This privacy policy explains how Graftly (operated by Krave Ltd) collects, uses, and protects your personal information. We believe in transparency and plain English.
Who We Are
Graftly is a trading name of Krave Ltd, a company registered in England and Wales (Company Number: 13740967). Our registered office is at Unit A 82 James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
For data protection purposes, Krave Ltd is the data controller. You can contact us at privacy@getgraftly.com.
What Data We Collect
Account Information
- Email address (for login and communication)
- Name and business name
- Phone number (optional, for support)
- Business address (for invoices and compliance)
Business Data
- Customer information you add to Graftly
- Quotes, jobs, and invoices you create
- Financial records (VAT, CIS calculations)
- Photos and documents you upload
Technical Data
- Device information (for app functionality)
- IP address (for security)
- Usage analytics (to improve the product)
How We Use Your Data
We use your data to:
- Provide the Graftly service (quotes, invoices, job tracking)
- Send transactional emails (invoices to your customers, receipts)
- Provide customer support
- Improve our product based on usage patterns
- Comply with legal obligations (tax records, HMRC requirements)
- Sell your data to third parties
- Share your customer list with anyone
- Use your data for targeted advertising
- Send marketing emails without your consent
Legal Basis for Processing
Under GDPR, we process your data based on:
- Contract: To provide the service you signed up for
- Legitimate Interest: To improve our product and prevent fraud
- Legal Obligation: To comply with tax and business laws
- Consent: For optional marketing communications
Data Sharing
We share data only with:
- Supabase: Our database provider (UK data centre)
- Stripe: Payment processing (PCI compliant)
- PostHog: Privacy-focused analytics (EU hosted)
- Your accountant: If you choose to export data to them
Data Retention
We keep your data for:
- Active accounts: As long as your account is active
- After cancellation: 30 days, then deleted (unless legally required)
- Financial records: 7 years (HMRC requirement)
- Backups: 30 days, then automatically purged
Your Rights
Under GDPR, you have the right to:
- Access: Request a copy of your data
- Rectification: Correct inaccurate data
- Erasure: Request deletion ("right to be forgotten")
- Portability: Export your data in standard formats
- Object: Opt out of certain processing
- Restriction: Limit how we use your data
To exercise these rights, email privacy@getgraftly.com.
International Transfers
Your data is stored in the UK (London). We do not transfer data outside the UK or EU except where necessary for service providers who are GDPR compliant with appropriate safeguards in place.
Children
Graftly is a business tool. We do not knowingly collect data from anyone under 18. If you believe we have collected data from a minor, please contact us immediately.
Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes by email. The "last updated" date at the top of this page shows when it was last revised.
Contact & Complaints
Questions or complaints about data protection? Contact us at privacy@getgraftly.com.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.