Legal
Privacy Policy
Last updated 4 November 2026
This policy explains what Graft'd does with personal data. It is written to be read, not to be survived. If anything here is unclear, email apps@marvanova.com and we will explain it in plain English.
1. Who we are
Graft'd is a product of Marvanova Ltd, a company registered in England and Wales, company number 17280852, registered office Suite A, 82 James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE. We are registered with the Information Commissioner's Office as a data controller, registration number ZC117173.
For the data described in section 3 we are the data controller. For the data you put into the app about your own customers, described in section 4, you are the controller and we are your processor.
Contact for any privacy question or request: apps@marvanova.com.
2. The short version
We collect what we need to run your account, take payment and send you the emails the service depends on. We do not sell your data. We do not sell your customers' data. We do not use your job data to train AI models. Analytics only run if you say yes.
3. Data we hold about you
| What | Why | Legal basis |
|---|---|---|
| Name, email address, business name, trade, and your certification body registration number if you enter one | To create and run your account, and to put your details on the quotes, invoices and certificates you generate | Performance of a contract |
| Waiting list and founding member sign-ups: email address, and anything else you choose to tell us | To tell you when access opens and to run the founding member offer | Consent, which you can withdraw at any time |
| Subscription and billing records: plan, status, renewal date, invoice history | To take payment and meet our accounting obligations | Contract, and legal obligation |
| Support emails you send us | To answer you | Legitimate interests, being able to support our own customers |
| Technical logs: IP address, browser, timestamps, error traces | Security, fraud prevention and fixing faults | Legitimate interests, keeping the service working and secure |
| Analytics about how the site and the app are used | To see which parts of the site are useful | Consent. Nothing analytics related loads until you accept |
| Your phone's location, if you allow it: while Graft'd is open on your screen on a day you have jobs booked, and when you tap Arrived, Left or Plan my day | To offer to log when you arrive at a booked job and when you leave, and to start your route from where you are. We save the time and how far you were from the job's postcode. We do not save where you were. Nothing is checked when Graft'd is closed or in the background, and it stops once the day's jobs are logged | Your choice. Graft'd explains what it is for before your phone asks, and you can say no or turn it off on the Scheduler. The time is still logged without it |
| Photos you take in the app, and any arrows or labels you draw on them | To keep a record of your jobs. Location details are removed from photos before they are saved | Performance of a contract |
| Your bank details and your own payment link, if you add them | To show your customers how to pay you, on invoices, payment reminders and the payment code. Money goes straight to you. Graft'd never holds or moves it | Performance of a contract |
| Expenses and receipts you log, and which job they were for | To show you what each job cost you | Performance of a contract |
We never see your card details. Card payments are handled entirely by Stripe. We receive a payment reference, the outcome, and the last four digits, and nothing else.
4. Data you put into the app about your customers
When you quote a job, raise an invoice or generate a certificate, you enter details about the person you are working for. This includes details about the people at a property, such as tenants, and a customer's signature when they sign off a job. That is their personal data, and it is yours to control. You decide what goes in, how long it stays and when it is deleted.
We only process it to provide the app to you. We do not market to your customers. We do not sell it. We do not use it to train AI models. If you close your account, you can export it first, and we delete it as set out in section 8.
The same applies to the people who help you on jobs: their names, the rates you pay them and what you have paid them. Only you see these. They are never shown to your customers or to anyone you add as a team login.
You are responsible for having a lawful basis to hold your customers' and helpers' details, which for ordinary trade work is normally the contract you have with them.
5. Artificial intelligence
Some features send the text you enter or say to Anthropic so it can be turned into quote lines, draft wording or an answer. That processing happens under Anthropic's commercial terms, which do not permit your inputs to be used to train their models.
Voice quoting uses the speech recognition built into your phone or browser. On Chrome and Android that is a Google service, and on an iPhone or iPad it is Apple's, so what you say is sent to that company while the microphone is on, to turn it into words. On a phone with speech recognition, Graft'd keeps only the words, not the audio. On a computer, or a phone without speech recognition, a voice note can also keep the recording, which is backed up with your account when you are signed in. The walk-round quote only listens between your taps on Start and Done.
Do not paste anything into the app that you would not be comfortable being processed this way. AI output is a starting point and it can be wrong. You remain responsible for checking every quote, invoice, certificate and piece of advice before you rely on it or send it to a customer.
6. Who else touches the data
We use a small number of suppliers. Each of them only gets what they need to do their job.
| Supplier | What they do | Where |
|---|---|---|
| Supabase | Database and account sign-in | EU |
| Vercel | Hosting and delivery of the site and app | EU and USA |
| Stripe | Card payments and subscriptions | EU and USA |
| Resend | Sending the emails the service depends on | EU and USA |
| Anthropic | The AI features described in section 5 | USA |
| Google Analytics | Website usage statistics, only after you accept | EU and USA |
| Microsoft Clarity | Recordings and heatmaps of how our homepage is used, only after you accept | EU and USA |
| Ideal Postcodes (postcodes.io) | Turning job postcodes into map points for the arrival check and route planner. Only the postcode is sent, never names or other details | UK company. Their policy says some data may be stored outside the EEA |
When you tap Open in Google Maps, the addresses for that route are sent to Google so it can show the directions. That only happens when you tap it.
We will also disclose data if the law requires it, or to establish or defend a legal claim.
7. Transfers outside the UK
Some of the suppliers above process data in the United States. Those transfers are covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or by the supplier's certification under the UK extension to the EU-US Data Privacy Framework. Ideal Postcodes' own policy says some data may be stored outside the EEA, and that it aims to protect it with standard contractual clauses.
8. How long we keep things
- Account and job data: for as long as your account is open, then 30 days after you close it, so an accidental cancellation can be undone. After that it is deleted.
- Billing records: six years after the end of the financial year they relate to, because HMRC requires it.
- Waiting list entries: until you unsubscribe or ask us to remove you, or 24 months after the last time you engaged, whichever comes first.
- Support emails: two years.
- Technical logs: 90 days.
9. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete it, where we have no overriding reason to keep it
- restrict what we do with it, or object to us using it
- send it to you, or to someone else, in a portable format
- stop sending marketing, which you can also do from any email we send
Email apps@marvanova.com and we will respond within one month. There is no charge.
To delete your account, open Profile in the app and tap Delete my account, or follow the steps at getgraftd.co.uk/delete-account.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.
10. Cookies
The app sets a small number of cookies that are strictly necessary: they keep you signed in and remember the cookie choice you made. Those do not need consent and cannot be turned off without breaking the service.
Google Analytics and, on our homepage, Microsoft Clarity are the only non-essential cookies we use. Clarity records how the page is used, such as clicks, scrolling and mouse movement, so we can see what is confusing. Neither loads at all unless you press accept on the banner, and the site works exactly the same either way. You can change your mind at any time by clearing this site's data in your browser.
We do not use advertising cookies, advertising tracking pixels or cross-site profiling.
11. Automated decisions
We do not make automated decisions that produce a legal or similarly significant effect on you. The AI features suggest and draft. You decide.
12. Children
Graft'd is a business tool and is not intended for anyone under 18.
13. Changes
If we change this policy we will update the date at the top, and if the change is significant we will email account holders before it takes effect.