Last updated
Who we are
Graft is a trading name of Logicly Ltd, a company registered in England and Wales with company number 08378826. Our registered office is Suite A 82 James Carter Road, Mildenhall, Suffolk, England, IP28 7DE. Logicly Ltd is the controller of the personal data this policy describes. We are registered with the Information Commissioner's Office (ICO), with Graft listed as a trading name.
Data protection enquiries: privacy@graft.bot. For written requests, write to us at our registered office: Logicly Ltd, Suite A, 82 James Carter Road, Mildenhall, Suffolk IP28 7DE.
When we are the processor
When an organisation connects its systems to the Graft platform, that organisation is the controller of the data we process for it, and we act as its processor, on the terms of our agreement with it (our Data Processing Addendum for customers who sign one). If you are an employee, client or contact of one of our customers, that organisation's own privacy notice explains how your data is used, and you should contact it first. If a request about that data reaches us, we pass it on.
What we collect and why
Enquiries and the Graft Devices waitlist
When you use our contact form or join the Graft Devices waitlist, we collect your name, email address, company and message, plus the topic you choose and any optional details you add. We use them to reply and to follow up on your enquiry. We store them in our CRM, Twenty, and send you a confirmation email. For the waitlist, we use them only to contact you about Graft Devices. Our lawful basis is legitimate interests.
Site security
We use your IP address on every form submission to limit abuse. We allow five submissions a minute from one address. The address may also appear in our server logs. Our lawful basis is legitimate interests.
Page views and speed
Vercel Web Analytics and Speed Insights count visits and measure page speed on graft.bot. They do not use cookies and do not identify you across sites. Our lawful basis is legitimate interests.
Error reports
Sentry collects error reports from graft.bot, the dashboard and our API so we can find and fix faults. Our lawful basis is legitimate interests.
Your dashboard account
We hold your name, email address, organisation, role, sign-in method and two-factor settings. They come from you, from your organisation's administrator, or from your Google, Microsoft or company single sign-on provider. We also record your IP address and browser user agent when you sign in, to keep sessions secure and to investigate misuse. Our lawful basis is contract where you are the customer, and legitimate interests where your organisation is.
Billing
If you are a billing contact, Stripe collects your payment details so we can charge usage and send invoices. Stripe holds card details, not us. Our lawful basis is contract, and legal obligation for tax records.
The assessment chat
If your organisation uses Graft's assessment chat, what you type is stored in your organisation's account and sent to an Anthropic model through Vercel's AI Gateway to generate replies. The gateway may serve that model through Anthropic, AWS Bedrock or Google Vertex AI. Every request asks for zero data retention and no prompt training. Your organisation controls that data and we process it for them. Please do not enter client-identifying, privileged or other confidential information into the chat. Transcripts are deleted 90 days after the assessment completes, or 90 days after the last message if it is never completed.
Emails and messages
We keep the emails and messages you exchange with us to run our relationship with you. Our lawful basis is legitimate interests.
We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not sell personal data. We do not use your data, or our customers' data, to train AI models.
Marketing
We send marketing email only with your consent, or to business contacts about similar services where the law allows. Every marketing email will let you opt out.
Who we share it with
These service providers process data on our instructions. This list covers the providers behind this site and the dashboard. The sub-processors page is the full list of companies that handle customer data, including the hosts of AI models.
- Vercel Inc.: website and dashboard hosting, analytics and the AI Gateway.
- Neon (Databricks, Inc.): our database, hosted in London.
- Twenty: our sales CRM for enquiries and waitlist sign-ups.
- Resend, Inc.: sending email.
- Functional Software, Inc. (Sentry): error monitoring.
- Stripe: payments and VAT calculation.
- Anthropic, PBC, through the AI Gateway: the assessment chat.
- Nango, Inc.: only for data your organisation connects to the platform.
We may also share data with our professional advisers and insurers, with regulators or law enforcement where the law requires it, and with a buyer if our business is sold.
Where your data is held
Our database is in London. The sub-processors page says where our application servers run. Some of our providers are in the United States. Where a provider is outside the UK, the transfer is covered by the safeguards in that provider's data processing terms, such as the UK-US data bridge or the ICO's international data transfer addendum.
How long we keep it
- Enquiries and waitlist sign-ups: only as long as needed to respond and follow up, then deleted.
- Dashboard account data: while the account is active. When an organisation is deleted, we delete its data within 30 days, including the accounts of people who belong to no other Graft organisation, which are deleted, or anonymised where another customer's records still name them.
- Assessment chat transcripts: 90 days, as above.
- Server logs and error reports: for the retention period of our hosting and monitoring providers.
- Invoices and billing records: six years after the end of the financial year they relate to, as tax law requires.
Cookies
On graft.bot we may set a language-preference cookie (NEXT_LOCALE) so the site shows your language. Our analytics do not use cookies, and we do not use advertising or tracking cookies. In the dashboard, strictly necessary cookies keep you signed in securely. Because these cookies are strictly necessary or remember a choice you made, we do not ask for consent to them.
Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, and move it to another provider. Where we rely on consent, you can withdraw it at any time.
Email privacy@graft.bot, use the contact form, or write to us at our registered office: Logicly Ltd, Suite A, 82 James Carter Road, Mildenhall, Suffolk IP28 7DE. We reply within one month.
You can complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to help first.
Changes to this policy
We post any change here and update the date at the top. If a change materially affects how we use data you have already given us, we will tell you by email.
Graft is a trading name of Logicly Ltd, registered in England and Wales, company number 08378826. Registered office: Suite A 82 James Carter Road, Mildenhall, Suffolk, England, IP28 7DE.