Sign up free

Privacy Policy

Last updated: 16 October 2026

GraftG is part of the Grafto family, a trading name of Green and Home Limited (Company No. 04204020), registered in England & Wales. This policy explains how we collect, use, and protect your personal data when you use our service.

1. What data we collect

2. How we use your data

3. Legal basis (UK GDPR)

We process your data on the basis of contract performance (to deliver the service you signed up for) and legitimate interests (to improve the service and prevent fraud). Where required, we will ask for your consent.

4. Data sharing

We do not sell your data. We share it only with the following sub-processors necessary to deliver the service:

Transfers outside the UK. Some of these providers process data in the United States or elsewhere outside the UK. Our database and stored documents are hosted with Cloudflare in Western Europe. When your data, or your customers' data, is processed outside the UK, it is protected by the safeguards in that provider's data processing terms. For example, Anthropic's terms include the UK International Data Transfer Addendum approved by the Information Commissioner. To find out which safeguard applies to a particular provider, email hello@graftg.co.uk.

5. Data retention

We retain your account and business records for as long as your account is active plus 7 years (to comply with HMRC record-keeping requirements). You can request deletion at any time; statutory data may be retained for the legally required period.

Some data is deleted automatically on a shorter timetable:

Founding Tradies applications (graftg.co.uk/founders): name, trade, WhatsApp number, email, postcode area, jobs per week and your answer to "why you". Approved applications are kept for the life of the account as the record of your place. Declined and waiting-list applications are deleted automatically after 12 months. Legal basis: our legitimate interest in running the programme, and your consent to be contacted about your application.

Meta (Facebook) advertising on graftg.co.uk/founders. When we run ads for the Founding Tradies programme, the /founders page can set a Meta pixel cookie — only after you click "OK" on the cookie notice — so Meta can tell us which ads brought people to the page. If you submit an application we also send Meta a "Lead" event from our server containing your email address and phone number in hashed (irreversible) form, plus your IP address and browser type, so the ad campaign can be measured and improved. Legal basis: consent for the cookie; our legitimate interest in measuring advertising for the server event. Meta is a separate data controller for how it uses this — see Meta's privacy policy. We also record which ad (campaign and creative name) your application came from.

Testimonials. If you give us a written or video testimonial we store it, and — if you reply YES when we ask — a record of your consent to use it publicly (first name, trade, and for video your likeness and voice). We keep the consent record for as long as the testimonial is in use, and for 6 years afterwards as evidence of consent. You can withdraw consent for future use at any time by emailing hello@graftg.co.uk; see the programme terms.

6. Data deletion

To delete your GraftG account and all associated data, email hello@graftg.co.uk from the email address linked to your account with the subject line "Delete my account". We will confirm receipt and complete the deletion within 30 days. Some data (e.g. invoices, mileage logs) may be retained for up to 7 years where required by UK tax law (HMRC record-keeping obligations).

7. Your rights

Under UK GDPR you have the right to: access, correct, or delete your data; object to or restrict processing; and data portability. To exercise these rights, email hello@graftg.co.uk. You also have the right to complain to the ICO.

Your customers' data

When you store customer details in GraftG (names, addresses, phone numbers, email addresses on quotes, invoices, jobs and bookings), you are the data controller for that information and GraftG processes it on your behalf, solely to provide the service to you. If a customer books a visit through your public booking page, we collect the details they enter (name, phone, address, optional email) for you, to manage that booking. We do not use your customers' details for marketing and never sell them. Deleting your account deletes them (subject to the statutory retention periods above).

8. Cookies

We don't use analytics cookies anywhere. On our marketing site (graftg.co.uk), the only non-essential cookie is the Meta advertising pixel on the Founding Tradies page (graftg.co.uk/founders), and it is set only after you click "OK" on the cookie notice there — see section 5 above. No other page on graftg.co.uk sets advertising cookies.

The app (app.graftg.co.uk) uses a session cookie set by Clerk, our authentication provider, which is strictly necessary for the service to work — signing you in and keeping you signed in. Strictly necessary cookies don't need consent under UK PECR.

9. Security

All data, including bank details, is encrypted at rest by our hosting provider and in transit (TLS 1.2+). Bank details appear only on the invoices you generate. We perform regular security reviews.

10. Changes to this policy

We will notify you by email of any material changes. The current version is always at graftg.co.uk/privacy.

11. Contact

Green and Home Limited, Belfry House, Bell Lane, Hertford, SG14 1BP
hello@graftg.co.uk