Privacy Policy

1. Who we are

grafter.ly is operated by Grafterly Ltd, a company registered in Scotland. Our registered office is Kymel House, 3 Upper Carman Road, Renton, Dumbarton, G82 4NZ, and our company number is SC890809. References to "we," "us," or "our" in this policy refer to Grafterly Ltd.

We can be contacted at hello@grafter.ly.

2. What information we collect

We collect information you provide directly to us:

• Sign-ups: your name and email address, and the business details you give us on the signup form.
• Account registration: your email address, used to send you a magic sign-in link.
• Product data: information you enter while using grafter.ly — jobs, customers, quotes, invoices, and messages. This data belongs to you.
• Enquiries you forward to us: if you forward a customer enquiry to an address we publish, such as firstenquiry@grafter.ly, we read that email to build a job from it. That means we handle your customer's details — their name, contact details, address and what work they want — before you have an account with us. We use it only to build the job and show it back to you. We never market to your customer, never build a profile of them, and never use their details for anything else.

We also collect limited technical data automatically (IP address, browser type, pages visited) via our analytics provider (PostHog) and error monitoring provider (Sentry). This is used to improve the product and diagnose errors.

3. The grafter.ly app

The grafter.ly app for iPhone is a companion to the website. You sign in to your account, or make one with Sign in with Apple, and it shows you the same jobs, quotes and invoices. Five things about it are worth saying plainly.

• Signing in with Apple. If you use Sign in with Apple, Apple gives the app the email address on your Apple ID and its own identifier for you. The first time, it also gives your name. We use the address to find your grafter.ly account, and keep the identifier with the account so the next sign-in finds it. If no account uses the address, the app asks for your business name and your trade, and makes one. It asks for your name too if Apple did not send it. If you leave that screen without tapping Create account, we keep none of it.
• The address from Apple. On an account the app makes, it becomes the account's email address. Unless Apple is hiding it, it also becomes your business email, the one your customers see and reply to. You can change that in Settings. If you choose Apple's “Hide My Email”, Apple gives a relay address in place of your own. The relay is the address on your account, so the app asks for a business email your customers can reply to. If you already have an account under a different address, the app cannot tell it is yours and will offer to make a new one. Sign in with your email instead, or connect Apple from Settings on the website first.
• Disconnecting Apple. When you sign in with Apple in the app, we ask Apple for a token for that sign-in and keep it encrypted. We use it for one thing: to tell Apple to disconnect grafter.ly from your Apple ID when your sign-in is deleted. Until then we do nothing with it. If that does not work, or we were never given a token, your sign-in is deleted all the same. You can then remove grafter.ly from your Apple ID yourself.
• Staying signed in. Your session is held in the iPhone's Keychain, which is encrypted by the phone. Signing out removes it. The app also keeps a copy of your board and the jobs you have opened, so they can be read with no signal; that copy is deleted when you sign out.
• Notifications. If you turn them on, Apple gives us a token that identifies that phone. We store it against your account and use it only to send the notifications you asked for — a payment landing, a quote accepted, a customer replying, an enquiry arriving. We never put what your customer wrote into a notification, because it appears on a lock screen anyone can see. Signing out deletes the token, and so does deleting the app: Apple tells us it has stopped working and we remove it.

The app reports crashes and errors to Sentry, as the website does, so we can find out what broke. It also tells Sentry each time it is opened: which version, for how long, and whether it crashed. Each is filed under a random number for that copy of the app. Crash and error reports also carry a code worked out from the identifier the phone gives our apps. Some screens in the app are pages of the website, such as Settings and this policy. Sentry is at work on those as it is on the website. The website's analytics and advertising collect nothing in the app. There is no advertising identifier, and nothing in it follows you into other companies' apps or websites. The only two third-party components it contains are Supabase, for signing in, and Sentry.

4. How we use your information

• To communicate with you about your account, including signup and your subscription.
• To provide and improve the grafter.ly service.
• To diagnose errors and monitor service health.
• To comply with legal obligations where required.

We will not sell your personal data to third parties. We will not send you marketing emails beyond what you have signed up for.

5. Legal basis for processing

Under UK GDPR, we process your personal data on the following bases:

• Contract: processing your account data is necessary to provide the service.
• Legitimate interests: analytics and error monitoring help us maintain a functioning service.
• Consent: for signup-related communications, you have given us your email address voluntarily.

Enquiries forwarded before you have an account. When you forward a customer enquiry to try the service, we rely on legitimate interests to read it and build the job — yours, in seeing what the product does with your own work, and ours, in showing it. Forwarding the email is what asks us to do that, and we do nothing with it beyond building the job you get back. Your customer's interests are protected by keeping the use that narrow and by deleting everything if you do not claim the account. Once you claim it, you become the controller of that data and we process it for you under the data processing terms in our Terms of Service.

If we built a page about your business and you never asked us to. We create pages for trade businesses from public registers — Companies House, and the certification registers run by SELECT, Gas Safe, NICEIC and NAPIT. If there is a page here for your business and you did not make it, this is where it came from. We hold your business name, trade, town, phone, email, website and company number, and a note of which register each came from.

We only do this for limited companies, never for sole traders, because a company's registered name, trade and town are published in a statutory register rather than being personal details about a person.

We rely on legitimate interests: ours in reaching businesses who would find the product useful, and yours in a page that passes customer enquiries to you free, with no account and nothing to cancel. Four things keep that balance where we think it belongs. We publish your town but never your street or postcode, because a registered office is often a home. We never publish an email address for you — enquiries come through a form on the page, so nothing of yours is put in front of a scraper. Any enquiry it receives reaches you in full, free, and is never sold or shared with other trades. And you can remove the page in one click, from the page itself, with no account and no reply from us — the link is at the bottom of it. Once removed it stays removed; we will not create it again.

These pages can appear in search results. That is the point of them — a page nobody can find is no use to you — but it means the page is public from the day we make it rather than from the day you claim it. If you would rather it did not exist, the removal link takes it down straight away.

You can also object to this processing, ask us what we hold, or ask us to correct it, by emailing hello@grafter.ly. Removing the page does the same thing faster.

6. Who we share data with

We use the following sub-processors to operate the service:

• Supabase — database and authentication (EU region).
• Vercel — hosting and infrastructure.
• Postmark (ActiveCampaign) — transactional email delivery and inbound email processing.
• Anthropic — reading incoming enquiry messages to pull out the customer's name, contact details and what work they are asking for. Message content is sent to Anthropic to be processed and is not used to train their models.
• Google Places — finding your business on Google from the name and town you type while building a findagrafter.com website, so we can fill in your trade, phone number and area.
• AssemblyAI — turning the voice note you record while building a findagrafter.com website into text, in its EU region. We keep neither the recording nor the text, and the text is deleted from AssemblyAI as soon as we have read it.
• Stripe — card payments, both for your subscription and for invoices your customers pay online.
• Sentry — error monitoring.
• Apple — delivering notifications to the iPhone app. A notification's wording passes through Apple's push service to reach your phone, which is why we keep your customer's words out of it.
• PostHog — product analytics.
• Vercel Web Analytics — anonymous, cookieless visitor and page-view counts. Sets no cookies and collects no personal data.
• Google Ads — measuring the effectiveness of our advertising. Only set if you accept cookies.
• Meta (Facebook) — measuring the effectiveness of our advertising on Facebook and Instagram. Only set if you accept cookies.
• OpenAI — measuring the effectiveness of our advertising in ChatGPT. Only set if you accept cookies.

Each sub-processor is subject to its own privacy policy and data processing agreements. We do not share data with anyone else without your consent, except where required by law.

7. Data retention

Signup request data is retained until your request is consumed, rejected, or you ask us to remove it. Rejected signup requests are deleted after 90 days; pending requests that go unactioned for 30 days are auto-declined and deleted.

Deleting your account. You can delete your account yourself, from Settings — there is nobody to email and nothing to wait for. It locks straight away, everyone is signed out, and nothing further is charged. For 90 days everything stays exactly as it is and you can cancel from the same place, which is what makes those 90 days a chance to change your mind rather than a delay.

After 90 days the data is anonymised, not erased, and the difference matters, so here it is plainly.

• Your customers’ details are erased. Names, addresses, phone numbers, email addresses, the text of anything they sent you, and any photographs. We held those on your behalf, and once you are gone there is no reason for us to have them.
• Your own details are replaced with a placeholder, and the sign-in is destroyed. Nobody can get back into the account afterwards, including you.
• Invoices, payments and their totals survive, with nobody’s name attached. They are your tax records and HMRC expects them kept for six years, which is longer than our 90 days.
• Your inbound email address stops working and is never reissued to anyone else, so mail meant for you can never reach a stranger. If you set up forwarding from your own email, switch that rule off at your end — it is the only place that stops it, and we will email you to say so if mail keeps arriving.
• A page built from a public register goes back to being one. Anything you wrote on it is removed; what is left is what the register already published.

What we cannot reach. Anonymising our own records does not reach copies held elsewhere. If you connected Xero, your customers’ contact details are in your own Xero organisation, which is yours to manage and not ours to delete from; we revoke our access. Stripe keeps its own record of payments taken, and our references to those records survive so a refund or a chargeback can still be reconciled. Email we have sent or received on your behalf sits in our email provider’s archive under its own retention.

Forwarded enquiries, before you have an account. If you forward a customer enquiry to us to try the service, and you do not go on to claim the account we set up for you, everything from that forward is deleted 30 days after your most recent forward — the job, the customer record, the stored copy of the email, and the account itself. Each new forward moves that date out by another 30 days. We keep only a record that a deletion happened, which contains no personal data. Copies inside routine encrypted backups are overwritten on their own cycle, within 35 days.

Pages built from a public register. These hold register data and nothing else — no customer enquiry, no detail a register has not already published — so we keep them until you remove the page or ask us to. If one receives a customer enquiry, it becomes an account awaiting your claim, and the 30-day deletion clock above applies to it from then on.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data — though for your account you do not have to ask. Settings has a Delete this account card, and section 7 says exactly what happens.
• Object to or restrict how we process your data.
• Receive your data in a portable format.

To exercise any of these rights, email us at hello@grafter.ly. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data lawfully.

9. Cookies

We use strictly necessary cookies for authentication (session management); these are always on. We also use analytics cookies (PostHog) to understand how the product is being used, and advertising cookies (Google Ads, Meta and OpenAI) to measure how well our ads work. Advertising cookies are only set if you accept them in the cookie banner — declining leaves them off, and the site works exactly the same either way. We also use Vercel Web Analytics for anonymous visitor counts; it sets no cookies and needs no consent.

10. Changes to this policy

We may update this policy from time to time. We will note the date of the most recent update at the top of this page. Significant changes will be communicated to registered users by email.