, where the person who booked the delivery gave them, your name and phone number.

• Where it came from: From the person who booked the delivery, not from you.

• Why we use it: So that the business can deliver the goods to you: it needs to know where to take them, who will receive them and how to reach you when it arrives. We do not contact you ourselves, and we do not use your details for marketing.

• Our lawful basis: Legitimate interests: the interest of the person who booked the delivery, of the business and of you in the goods reaching you.

• Who receives it: Only the business making the delivery, with those of its staff who handle its bookings, and the person who booked it see your name and phone number. Where the delivery is priced by its distance, the delivery address alone, without your name or phone number, is sent to postcodes.io and OpenStreetMap’s Nominatim to find where it is. The suppliers that host GoSavis, listed under "How we share your information", handle these details for us.

• How long we keep it: With the booking record, for as long as that record is kept, as described under "How long we keep your information". If the person who booked the delivery closes their GoSavis account, your name, your phone number and the delivery address are removed from the booking when their account is deleted.

• Your rights: You have the rights described under "Your rights", including to see these details, to have them corrected or deleted, and to object to our using them. To use them, or with any question, email privacy@gosavis.com, naming the business and the date of the delivery if you can. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/.

If the booker selects your GoSavis member account, the Booking is linked to that account and you are notified. The business providing the service sees your display name as it does for other customer bookings. You can report a mistaken or unwanted selection through the Booking or support@gosavis.com. Being selected does not authorise use of your saved payment method, make you responsible for the booker’s payment, or give the booker access to your private account details.

We may revise this policy from time to time as the product, our suppliers, or the law change. The date at the top of this page reflects the most recent revision. We tell you about a material change at least 30 days before it takes effect, by email and in the app, with a summary of what is changing, so that you have a meaningful opportunity to read it first.

If you have any questions about this policy, want to exercise one of the rights described above, or would like to raise a concern about how your information is being handled, please get in touch using the details below.

• Privacy enquiries: privacy@gosavis.com

• General support: support@gosavis.com

• Telephone: 0114 551 9990

• Response time: Within 5 business days, and within one calendar month for formal rights requests

Every version of this document is kept here as it was published. A new version applies from the day it takes effect.