Plain-English privacy policy.
Graft Systems is a founder-led business in Northern Ireland. This page says what we collect on this website, why, who helps us process it, and how to have it removed. No tricks, no wall of legalese.
What we collect
Enquiry details. When you send the free-check form or contact us: your name, business name, website, the contact details you choose to give, and anything you write in the message.
Lead-source data. We record where an enquiry came from — the referring site, campaign tags on the link you clicked, and a first-party cookie (90 days) that remembers that source if you come back later. This is the same honest source-tracking we sell: it tells us, and our clients on their own sites, which channel an enquiry came from. It is not used to follow you around the internet.
Analytics — cookieless page counting only. We use Vercel Web Analytics to count page visits in aggregate. It sets no cookies, stores nothing on your device, and holds no personal data — we can see that pages were visited, never who visited them — so it runs without needing your consent and identifies nobody. The cookie banner still governs everything that DOES use cookies: consent-gated Google tracking loads only if you choose “Accept all”. Choosing “Essential only” means no cookie-based analytics and no lead-source cookies — essential cookies are just the ones needed to run the site.
What we do with it
We use your details to reply to your enquiry, run the free check you asked for, and provide the service if you become a client. We do not sell your data, share it with advertisers, or add you to mailing lists you didn’t ask for.
Who processes it for us
Like most small businesses we use a few reputable services to run things: Vercel (website hosting), Supabase (the secure database where enquiries are stored) and Resend (email delivery for enquiry notifications). Each processes data only on our instructions.
Anthropic (Claude). When an enquiry arrives, we send its details to Anthropic’s API to draft a suggested reply for us to review — never to reply to you automatically. What gets sent: your name, the job type, your rough location, where the enquiry came from, and your message. Your phone number and email address are not sent — the system only says whether you left one. Anthropic processes it on our instructions and does not use it to train their models. If you’d rather we didn’t do this with your enquiry, say so in the message or email us and we’ll handle it by hand.
How long we keep it
Enquiry records are kept while they’re useful for the purpose you sent them — responding to you and, for clients, showing honestly where work came from. Part of our system keeps a tamper-proof log of enquiries so source claims can be audited; on a removal request we redact your personal details from our working records and anything we can lawfully remove.
Your rights — and who to ask
You can ask what we hold about you, ask for a copy, ask us to correct it, or ask us to remove it. Email paul@graftsystems.co.uk — you’ll get a personal reply, normally within one working day. If you’re not happy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).
Last updated: July 2026.