Last updated
Who we are
Who are you contracting with?
- Logicly Ltd (company number 08378826, registered in England and Wales), trading as Graft. Logicly Ltd is the processor you contract with: it runs the platform and builds the agents. Your organisation is the controller.
Who do we contact about data protection?
- Data protection enquiries: privacy@graft.bot. For written requests, write to us at our registered office: Logicly Ltd, Suite A, 82 James Carter Road, Mildenhall, Suffolk IP28 7DE.
What we read
What do you read from our systems?
- The assessment reads the systems your organisation connects. Google Workspace: per-person daily counts of Gmail, Drive, Meet, Calendar and Chat activity, the third-party apps people have authorised against their accounts, and the directory and groups so we can report by team. Microsoft 365: per-person activity counts for email, Teams messages and meetings, and SharePoint and OneDrive files viewed, and which Microsoft 365 services are active, over Microsoft's 30-day report period. Linear and Twenty CRM: workflow events such as a state change or an assignment, with timestamps, where every person, object and project identifier is replaced by a keyed hash on arrival. Slack: nothing is read. If you connect it as a channel for approvals and alerts, Graft holds the connection only. For Google Workspace and Microsoft 365 we store no email bodies, subjects, attachment names, document contents, file names, meeting titles or display names.
How do you connect, and can we stop it?
- An administrator at your organisation approves each connection, and Graft uses the access you approve when you connect each system. You can revoke it at any time in the connected system's admin console or in the Graft dashboard. Google, Microsoft and Linear connections go through Nango, our integration layer, which holds the access tokens and makes each API call for us. Twenty sends signed webhooks.
Is the data anonymised?
- No. Where we pseudonymise data, it is still personal data. In our event log, every person, document and project identifier is replaced on arrival by a keyed hash: SHA-256 over a secret pepper, your organisation's id and the identifier. The Google and Microsoft usage rows use the same approach: the email address is replaced by a hash made with a secret pepper. The pepper is held outside the database. Because we hold it, we could re-identify a person whose email we already know.
Is this employee surveillance?
- Graft is not built to monitor individuals. It reports only on groups of at least 5 people and shows no one's individual figures, and it produces no rankings or scores of individuals. To build those figures it does process per-person activity counts under a keyed hash, which the ICO may treat as monitoring workers. Tell your staff before you connect, and we can give you a notice template.
Do you read our clients' confidential information?
- From Google Workspace, Microsoft 365, Linear and Twenty, the assessment reads activity metadata, not content. The assessment chat is the other place people type free text, and it tells users not to enter client-confidential or privileged material. If you later choose to run an agent, it reads only the content its task needs, under a written scope you approve in a statement of work. Every action that leaves your organisation waits for one of your people to approve it.
AI models
What happens to what people type in the assessment chat?
- It is stored in your organisation's account and sent to an Anthropic model through Vercel's AI Gateway to generate replies. The gateway may serve that model through Anthropic, AWS Bedrock or Google Vertex AI. The chat refuses any non-Anthropic model. Transcripts are deleted 90 days after the assessment completes, or 90 days after the last message if the assessment is never completed.
Do you or the AI providers train on our data?
- We never do. Every model request that carries your data goes through Vercel's AI Gateway and asks for zero data retention and no prompt training. A model that cannot offer zero data retention is refused.
Where your data is
Where is the data?
- The database is with Neon in London (AWS eu-west-2). The application servers run in London, United Kingdom. Nango, the connection layer, is in the United States, and so are the AI model providers. Where a provider is outside the UK, the transfer is covered by the safeguards in that provider's data processing terms, such as the UK-US data bridge or the ICO's international data transfer addendum.
Who are your sub-processors?
- Vercel (hosting, AI Gateway and workflow state), Neon (database), Nango (connections), Anthropic and OpenAI (AI models), Stripe (billing), Sentry (error monitoring) and Resend (email), plus Cloudflare for Graft Devices only. Because the AI Gateway is not pinned to one provider, AWS Bedrock and Google Vertex AI may also host Anthropic models, and Microsoft Azure may host OpenAI models. We give at least 30 days' notice of any change. See the full list.
Security
How is access to the dashboard secured?
- People sign in with Google, Microsoft or your own SAML or OIDC single sign-on, or with email and password and a verified address, plus authenticator-app two-factor. An organisation can require two-factor or single sign-on for its members. Law-firm organisations require two-factor for password sign-ins by default, once every password user in the organisation has enrolled. Google, Microsoft and single sign-on users are subject to their provider's own sign-in and multi-factor policies.
Who at Graft can see our data?
- Access to your content is limited to the people who need it for support, a security incident or a legal requirement.
If there is a breach, when will you tell us?
- Within 24 hours of becoming aware of it, with details following as we learn them, so you can meet your 72-hour deadline to the ICO.
Do you make automated decisions about our people?
- No. The assessment produces recommendations for your management. An agent's action that affects the outside world waits for a person at your organisation to approve it, and an unapproved action lapses after 72 hours without being done.
Your rights and your data
Can we delete it?
- Yes. You can disconnect any system at any time. An owner of your organisation can also delete the organisation in the dashboard. Everyone else loses access straight away, and we delete the organisation's data from production within 30 days. People who belong to no other Graft customer are deleted, or anonymised where another customer's records still name them. On your written instruction, or within 30 days after the contract ends, we delete your data from production and confirm it on request. Backups and restore history expire on their normal cycle.
Can you help us with a subject access request?
- Yes. Send it to us and we will search, export or erase within 10 business days.
What do we need to do as controller?
- Complete your own DPIA, record your lawful basis (normally legitimate interests, supported by a legitimate interests assessment), tell staff before you connect, and check that your client privacy notice covers service providers and AI. We provide a DPIA template and our processor DPIA pack.
Need the paperwork?
We share our data processing addendum and processor DPIA pack with customers and prospective customers. Request the DPA and DPIA pack, or read our sub-processor list and Privacy Policy.