Privacy Policy

GraftPal ("GraftPal", "we", "us") provides the GraftPal business management platform, its client portal, mobile and web applications, APIs and the website at graftpal.com (together, the "Service").

For anything about privacy or this policy, email privacy@graftpal.com.

GraftPal handles personal data in two different roles, and this policy covers both:

• As a controller for data about our own customers and website visitors: your account, billing, support conversations, usage of the Service, and marketing preferences. We decide how and why this data is used.
• As a processor for the data our customers store in their workspace about their own clients, leads, contacts and staff ("Customer Data"). The customer is the controller of that data; we only process it on their documented instructions to provide the Service, under the data processing terms in section 11 of our Terms of Service.

The Service is not designed for special category data (such as health information) or criminal offence data. Customers must not upload it unless they have a lawful basis and any required safeguards in place.

Where we act as a controller, we use personal data only for these purposes and on these lawful bases:

We do not use Customer Data for our own purposes, do not sell it, and do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

GraftPal AI features (such as the assistant, drafting and insights) send your prompt, and the workspace information needed to answer it, to our AI provider OpenAI through its API. The chat assistant on graftpal.com works the same way, answering from our website's content; we review saved chats to improve its answers. Under OpenAI's API terms, this data is not used to train OpenAI's models. We do not use Customer Data to train AI models of our own.

AI output can be wrong, so review it before you rely on it or send it to anyone. AI chat history is deleted automatically after 7 to 30 days, depending on your plan (see section 8). You never have to use AI features to use GraftPal.

We do not sell personal data. We share it only with:

• Sub-processors that help us run the Service, under written contracts that require them to protect the data and use it only on our instructions (listed below).
• Integrations you choose to connect, which receive data at your direction and handle it under their own terms.
• Your workspace and clients: people you invite, and clients you share documents, invoices or portal access with.
• Professional advisers (lawyers, accountants, auditors and insurers) under a duty of confidentiality.
• Authorities, when the law requires it; we will push back on requests that are not lawful and, where allowed, tell the affected customer first.
• A buyer or successor if our business is sold or restructured, under the same protections as this policy.

Some of our providers process data outside the UK and EEA, mainly in the United States. Where they do, we use a recognised safeguard: an adequacy decision or regulation (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with any supplementary measures needed. You can ask us for a copy of the relevant safeguard at privacy@graftpal.com.

Customers can export their data (for example as CSV) at any time while their subscription is active.

We use technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS/HTTPS) for all traffic, and encryption at rest by our database and storage provider.
• Passwords stored only as salted bcrypt hashes; integration access tokens encrypted with AES-256-GCM.
• Logical separation of each workspace's data, and role-based permissions within a workspace.
• Audit logs of important account and data actions.
• Rate limiting, security headers and a content security policy to reduce abuse and attacks.
• Least-privilege access for GraftPal staff, who access Customer Data only when needed to provide support you ask for, to keep the Service secure, or when the law requires.
• Error and security monitoring, dependency updates and a documented incident response process.

No system is completely secure. If you believe you have found a security issue, please email security@graftpal.com and give us a reasonable chance to fix it before disclosing it.

If a personal data breach happens, we will contain it, assess the risk and act to limit harm. Where we are the controller, we will report it to the ICO (or other supervisory authority) within 72 hours where required, and tell affected people without undue delay if the risk to them is high. Where we are a processor, we will tell the affected customer without undue delay after becoming aware of it and give them the information they need to meet their own obligations.

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict or object to our processing, including for direct marketing (an absolute right);
• receive your data in a portable format, or have it sent to another provider;
• withdraw consent at any time, without affecting processing before you withdrew it;
• not be subject to decisions based solely on automated processing that significantly affect you.

Many of these you can do yourself in the app: edit your profile, export data, and delete your account in Settings. Otherwise, email privacy@graftpal.com. We will respond within one month (extendable by two months for complex requests, in which case we will tell you), and may need to confirm your identity first. There is no fee unless a request is clearly unfounded or excessive.

If you are a client, lead or contact of a business that uses GraftPal, that business is the controller of your data and its own privacy notice applies. Please send requests to them first. If you contact us, we will pass your request to the business and help them respond.

We send product news and offers only where the law allows, and every marketing email has an unsubscribe link. Service messages (such as security alerts, receipts and changes to these terms) are not marketing and you will still receive them. Our use of cookies and your choices are explained in our Cookie Policy; you can change your cookie choices at any time with the Manage Cookies button.

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, contact privacy@graftpal.com and we will delete it.

We will update this policy when our practices or the law change, and change the date at the top. If a change is significant, we will tell customers by email or in the app before it takes effect.

Questions, requests or complaints: privacy@graftpal.com. We would like the chance to resolve any concern first, but you always have the right to complain to a supervisory authority, such as the UK Information Commissioner's Office (ico.org.uk).