Privacy Policy

Last updated: 3 August 2026

This policy explains what GraftKit does with your information. GraftKit is operated by Catalyst Bridge Ltd, a company registered in England and Wales (company number 16684771), based in Kinmel Bay, North Wales. For anything in this policy, contact [email protected].

Catalyst Bridge Ltd is the data controller for your account. Where you store your own customers' details in GraftKit, you are the controller of that information and we process it on your behalf.

1. What we collect

What	Why we need it
Your email address and a securely hashed password	To create your account and log you in. We never store your password itself.
Your business profile: your name, business name, phone, address, trade, region, certifications, payment terms and methods, and on Pro your logo and brand colours	To put your details on the quotes and invoices you produce.
The quotes and invoices you create, including line items and totals	To save your history so you can find, re-download and duplicate past documents.
Customer records you create: their name, phone, address and email	To save you retyping them on the next job.
Usage counts, such as how many documents you generated this week	To apply your plan allowance.
Your Stripe customer and subscription reference if you subscribe	To manage your plan, renewals and cancellation.
Your IP address, briefly, when you log in or reset a password	To rate limit sign in attempts and block brute force attacks.

We never see or store your card details. Payments are handled entirely by Stripe. Your card number never reaches our servers.

2. The voice feature, and where your words go

If you use "Talk it out", your device's own browser does the listening. In Chrome and Edge that means the audio is sent to Google's speech recognition service to be turned into text. That happens in your browser, before GraftKit sees anything, and it is governed by your browser's own privacy terms. If you would rather that did not happen, type the quote instead. Everything in GraftKit works without the voice feature.

Once the words are text, we send that text to Anthropic's Claude API so it can pull out the job details and draft your line items. That text may include the customer name, phone number and address you spoke aloud. Anthropic processes it to return the result and does not use it to train their models. We do not send them your email address, your password or your payment details.

3. Our lawful bases

Contract. Running your account, producing your documents, storing your history and taking payment.
Legitimate interests. Keeping the service secure, preventing abuse, and understanding overall usage so we can improve it. We use privacy-friendly analytics that do not identify you.
Legal obligation. Keeping billing records for the period tax law requires.

4. Who else handles your data

Who	What for	Where
DigitalOcean	The server everything runs on	London, UK
Cloudflare	Security and content delivery in front of the site	UK and global edge
Stripe	Taking and managing subscription payments	UK and US
Anthropic	Turning spoken job notes into draft quote lines	US
Google	Speech recognition inside your browser, web fonts, and sending your password reset email	US

We do not sell your data. We do not share it for advertising. Where a provider processes data outside the UK, a lawful transfer mechanism is in place.

5. Cookies and analytics

GraftKit sets no cookies. Visit the site and nothing is written to your browser at all.

Once you log in we store a sign in token and your business details in your browser's local storage. That is what keeps you logged in and lets the app work offline, so it is strictly necessary for the service you asked for.

Our analytics are self-hosted and cookie free. They count page views and do not use cookies, do not track you across other websites, and do not build a profile of you. Because of this there is no consent banner to click.

6. How long we keep it

Your account and its contents: for as long as your account is open.
After you ask us to delete your account: removed within 30 days.
Billing records: six years, because tax law requires it.
Password reset links: one hour, then they stop working.
Free accounts with no activity for 12 months: we may delete them, and we will email you first.

7. Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, send it to another provider, or stop a particular use of it. Email [email protected] and we will respond within one month. There is no charge.

You can delete most of your own data from inside the app at any time. To remove the whole account, email us.

8. Keeping it safe

The site runs over HTTPS. Passwords are hashed with bcrypt and cannot be read by us or anyone else. Sign in attempts are rate limited per IP address. The database sits on a firewalled server that only accepts web traffic through Cloudflare, and our own access is by SSH key only.

If a breach ever puts your rights at risk, we will tell you and the Information Commissioner's Office without undue delay.

9. Children

GraftKit is a tool for running a business and is not intended for anyone under 18. We do not knowingly collect data about children.

10. Changes

If we change this policy we will update the date at the top. If a change materially affects you, we will email you.

11. Complaints

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

12. Contact

Catalyst Bridge Ltd, Kinmel Bay, North Wales. Email: [email protected]