Privacy notice

For your account (your name, email, login and billing) [LEGAL ENTITY NAME] ([Registered number and registered office address]) is the controller.

For the personal data of your clients and contacts that you put into Acraft, you are the controller and we are your processor: we handle it only on your instructions and to run the service.

• Account data: name, email, password (stored hashed), workspace and team members.
• Business data you enter: clients, enquiries, jobs, schedules, quotes, invoices, notes, photos, documents, voice and video recordings.
• Usage and device data: pages used, errors and approximate technical details, to keep the service working and improve it.

• To provide the service you signed up for (contract).
• To secure the service, prevent abuse and fix faults (legitimate interests).
• To send service emails such as verification, reminders and the documents you send to clients (contract).
• To improve our AI using anonymised quotes (legitimate interests; you can opt out, see below).
• To meet legal duties such as tax record keeping (legal obligation).

AI features send the text, images, documents and recordings you submit, and the parts of your workspace needed to answer (such as your price list), to AI model providers acting as our processors. They process it to produce the answer and may not use it for their own purposes.

When you send a quote drafted by the AI, we store an anonymised record of the request, the draft and the final quote to improve our models, including fine-tuning. Names, companies, emails, phone numbers and addresses of your clients, site addresses and your team’s names are removed automatically before storage. Free-text details can occasionally slip through. Photos, videos and audio files are not part of this record, only text derived from them.

To opt out, write to [privacy contact email]. We stop recording and delete what we hold for your account.

Only service providers that help us run Acraft: hosting and storage, email delivery, AI model providers, error and usage monitoring, and accounting integrations you connect yourself (such as Xero). We do not sell personal data.

Some providers are outside the UK. Where they are, we rely on an adequacy decision or the UK international data transfer safeguards.

• Account and business data: while your account is open, then deleted within a reasonable period after closure.
• Invoices and accounting records: as long as tax law requires, normally six years.
• Anonymised AI improvement records: until you opt out or we retire the dataset.

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw an opt-in you gave. Write to [privacy contact email]. If you are a client of one of our customers, contact that business first; we will help them respond.

You can complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handled your data.

Data is encrypted in transit, access is limited to the team that needs it, and passwords are stored hashed. No system is perfectly secure; if a breach puts your data at risk we will tell you and the regulator as the law requires.

If we change this notice materially we will tell you before it applies.