Privacy Policy

1. Who we are

grafter.ly is operated by Grafterly Ltd, a company registered in Scotland. Our registered office is in Scotland, United Kingdom. References to "we," "us," or "our" in this policy refer to Grafterly Ltd.

We can be contacted at hello@grafter.ly.

2. What information we collect

We collect information you provide directly to us:

• Sign-ups: your name and email address, and the business details you give us on the signup form.
• Account registration: your email address, used to send you a magic sign-in link.
• Product data: information you enter while using grafter.ly — jobs, customers, quotes, invoices, and messages. This data belongs to you.
• Enquiries you forward to us: if you forward a customer enquiry to an address we publish, such as firstenquiry@grafter.ly, we read that email to build a job from it. That means we handle your customer's details — their name, contact details, address and what work they want — before you have an account with us. We use it only to build the job and show it back to you. We never market to your customer, never build a profile of them, and never use their details for anything else.

We also collect limited technical data automatically (IP address, browser type, pages visited) via our analytics provider (PostHog) and error monitoring provider (Sentry). This is used to improve the product and diagnose errors.

3. How we use your information

• To communicate with you about your account, including signup and your subscription.
• To provide and improve the grafter.ly service.
• To diagnose errors and monitor service health.
• To comply with legal obligations where required.

We will not sell your personal data to third parties. We will not send you marketing emails beyond what you have signed up for.

4. Legal basis for processing

Under UK GDPR, we process your personal data on the following bases:

• Contract: processing your account data is necessary to provide the service.
• Legitimate interests: analytics and error monitoring help us maintain a functioning service.
• Consent: for signup-related communications, you have given us your email address voluntarily.

Enquiries forwarded before you have an account. When you forward a customer enquiry to try the service, we rely on legitimate interests to read it and build the job — yours, in seeing what the product does with your own work, and ours, in showing it. Forwarding the email is what asks us to do that, and we do nothing with it beyond building the job you get back. Your customer's interests are protected by keeping the use that narrow and by deleting everything if you do not claim the account. Once you claim it, you become the controller of that data and we process it for you under the data processing terms in our Terms of Service.

5. Who we share data with

We use the following sub-processors to operate the service:

• Supabase — database and authentication (EU region).
• Vercel — hosting and infrastructure.
• Postmark (ActiveCampaign) — transactional email delivery and inbound email processing.
• Anthropic— reading incoming enquiry messages to pull out the customer's name, contact details and what work they are asking for. Message content is sent to Anthropic to be processed and is not used to train their models.
• Stripe — card payments, both for your subscription and for invoices your customers pay online.
• Sentry — error monitoring.
• PostHog — product analytics.
• Vercel Web Analytics — anonymous, cookieless visitor and page-view counts. Sets no cookies and collects no personal data.
• Google Ads — measuring the effectiveness of our advertising. Only set if you accept cookies.

Each sub-processor is subject to its own privacy policy and data processing agreements. We do not share data with anyone else without your consent, except where required by law.

6. Data retention

Signup request data is retained until your request is consumed, rejected, or you ask us to remove it. Rejected signup requests are deleted after 90 days; pending requests that go unactioned for 30 days are auto-declined and deleted.

Account and product data is retained while your account is active and for 90 days after deletion, to allow for recovery.

Forwarded enquiries, before you have an account. If you forward a customer enquiry to us to try the service, and you do not go on to claim the account we set up for you, everything from that forward is deleted 30 days after your most recent forward — the job, the customer record, the stored copy of the email, and the account itself. Each new forward moves that date out by another 30 days. We keep only a record that a deletion happened, which contains no personal data. Copies inside routine encrypted backups are overwritten on their own cycle, within 35 days.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data.
• Object to or restrict how we process your data.
• Receive your data in a portable format.

To exercise any of these rights, email us at hello@grafter.ly. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data lawfully.

8. Cookies

We use strictly necessary cookies for authentication (session management); these are always on. We also use analytics cookies (PostHog) to understand how the product is being used, and advertising cookies (Google Ads) to measure how well our ads work. Advertising cookies are only set if you accept them in the cookie banner — declining leaves them off, and the site works exactly the same either way. We also use Vercel Web Analytics for anonymous visitor counts; it sets no cookies and needs no consent.

9. Changes to this policy

We may update this policy from time to time. We will note the date of the most recent update at the top of this page. Significant changes will be communicated to registered users by email.