Privacy Policy

Last updated: 15 October 2026

This policy explains how Green & Home Limited (trading as Grafto) collects, uses and protects your personal data when you visit grafto.co.uk. We comply with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Data Controller: Green & Home Limited (trading as Grafto)
Company No. 04204020 · VAT No. 770654321
Belfry House, Bell Lane, Hertford, SG14 1BP
Email: hello@grafto.co.uk

2. What we collect

• Email address — if you contact us or ask about a product.
• AI Tools Assessment answers — if you fill in the assessment questionnaire: your name, contact details, business details and the answers you give. We use them only to prepare and deliver your assessment and to contact you about it, and keep them for up to 2 years unless you become a client.
• Event sign-ups — your name, email and business, used only for the event you registered for.
• Waiting-list sign-ups — your email and which product you asked about. See waiting lists below.
• Anonymous usage data — via Cloudflare Web Analytics, which is cookieless and does not track you across sites.
• Technical data — IP address and browser type, processed by Cloudflare for security and performance.

This marketing site does not use advertising cookies, tracking pixels or Google Analytics. Individual Grafto apps have their own privacy policies covering the data they process.

3. How we use it

To respond to your enquiries, tell you about products you've asked about, and improve the site. Our lawful basis is legitimate interests and, where relevant, consent.

3a. Waiting lists

Some Grafto products are not open yet. If you join a waiting list for one (on this site, or on the Quote Nudge sites, which send sign-ups here):

• What we keep: your email address, the product, the page you signed up on and the date and time. The Quote Nudge early-access forms can also send your name and business name if you give them.
• Why: to email you when that product opens. We will not add you to a newsletter or use your email for anything else.
• Lawful basis: your consent, given by submitting the form. You can withdraw it at any time by replying to any email from us or writing to hello@grafto.co.uk, and we will delete your sign-up.
• How long: we delete your sign-up once we have told you the product is open. The copy we store in Cloudflare is deleted automatically 24 months after you sign up whatever happens. The copy in HubSpot is deleted when you ask us, or in our clean-up of contacts with no activity for two years.
• Where it goes: stored in Cloudflare (our hosting provider). A copy is added to our customer records in HubSpot, and a notification goes to our own inbox through Resend.
• Stopping abuse: to limit repeated sign-ups we keep a one-way hash of your IP address for one hour. We do not keep the IP address itself.

4. Who we share it with

We don't sell your data. We use Cloudflare (hosting, security, cookieless analytics and form storage), HubSpot (our customer records) and Resend (sending confirmation and notification emails). Some of these providers may process data outside the UK under appropriate safeguards.

5. Your rights

Under UK GDPR you can access, correct, delete, or object to the processing of your data. Email hello@grafto.co.uk and we'll respond within 30 days. You can also complain to the ICO.

6. Changes

We may update this policy. The date above always reflects the current version.