Privacy and cookies.

Who we are

This website is run by Graft Marketing, the trading name of Gavin Scothorn. We are the controller of the personal data we collect through it, which means we decide how it's used and we're responsible for looking after it.

Our studio is Dovecote Studio, Dovecote Barn, Wood Lane, Hanbury, Burton upon Trent, Staffordshire DE13 8TG. For anything about your data, email newbiz@graftmarketing.co.uk and Gav will deal with it personally.

This policy covers this website and the enquiries that come through it. It's written in plain English on purpose. If anything isn't clear, ask us.

What we collect

The contact form. Your name, email address, business name, message, rough budget and, if you tell us, how you heard about us. The form is handled by Netlify Forms, part of Netlify, the company that hosts this website. Netlify is based in the US and stores submissions on its servers in the US and the EU.

The free AI visibility check. Your business name, what you do, your town, your website if you give it, your email address, your name if you give it, and whether you said we can email you about the result. There is more on the check in its own section below.

Emails you send us. If you email us, we keep the email and your contact details so we can reply and keep a record of the conversation.

How you use the site. Only if you accept analytics or marketing cookies (see below). If you say no, we collect nothing about your visit beyond the basic server logs Netlify keeps to run and protect the site.

We don't ask for, and don't want, sensitive information such as health details. Please don't put it in the form.

The free AI visibility check

What happens when you run it. We read the public pages of the website you give us (the homepage, robots.txt, llms.txt and sitemap.xml), and we ask an AI assistant two questions about your business: who it would recommend for your trade in your town, and what it knows about your business. Then we score what came back and show you the report.

Who the AI assistant is. The questions are answered by an AI service provider we use under contract. It receives your business name, what you do, your town and your website address, and searches the web for them. It does not receive your email address or your name.

What we keep. Your details and the full report (the score, what the AI assistant said, the websites it used and the website checks) are saved in Netlify Blobs, storage that is part of Netlify, and the form comes through to us by Netlify Forms. To stop the check being misused we also keep a count of checks run from each connection for a day, using a scrambled (hashed) version of your IP address, never the address itself.

Emails. We only email you about your result if you tick the box to say we can, and every email lets you say no more. We never add you to a mailing list without asking. If you ask us to run the check by hand (for example when the day's automatic checks are used up), we'll email you the result you asked for.

Your choice. The check is free and you never have to buy anything. If you want your report or details deleted before the 12 months are up, email us.

Why we use it, and the lawful basis

To reply to your enquiry and prepare a proposal. If you ask us about working together, we use your details to take steps you asked for before a contract. For general questions, we rely on our legitimate interest in answering people who get in touch.

To do the work, if you become a client. We use your details to deliver what we agreed (the contract) and to keep proper records for tax and accounting (a legal obligation).

To run the free AI visibility check and show you the report. Our legitimate interest in providing the check you asked for, and in knowing who used it so we can answer questions about it. Keeping a hashed count of checks per connection is our legitimate interest in stopping misuse.

To email you about your AI visibility check. Only with your consent: the box on the form, which is unticked until you tick it. You can withdraw it at any time.

Cookies for analytics and marketing. Only with your consent, which you can withdraw at any time.

Marketing emails. We don't send them unless you've said yes. If you do, every email has an unsubscribe link.

Cookies

Cookies are small files a website stores on your device. The law (the Privacy and Electronic Communications Regulations, or PECR) says we need your permission for any that aren't strictly needed to run the site. So nothing below is switched on until you say yes.

Strictly necessary: none. The site works without any cookies. We remember your cookie choice on your own device so we don't ask you on every page. That record isn't sent to us.

Analytics: Google Analytics 4, only if you accept. It tells us which pages people visit, how they found us and roughly where they are, so we can see what's useful and what isn't. It sets cookies that start with _ga, which last up to two years. Google provides it and we see the figures in aggregate, not who you are.

Marketing: Meta Pixel, only if you accept. It tells Meta (Facebook and Instagram) that you visited, so we can measure our ads there and show them to people likely to be interested. It sets a cookie called _fbp, which lasts up to 90 days. Meta may link this to your Facebook or Instagram account under its own privacy policy.

Changing your mind. Click "Cookie settings" at the bottom of any page to accept or turn off analytics and marketing cookies whenever you like. Turning them off stops them from then on. You can also clear cookies in your browser settings.

Who we share it with

We never sell your data, and we don't pass it to anyone to market to you. We only share it with the few companies that help us run the business:

Netlify, which hosts this website, receives the contact form and the AI visibility check form, and stores the check results.

An AI service provider, which answers the AI visibility check questions. It receives your business name, what you do, your town and your website address, not your email or your name.

Google, for Google Analytics, if you accept analytics cookies.

Meta, for the Meta Pixel, if you accept marketing cookies.

HubSpot, the CRM we keep client and project records in, if you become a client.

Our accountant, for invoices and tax records, if you become a client.

Each one handles your data under a contract that says how it must be looked after. We'd also share information if the law required it.

International transfers

Netlify, our AI service provider, Google, Meta and HubSpot are US companies, so some of your data may be stored or accessed outside the UK. When that happens it's protected in one of the ways UK law allows: a country the UK has approved as adequate (such as the EU, or US companies certified under the UK Extension to the EU-US Data Privacy Framework), or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

Enquiries that don't become work: 24 months from our last contact, so we have the context if you come back to us. Then we delete them.

AI visibility checks: 12 months from the day you ran the check. Then the report and your details are deleted automatically. If the check became a conversation about working together, the enquiry rule above applies from then on.

Client records: 6 years after the end of the financial year the work was in, because the tax rules say we have to keep them.

Analytics data: Google Analytics keeps it for 14 months, then deletes it.

If you ask us to delete something sooner, we will, unless the law says we have to keep it.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us to:

See the personal data we hold about you (access).

Correct anything that is wrong or incomplete.

Delete your data.

Stop or limit how we use it, including objecting to anything we do on the basis of legitimate interests.

Give you a copy in a common format, or send it to someone else (portability).

Email newbiz@graftmarketing.co.uk. It's free, and we'll reply within one month. If you're unhappy with how we've handled your data, tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

If we change how we use your data, we'll update this page and the date at the top. If it's a big change that affects you directly, we'll tell you.