Graft AI

Privacy Policy

Last updated: 28 May 2026

This policy explains what personal data Graft AI ("Graft", "we", "us", "the app") collects, why we collect it, who we share it with, and the rights you have over it. Graft is a job-management, scheduling, quoting and invoicing app for self-employed tradespeople in the United Kingdom.

Data controller: Adam Smith (trading as Graft AI)
Contact: adamjsmith197@gmail.com

1. Information we collect

Information you give us

Account details — your name, email address and the password you set when you create an account.
Business profile — your trading name, business address, contact phone/email, logo, VAT number and bank account details that you choose to add for displaying on quotes and invoices.
Customer & lead records — information you enter about your own clients and leads, such as their names, addresses, phone numbers and email addresses, so you can schedule jobs and send them documents.
Jobs & projects — project descriptions, schedules, time/hours logged, to-do items, notes, quotes and invoices.
Photos & files — images and receipts you upload (for example job photos or expense receipts).
Messages — messages you send through the in-app client portal and your conversations with the in-app AI assistant.
Voice input — audio you record when you use voice features, which is converted to text and (for spoken replies) to speech.

Information collected automatically

Location — with your permission, your device's location to provide directions to jobs and weather-aware scheduling. You can refuse or revoke this in your device settings.
Device & usage data — basic technical data such as device type, app version, diagnostic/crash information and a push notification token (if you enable notifications).

2. How we use your data

To create and operate your account and your company workspace.
To let you manage clients, schedule jobs, track time and produce quotes and invoices.
To power AI features — generating briefs, suggestions and assistant replies based on the information in your workspace.
To provide weather-aware scheduling and directions to jobs.
To send the documents and messages you choose to send to your clients.
To send you notifications and reminders you have opted into.
To keep the service secure, prevent abuse and fix problems.

3. Legal basis for processing (UK GDPR)

Performance of a contract — to provide the app and the features you sign up for.
Legitimate interests — to keep the service running, secure and improving, in a way that does not override your rights.
Consent — for optional permissions such as location, microphone and push notifications. You can withdraw consent at any time.

4. Who we share data with

We do not sell your personal data. We share it only with the service providers ("sub-processors") needed to run the app, and only to the extent required to provide their service:

Provider	Purpose
Supabase	Cloud database, authentication, file storage and hosting
Anthropic (Claude)	Powering the in-app AI assistant and AI-generated content
ElevenLabs	Converting text to spoken audio for voice replies
Open-Meteo	Weather forecasts for weather-aware scheduling
Google (Maps & Firebase)	Directions to jobs and delivery of push notifications
Apple & Google (app stores)	App distribution and, where used, app diagnostics

We may also disclose data where required by law, or to protect our legal rights.

5. AI processing

When you use AI features, the relevant content from your workspace (for example a message you send the assistant, or job details it summarises) is sent to our AI provider to generate a response. This content is used to produce your result and is not used by us to train AI models. Please avoid entering data you do not wish to be processed in this way.

6. International transfers

Some of our sub-processors are based outside the UK/EEA (for example in the United States). Where data is transferred internationally, we rely on appropriate safeguards such as the providers' standard contractual clauses and data-protection commitments.

7. Data retention

We keep your data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records to comply with legal obligations (for example tax/accounting records relating to invoices).

8. Your rights

Under UK data-protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict or object to certain processing;
receive a copy of your data in a portable format;
withdraw any consent you have given.

You can exercise these rights, including requesting deletion of your account and data, by emailing adamjsmith197@gmail.com, or by using the in-app account-deletion option where available. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. Security

Data is transmitted over encrypted connections (HTTPS) and stored on secured infrastructure with access controls. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

10. Children

Graft is a business tool intended for adults (18+). It is not directed at children and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Significant changes may also be notified in the app.

12. Contact

For any questions about this policy or your data, contact:
Adam Smith (trading as Graft AI)
adamjsmith197@gmail.com