Privacy Policy

Last updated: 8 July 2026

GraftG is part of the Grafto family, a trading name of Green and Home Limited (Company No. 04204020), registered in England & Wales. This policy explains how we collect, use, and protect your personal data when you use our service.

1. What data we collect

• Account data: name, email address, and phone number when you sign up.
• Business data: business name, VAT number, hourly rate, bank sort code and account number (stored securely and only used to populate invoice PDFs).
• WhatsApp messages: text and image content you send to your GraftG number, used to power the service (mileage, quotes, receipts, jobs). Messages are processed by AI and the results stored; raw message content is not retained beyond processing.
• Mileage, job, receipt, and quote records you create via the service.
• Payment data: billing handled by Stripe. We store only a Stripe customer ID and subscription status. We never see your full card number.
• Usage data: standard server logs (IP address, browser type, pages visited) retained for 30 days.

2. How we use your data

• To provide, personalise, and improve the GraftG service.
• To send weekly/monthly summary emails you have opted into.
• To process payments and manage your subscription.
• To comply with legal obligations (HMRC record-keeping requirements).
• To contact you about your account or service updates.

3. Legal basis (UK GDPR)

We process your data on the basis of contract performance (to deliver the service you signed up for) and legitimate interests (to improve the service and prevent fraud). Where required, we will ask for your consent.

4. Data sharing

We do not sell your data. We share it only with the following sub-processors necessary to deliver the service:

• Cloudflare — hosting, database, and CDN (US/EU).
• Anthropic — AI processing of message content. Messages are not used to train their models under our enterprise agreement.
• Meta (WhatsApp) — message delivery via WhatsApp Cloud API.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Clerk — authentication.
• HubSpot — CRM (newsletter subscribers only).
• Xero — accounting integration (only if you enable this feature).

5. Data retention

We retain your account and business records for as long as your account is active plus 7 years (to comply with HMRC record-keeping requirements). You can request deletion at any time; statutory data may be retained for the legally required period.

6. Data deletion

To delete your GraftG account and all associated data, email [email protected] from the email address linked to your account with the subject line "Delete my account". We will confirm receipt and complete the deletion within 30 days. Some data (e.g. invoices, mileage logs) may be retained for up to 7 years where required by UK tax law (HMRC record-keeping obligations).

7. Your rights

Under UK GDPR you have the right to: access, correct, or delete your data; object to or restrict processing; and data portability. To exercise these rights, email [email protected]. You also have the right to complain to the ICO.

8. Cookies

Our marketing site (graftg.co.uk) uses no tracking or analytics cookies. The app (app.graftg.co.uk) uses a session cookie set by Clerk, our authentication provider, which is strictly necessary for the service to work — signing you in and keeping you signed in. Because we only use strictly necessary cookies, no cookie consent banner is required under UK PECR. No third-party advertising or analytics cookies are used anywhere.

9. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Bank details are stored encrypted and only decrypted when generating a PDF. We perform regular security reviews.

10. Changes to this policy

We will notify you by email of any material changes. The current version is always at graftg.co.uk/privacy.

11. Contact

Green and Home Limited, Belfry House, Bell Lane, Hertford, SG14 1BP
[email protected]