Privacy
Plain English. Last updated 25/09/2026.
Who we are
Grafto runs grafto.pages.dev and is the data controller for your account. Questions or requests: the email address we will publish here shortly. We reply within one month.
What we keep and why
| Data | Why | Lawful basis | How long |
|---|---|---|---|
| Email, hashed password or Google/Apple sign-in ID | Your account and signing in | Contract | Until you delete your account |
| Jobs, quotes, diary, invoices, receipts, settings | Running Grafto for you and syncing your phones | Contract | Until you delete them or your account |
| Photos you add | Your job record and, if you ask, the photo prep check | Contract | Until you delete them or your account |
| Sign-in session | Keeping you signed in | Contract | 30 days, or until you sign out |
| Hashed email and IP counters | Stopping password guessing | Legitimate interests (security) | About 2 hours |
| Daily photo-check count | Fair use of the free AI allowance | Legitimate interests | 2 days |
| Photo-check results (not the photos) | Not re-checking the same photos | Legitimate interests | 30 days |
We don't sell data, show adverts, build profiles, or use analytics or tracking of any kind.
Your customers' details
Names, addresses and numbers you enter for your customers are yours: you are their data controller, and Grafto stores them for you as your processor, only to run the app. You need your own reason to hold them (usually, to quote for and do the work they asked for).
Who processes it for us
- Cloudflare hosts the site, the database and the photo check (Workers AI). Cloudflare's network can include the US; transfers are covered by the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses.
- Google Gemini or Groq check photos only if we switch them on as a backup AI provider.
- Google or Apple handle sign-in only if you choose "Continue with Google" or "Continue with Apple".
- postcodes.io and planning.data.gov.uk receive a postcode you enter (nothing else) to find the region and planning constraints.
Fonts, icons and scripts come from our own domain, so loading a page sends nothing to anyone else.
Photos
Photos are shrunk on your phone before upload, which strips location data. Don't photograph people, number plates or paperwork. The AI only picks conditions from a fixed list for your trade: it never sets a price, and it never decides anything about you or your customer on its own.
Cookies and storage
One strictly necessary cookie (grafto_session) keeps you signed in. The app also keeps a copy of your work on your phone so it opens without signal, and remembers sun mode. There are no advertising or analytics cookies, so there's no cookie banner.
Your rights
You can see, correct, download or delete your data, and object to how we use it. Download everything from Settings → Your data. Delete your account from Settings → Account and it's removed from the live database straight away. If you're unhappy with how we handle your data, tell us first; you can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Passwords are salted and hashed, sign-in cookies are HttpOnly and Secure, every page is served over HTTPS with a strict content security policy, and your data is private to your account.
Age
Grafto is a business tool for adults. It isn't for anyone under 18.
Changes
If this notice changes in a way that matters, we'll tell you in the app before it applies.