Privacy Policy

Who We Are

GraftDesk Construction AI is a sole trader business operated by Ross Sweeney, based in Devon, UK. We provide done-for-you RAMS documents, quotes, tenders and invoice chasing services for UK construction and trades businesses.

Contact: ross@graftdesk.co.uk | graftdesk.co.uk

For the purposes of UK GDPR and the Data Protection Act 2018, Ross Sweeney (trading as GraftDesk Construction AI) is the data controller.

What Data We Collect

We collect and process the following types of personal and business data:

• Your name and job title
• Your business name and address
• Your business email address and phone number
• Job and site details you provide when requesting a document
• Payment information (processed securely via Stripe — we do not store card details)
• Communications between you and GraftDesk

How We Collect Your Data

We collect data in the following ways:

• When you submit an enquiry via our website contact form
• When you email us directly at ross@graftdesk.co.uk
• When you make a payment via Stripe
• Through legitimate business outreach — where we identify your business as a potential client based on publicly available information and contact you because our services are directly relevant to your trade

Why We Process Your Data — Legal Basis

We process your data under the following lawful bases under UK GDPR:

• Contract: To deliver the documents and services you have paid for or requested
• Legitimate Interests: To contact UK construction businesses about our services where those services are directly relevant to their business operations. We have assessed that our legitimate interest is not overridden by your rights, as we only contact businesses in the relevant trades and always provide a clear opt-out
• Legal Obligation: To comply with financial and tax record-keeping requirements

How We Use Your Data

We use your data to:

• Deliver RAMS documents, quotes, tenders and other requested services
• Communicate with you about your order or enquiry
• Send you relevant information about GraftDesk services (you can opt out at any time)
• Process payments via Stripe
• Comply with legal and tax obligations

We do not sell, rent or share your data with third parties for marketing purposes.

Cold Email Outreach — Your Rights

GraftDesk conducts B2B cold email outreach to UK construction businesses under the legitimate interests basis permitted by PECR (Privacy and Electronic Communications Regulations) and UK GDPR.

Every marketing email we send includes a clear opt-out instruction. If you wish to stop receiving emails from GraftDesk:

We maintain a suppression list of all opt-out requests and check it before any new outreach is sent.

Data Retention

We retain your data for the following periods:

• Client records: 6 years from the end of the business relationship (required for tax purposes)
• Enquiry data: 12 months from last contact, unless you become a client
• Opt-out records: Indefinitely, to ensure we never re-contact you
• Payment records: 6 years (legal requirement)

Third Parties We Use

We use a small number of trusted third-party services to operate GraftDesk:

• Stripe — payment processing (stripe.com/gb/privacy)
• Zoho Mail — business email (zoho.com/privacy)
• Tally — website enquiry forms (tally.so/privacy)
• Calendly — call booking (calendly.com/privacy)
• Netlify — website hosting (netlify.com/privacy)
• Anthropic (Claude) — AI document generation (anthropic.com/privacy)

Each of these services has their own privacy policy and data protection measures. We only share the minimum data necessary with each provider.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — ask us to delete your data (subject to legal obligations)
• Right to restrict processing — ask us to limit how we use your data
• Right to object — object to processing based on legitimate interests
• Right to data portability — receive your data in a portable format

To exercise any of these rights, contact us at ross@graftdesk.co.uk. We will respond within 30 days.

Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113

We would always prefer to resolve any concerns directly — please contact us first at ross@graftdesk.co.uk.

Contact Us

For any privacy-related queries, data requests or opt-out requests: