Privacy Policy

Last updated: 8 July 2026

GraftG is part of the Grafto family, a trading name of Green and Home Limited (Company No. 04204020), registered in England & Wales. This policy explains how we collect, use, and protect your personal data when you use our service.

1. What data we collect

• Account data: name, email address, and phone number when you sign up.
• Business data: business name, VAT number, hourly rate, bank sort code and account number (stored securely and only used to populate invoice PDFs).
• WhatsApp messages: text and image content you send to your GraftG number, used to power the service (mileage, quotes, receipts, jobs). Messages are processed by AI and the results stored. Voice notes are transcribed and the transcript is kept (to power the service and investigate errors); receipt photos are stored so you can view them later. Other raw message content is not retained beyond processing.
• Mileage, job, receipt, and quote records you create via the service.
• Payment data: billing handled by Stripe. We store only a Stripe customer ID and subscription status. We never see your full card number.
• Usage data: standard server logs (IP address, browser type, pages visited) retained for 30 days.

2. How we use your data

• To provide, personalise, and improve the GraftG service.
• To send weekly/monthly summary emails you have opted into.
• To process payments and manage your subscription.
• To comply with legal obligations (HMRC record-keeping requirements).
• To contact you about your account or service updates.

3. Legal basis (UK GDPR)

We process your data on the basis of contract performance (to deliver the service you signed up for) and legitimate interests (to improve the service and prevent fraud). Where required, we will ask for your consent.

4. Data sharing

We do not sell your data. We share it only with the following sub-processors necessary to deliver the service:

• Cloudflare — hosting, database, and CDN (US/EU).
• Anthropic — AI processing of message content. Under Anthropic's API terms, our data is not used to train their models.
• Meta (WhatsApp) — message delivery via WhatsApp Cloud API.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Clerk — authentication.
• HubSpot — CRM (newsletter subscribers only).
• Xero — accounting integration (only if you enable this feature).

5. Data retention

We retain your account and business records for as long as your account is active plus 7 years (to comply with HMRC record-keeping requirements). You can request deletion at any time; statutory data may be retained for the legally required period.

6. Data deletion

To delete your GraftG account and all associated data, email [email protected] from the email address linked to your account with the subject line "Delete my account". We will confirm receipt and complete the deletion within 30 days. Some data (e.g. invoices, mileage logs) may be retained for up to 7 years where required by UK tax law (HMRC record-keeping obligations).

7. Your rights

Under UK GDPR you have the right to: access, correct, or delete your data; object to or restrict processing; and data portability. To exercise these rights, email [email protected]. You also have the right to complain to the ICO.

Your customers' data

When you store customer details in GraftG (names, addresses, phone numbers, email addresses on quotes, invoices, jobs and bookings), you are the data controller for that information and GraftG processes it on your behalf, solely to provide the service to you. If a customer books a visit through your public booking page, we collect the details they enter (name, phone, address, optional email) for you, to manage that booking. We do not use your customers' details for marketing and never sell them. Deleting your account deletes them (subject to the statutory retention periods above).

8. Cookies

Our marketing site (graftg.co.uk) uses no tracking or analytics cookies. The app (app.graftg.co.uk) uses a session cookie set by Clerk, our authentication provider, which is strictly necessary for the service to work — signing you in and keeping you signed in. Because we only use strictly necessary cookies, no cookie consent banner is required under UK PECR. No third-party advertising or analytics cookies are used anywhere.

9. Security

All data, including bank details, is encrypted at rest by our hosting provider and in transit (TLS 1.2+). Bank details appear only on the invoices you generate. We perform regular security reviews.

10. Changes to this policy

We will notify you by email of any material changes. The current version is always at graftg.co.uk/privacy.

11. Contact

Green and Home Limited, Belfry House, Bell Lane, Hertford, SG14 1BP
[email protected]