Last updated: 28/07/2026

Graft ("we", "us", "our") is a marketing tool for UK small business owners — trades, cafés, salons, ecommerce and more — currently in early access. This policy explains what information Graft collects, why, and what choices you have.

Who we are

Graft is provided by Graft AI Marketing Ltd. If you have questions about this policy or how your data is handled, contact us at hello@startgrafting.com.

What we collect

‍Account and business information you give us directly: your name, email address, business name, trade/category, and any brand details you enter during setup (tone of voice, target audience, proof points — what we call your "Brand Brain").

‍Google Business Profile data, if you choose to connect it: your business name, category, services, location, opening hours, photos, and customer reviews. We access this only after you explicitly connect your account via Google's own sign-in flow, and only to help generate relevant marketing content and surface opportunities worth posting about.

‍Instagram and Facebook Page data, if you choose to connect them: your Page and Instagram Business account details, and, once you approve a post, the content needed to publish it on your behalf. We request only the specific permissions needed for this (publishing, reading engagement, managing comments) — never more than the feature actually uses.

‍Photos and notes you upload of completed work, which Graft uses to generate captions, updates, and content ideas.

‍Generated content, including drafts Graft creates and your approval/edit history, so you can see what was suggested, what you approved, and what changed.

We do not collect payment information at this stage, as billing is not yet active during early access.

How we use it

To generate marketing content in your business's own voice, to surface opportunities (like a good review worth posting about), and to let you review and approve that content before anything is shared publicly. Today, nothing is published on your behalf without you approving it first — this is the first stage of a trust journey we're building towards, where Graft will eventually be able to work more independently in the background so you can hand your marketing off entirely. We'll always be clear about which stage is active on your account, and any move to greater autonomy will be something you choose, not something that happens by default.

We also use it to operate and improve the product itself, and to communicate with you about your account.

Who we share it with

We share data with the third-party services Graft integrates with, strictly to provide the feature you've connected:

‍Google, for Google Business Profile access (read and, where you approve an update, write).

‍Meta, for Instagram and Facebook Page access (read and, where you approve a post, publish).

‍Our AI content-generation provider (currently OpenAI's API), which processes your Brand Brain details and job notes/photos to draft captions and content. This provider does not use your data to train their models under the terms we operate under.

‍Our infrastructure providers (e.g. Supabase, our database/backend host), who store your data on our behalf under standard processor agreements.We do not sell your data, and we do not share it with advertisers.

How long we keep it

We keep your account and content data for as long as your account is active, plus a reasonable period afterwards in case you reactivate or as required for legal/accounting reasons. If you delete your account, see "Deleting your data" below.

Your rights

If you're in the UK or EU, UK GDPR / EU GDPR gives you the right to access the personal data we hold about you, correct it, delete it, restrict or object to certain processing, and receive a copy in a portable format. To exercise any of these, email hello@startgrafting.com. We'll respond within one month, as required by law.

Children

Graft is a business tool and is not directed at or intended for use by children.

Changes to this policy

We'll update the "last updated" date above if this policy changes, and, for material changes, let active users know directly.

If you'd like Graft to delete your data — whether you're closing your account or simply want your information removed — email hello@startgrafting.com with the subject line "Data deletion request" from the email address associated with your account.

Once we receive your request, we will:

Confirm receipt within 5 working days.

Delete your account data, uploaded photos, generated content, and any connected-account tokens (Google, Instagram, Facebook) from our systems within 30 days.

Confirm once deletion is complete.

Deleting your Graft account does not disconnect or affect your underlying Google, Instagram, or Facebook accounts directly — you may also want to review and revoke Graft's access from within those platforms' own security/app settings.

If you connected Graft via Facebook or Instagram Login, you can also remove Graft's access at any time directly from Facebook (Settings → Business Integrations) or Instagram (Settings → Apps and Websites → Active), independently of contacting us.