Privacy Policy
Last updated: 29 July 2026
Who we are
Graftline provides an automated phone answering service for UK tradespeople. We are the data controller for account data, and a processor of call data on behalf of the tradesperson whose calls we answer. Contact: contact@graftline.co.uk.
What we collect
- Account data (tradespeople): business name, trade, phone number, email, and payment details. Payments are handled by Stripe — we never see your full card number.
- Call data (callers): when you ring a business that uses Graftline, we process the call audio, a transcript, the details you give us about your job (name, callback number, postcode, description), and your phone number. Calls are recorded — you're told this at the start of every call.
- Usage data: call minutes and outcomes, used for billing and the business's own reporting.
Why we process it (legal bases)
We process account data to perform our contract with the tradesperson (UK GDPR Art. 6(1)(b)). We process call data in the legitimate interest of the tradesperson taking your job enquiry (Art. 6(1)(f)) — exactly as a human receptionist would. Recording disclosure is given on every call in line with PECR and ICO guidance.
Where it goes
Call audio is processed by our voice technology providers (including Retell AI and ElevenLabs), which may involve processing in the United States under the UK–US Data Bridge and standard contractual clauses. Job details are delivered to the tradesperson you were trying to reach, by WhatsApp or SMS and their dashboard. We never sell personal data, full stop.
How long we keep it
Call recordings and transcripts: 90 days, then deleted. Job details: kept while the tradesperson keeps their account, as their business records. Account data: deleted within 30 days of account closure, except invoices we must keep for tax law.
Your rights
You can ask for a copy of your data, correction, or deletion at any time — email contact@graftline.co.uk and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the ICO (ico.org.uk).
Security
Data is encrypted in transit and at rest. Access is restricted, and recordings live in private storage. We don't put personal data in logs.