Version 2026-07-21
Capstone Software Ltd ("we") is the controller of the personal data you provide when you
use Graft. This policy explains what we collect and why.
statements, invoices, business details (including UTR, National Insurance
number and VAT number where you provide them for invoicing and MTD).
providers, stored encrypted and used only to provide the features you turn on.
business trips; you control this permission and can turn it off at any time.
To provide the Service you asked for: keep your records, calculate figures,
produce invoices, and — on your instruction — submit to HMRC and sync with the
services you connect. We use security data to protect your account. We do not
sell your personal data.
We share data only with: the third parties you connect (e.g. HMRC, Xero, your
bank, our payment processor), your accountant if you link one, and the
infrastructure providers that host the Service, all under appropriate
safeguards. We disclose data if the law requires it.
We keep your records while your account is active and for as long as we are
required to (for example, tax record-keeping periods). You can export your data
and ask us to delete your account, subject to any legal retention we must apply.
Under UK data protection law you can ask to access, correct, export or delete
your personal data, and object to certain processing. Contact us through the
app or website to exercise these rights. You can also complain to the
Information Commissioner's Office (ico.org.uk).
Capstone Software Ltd — via the app or the website contact page.