We keep this simple. You use Graft to run your trade business. We process your data only to make the app work and to keep you informed. We don't sell it, we don't share it with advertisers, and we store it securely in the EU.
1. Who we are
Graft Assistant is operated by MORGAN & CO ENTERPRISE LTD, a company registered in England and Wales.
- Email: hello@graftassistant.co.uk
- Website: graftassistant.co.uk
We are the data controller for personal data processed through the Graft app and website. This policy applies to the Graft Assistant mobile application and any related services.
2. What data we collect and why
Account & profile data
| Data | Why we collect it | Legal basis |
|---|---|---|
| Email address | To create and manage your account; to send transactional emails | Contract performance |
| First name, trade type, business name | To personalise the app and your AI assistant | Contract performance |
| AI assistant name | To personalise your in-app experience | Contract performance |
Business data you enter
| Data | Why we collect it | Legal basis |
|---|---|---|
| Jobs (title, address, date, status, notes) | Core app function — managing your work schedule | Contract performance |
| Invoices (number, description, amount, due date) | Core app function — tracking your invoicing | Contract performance |
| Quotes (number, description, amount, status) | Core app function — managing your quotes | Contract performance |
| Client details (name, phone, email, address, notes) | Core app function — managing your client list | Contract performance |
Receipts & expenses
If you use expense tracking, we store the receipt photos you capture or upload and the expense details you enter (amount, category, date). These are used only to provide the expenses and tax features.
Connected inboxes (optional)
If you connect an email account (Gmail or Outlook) or your Instagram professional account, we access and store the messages needed to show your unified inbox and — where you switch it on — to draft AI replies for your review. We request only the minimum permissions required for this feature. We never use this content for advertising and we never sell it.
Graft's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Microsoft and Meta is handled to the same standard: used only to provide the inbox features you've connected.
AI call answering (optional)
If you enable AI call answering, calls to your Graft number are answered by an AI agent. Call audio is processed, and transcripts and caller details (such as name and phone number) are stored in your account so you can review and follow up.
AI assistant conversations
When you use the AI assistant, your messages and the assistant's replies are stored so you can refer back to previous conversations. These are stored securely in your account and are not used to train AI models.
Payments & subscriptions
When you subscribe to a paid plan, payment is processed by Stripe (on our website) or by Apple (in-app purchases on iOS). We never see or store your full card details. We store your subscription plan and status, and the billing records we are required to keep for tax purposes.
Device & usage data
We may collect basic technical information (device type, OS version, app version, crash reports) to maintain and improve the service. This data is anonymised where possible.
3. Who we share your data with
We do not sell your data. We share it only with the following trusted sub-processors to operate the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and backend infrastructure | EU West (Ireland) |
| Brevo | Transactional and marketing email delivery | EU (France) |
| Stripe | Payment processing (web subscriptions) | EU / USA (Standard Contractual Clauses apply) |
| Apple | Payment processing (in-app purchases on iOS) | EU / USA (Standard Contractual Clauses apply) |
| Anthropic | AI assistant responses (your messages are sent to process your request) | USA (Standard Contractual Clauses apply) |
| Gmail connection for the unified inbox (only if you connect it) | EU / USA (Standard Contractual Clauses apply) | |
| Microsoft | Outlook connection for the unified inbox (only if you connect it) | EU / USA (Standard Contractual Clauses apply) |
| Meta | Instagram messages and comments for the unified inbox (only if you connect it) | EU (Meta Platforms Ireland Ltd) |
| Vapi | AI call answering (call audio and transcripts, only if you enable it) | USA (Standard Contractual Clauses apply) |
We may also disclose data where required by law, a court order, or to protect the rights and safety of users.
4. How long we keep your data
- Account data: Retained while your account is active and for up to 90 days after deletion, then permanently erased.
- Business data (jobs, invoices, quotes, clients): Retained while your account is active. You can delete any record at any time in the app.
- AI conversation history: Retained while your account is active. You can delete individual conversations in the app.
- Receipt photos & expenses: Retained while your account is active. You can delete any expense (and its photo) at any time in the app.
- Connected inbox messages & call transcripts: Retained while the connection is active. Deleted when you disconnect the account or delete the conversation; access tokens are deleted immediately on disconnect.
- Billing records: Retained for 7 years as required by UK tax law.
5. Your rights under UK GDPR
You have the following rights over your personal data. To exercise any of them, email us at hello@graftassistant.co.uk.
- Access: Request a copy of the personal data we hold about you.
- Correction: Ask us to correct inaccurate or incomplete data.
- Erasure: Ask us to delete your data ("right to be forgotten"). You can also delete your account directly in the app.
- Portability: Request your data in a structured, machine-readable format.
- Restriction: Ask us to limit how we process your data in certain circumstances.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Where we rely on consent, you can withdraw it at any time.
We will respond to requests within one month. If you're not happy with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
6. Cookies
The Graft mobile app does not use cookies. Our website (graftassistant.co.uk) may use essential cookies to ensure the site works correctly. We do not use tracking or advertising cookies.
7. Children's privacy
Graft is intended for use by adults running a trade business. We do not knowingly collect data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
8. Security
We use industry-standard security measures including encrypted connections (TLS), row-level security on our database, and secure authentication. No system is 100% secure, but we take reasonable steps to protect your data.
9. Changes to this policy
We may update this policy from time to time. We'll notify you by email or in-app notification if we make material changes. The "last updated" date at the top of this page will always reflect the most recent version.
10. Contact us
For any privacy-related questions or to exercise your rights:
- Email: hello@graftassistant.co.uk
- Subject line: Privacy Request