Legal
Privacy Policy
Last updated 4 September 2026
This policy explains what Graft'd does with personal data. It is written to be read, not to be survived. If anything here is unclear, email apps@marvanova.com and we will explain it in plain English.
1. Who we are
Graft'd is a product of Marvanova Ltd, a company registered in England and Wales, company number 17280852, registered office Suite A, 82 James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.
For the data described in section 3 we are the data controller. For the data you put into the app about your own customers, described in section 4, you are the controller and we are your processor.
Contact for any privacy question or request: apps@marvanova.com.
2. The short version
We collect what we need to run your account, take payment and send you the emails the service depends on. We do not sell your data. We do not sell your customers' data. We do not use your job data to train AI models. Analytics only run if you say yes.
3. Data we hold about you
| What | Why | Legal basis |
|---|---|---|
| Name, email address, business name, trade, and your certification body registration number if you enter one | To create and run your account, and to put your details on the quotes, invoices and certificates you generate | Performance of a contract |
| Waiting list and founding member sign-ups: email address, and anything else you choose to tell us | To tell you when access opens and to run the founding member offer | Consent, which you can withdraw at any time |
| Subscription and billing records: plan, status, renewal date, invoice history | To take payment and meet our accounting obligations | Contract, and legal obligation |
| Support emails you send us | To answer you | Legitimate interests, being able to support our own customers |
| Technical logs: IP address, browser, timestamps, error traces | Security, fraud prevention and fixing faults | Legitimate interests, keeping the service working and secure |
| Analytics about how pages are used | To see which parts of the site are useful | Consent. Nothing analytics related loads until you accept |
We never see your card details. Card payments are handled entirely by Stripe. We receive a payment reference, the outcome, and the last four digits, and nothing else.
4. Data you put into the app about your customers
When you quote a job, raise an invoice or generate a certificate, you enter details about the person you are working for. That is their personal data, and it is yours to control. You decide what goes in, how long it stays and when it is deleted.
We only process it to provide the app to you. We do not market to your customers. We do not sell it. We do not use it to train AI models. If you close your account, you can export it first, and we delete it as set out in section 8.
You are responsible for having a lawful basis to hold your customers' details, which for ordinary trade work is normally the contract you have with them.
5. Artificial intelligence
Some features send the text you enter to Anthropic so it can be turned into quote lines, draft wording or an answer. That processing happens under Anthropic's commercial terms, which do not permit your inputs to be used to train their models.
Do not paste anything into the app that you would not be comfortable being processed this way. AI output is a starting point and it can be wrong. You remain responsible for checking every quote, invoice, certificate and piece of advice before you rely on it or send it to a customer.
6. Who else touches the data
We use a small number of suppliers. Each of them only gets what they need to do their job.
| Supplier | What they do | Where |
|---|---|---|
| Supabase | Database and account sign-in | EU |
| Vercel | Hosting and delivery of the site and app | EU and USA |
| Stripe | Card payments and subscriptions | EU and USA |
| Resend | Sending the emails the service depends on | EU and USA |
| Anthropic | The AI features described in section 5 | USA |
| Google Analytics | Website usage statistics, only after you accept | EU and USA |
We will also disclose data if the law requires it, or to establish or defend a legal claim.
7. Transfers outside the UK
Some of the suppliers above process data in the United States. Those transfers are covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or by the supplier's certification under the UK extension to the EU-US Data Privacy Framework.
8. How long we keep things
- Account and job data: for as long as your account is open, then 30 days after you close it, so an accidental cancellation can be undone. After that it is deleted.
- Billing records: six years after the end of the financial year they relate to, because HMRC requires it.
- Waiting list entries: until you unsubscribe or ask us to remove you, or 24 months after the last time you engaged, whichever comes first.
- Support emails: two years.
- Technical logs: 90 days.
9. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct anything that is wrong
- delete it, where we have no overriding reason to keep it
- restrict what we do with it, or object to us using it
- send it to you, or to someone else, in a portable format
- stop sending marketing, which you can also do from any email we send
Email apps@marvanova.com and we will respond within one month. There is no charge.
If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.
10. Cookies
The app sets a small number of cookies that are strictly necessary: they keep you signed in and remember the cookie choice you made. Those do not need consent and cannot be turned off without breaking the service.
Google Analytics is the only non-essential cookie we use. It does not load at all unless you press accept on the banner, and the site works exactly the same either way. You can change your mind at any time by clearing this site's data in your browser.
We do not use advertising cookies, tracking pixels or cross-site profiling.
11. Automated decisions
We do not make automated decisions that produce a legal or similarly significant effect on you. The AI features suggest and draft. You decide.
12. Children
Graft'd is a business tool and is not intended for anyone under 18.
13. Changes
If we change this policy we will update the date at the top, and if the change is significant we will email account holders before it takes effect.