Privacy Policy
Last updated: 2 March 2026
In short: We only collect what's needed to make the app work. We don't sell your data. We don't share it with advertisers. Your business data stays yours.
1. Who We Are
Graft ("we", "our", "us") is a business management app for tradespeople, freelancers, and sole traders. Graft is operated by Calm Routines Studio.
Contact: hello@graftassistant.com
2. What Data We Collect
Account Information
- Email address (for sign-in and password recovery)
- Business name, trade type, and contact details (provided during onboarding)
Business Data
- Client names and contact details you add
- Bookings, invoices, quotes, and expenses you create
- Service menu items and pricing
- Payment records
Device Permissions (Optional)
- Contacts — to import clients from your phone (only when you choose to)
- Location — to show jobs on a map and calculate travel (only when you choose to)
- Microphone — for the voice-to-invoice feature (only when you choose to)
- Camera — to scan receipts or take job photos (only when you choose to)
All permissions are optional and requested only when you use the feature that needs them.
3. How We Use Your Data
We use your data solely to:
- Provide and operate the Graft app
- Store your business data so you can access it across devices
- Send password reset emails when you request them
- Improve the app based on aggregated, anonymised usage patterns
We do NOT: Sell your data, share it with advertisers, use it for marketing, or provide it to third parties for their own purposes.
4. Where Your Data Is Stored
Your data is stored securely using Google Firebase (Cloud Firestore) with encryption in transit and at rest. Google Firebase complies with SOC 1, SOC 2, SOC 3, and ISO 27001 standards. Data is processed in Europe or the United States depending on Firebase's infrastructure.
5. Data Retention
We keep your data for as long as your account is active. If you delete your account, we will delete all associated data within 30 days. You can request data deletion at any time by contacting us.
6. Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Portability — export your data in a machine-readable format
- Objection — object to data processing
To exercise any of these rights, email us at hello@graftassistant.com.
7. Children's Privacy
Graft is not intended for use by anyone under the age of 16. We do not knowingly collect data from children.
8. Third-Party Services
We use the following third-party services:
- Google Firebase — authentication and data storage (Firebase Privacy)
- Expo / EAS — app building and updates (Expo Privacy)
9. Changes to This Policy
We may update this policy from time to time. We will notify you of any material changes through the app or by email. The "Last updated" date at the top will always reflect the latest version.
10. Contact
If you have any questions about this privacy policy or how we handle your data: