Graft – Privacy Policy

Summary

• Your records stay on your iPhone. Receipts, photos, voice notes and every money in and money out entry are kept on your phone. We never see them.
• Only your quarterly totals go to HMRC. When you send a quarterly update, the totals pass through our server to HMRC. We don't keep them.
• No account, no adverts, no tracking. Graft has no sign-up of its own, contains no advertising or analytics software, and we never sell or share your information for marketing.
• The reading happens on your iPhone. Receipts and voice notes are read by Apple's on-device features, not sent to an AI service.

Who we are

Graft ("the app") is published by Digitalhope Ltd ("we", "us"), a company registered in the United Kingdom. We are the data controller for the information described here. Contact: support@digitalhopeltd.com.

What stays on your iPhone

These are stored in the app's private storage on your iPhone and never leave it through Graft:

• photos and scans of receipts, and files you share into Graft
• voice notes and their transcripts
• your money in and money out records, categories, notes and edit history
• your business details, including your trade and your National Insurance number
• copies of the quarterly updates you have sent and the receipts HMRC gives you back

Receipt files are saved with the strongest file protection iOS offers. Your iPhone's own backups may include Graft's records; those are covered by Apple's privacy policy and your iCloud or computer settings. Graft does not sync to iCloud.

If you add Graft's widgets or its Live Activity, your quarter's totals (such as profit and the amount to set aside) and the next deadline appear on your Home Screen or Lock Screen.

Reading receipts and voice notes

Graft reads receipts with Apple's on-device text recognition, transcribes voice notes with Apple's on-device speech recognition, and uses Apple's on-device language model to suggest the amount, date, category and who was paid. All of this happens on your iPhone and nothing is sent to us, to Apple or to any AI service. The first time you log a job by voice, your iPhone may download Apple's English speech model; nothing you say is sent with it.

Your HMRC connection

Graft has no account of its own. When you choose to connect to HMRC, you sign in on HMRC's own Government Gateway page; Graft never sees your user ID or password. HMRC then gives our server a token that lets Graft act for you. We keep that token encrypted on our server so you don't have to sign in every time, together with a scrambled (hashed) copy of the key your iPhone uses to reach it and the dates it was created and last used. The key itself is kept in your iPhone's secure Keychain and is not synced to your other devices.

What passes through our server to HMRC

When Graft checks your deadlines or sends a quarterly update, the request goes from your iPhone through our server to HMRC. It carries:

• your National Insurance number and HMRC business ID, which HMRC needs to find your records
• the tax year and dates being asked about
• your quarterly totals: income, and expenses either as one total or by HMRC category depending on your turnover

Our server passes these to HMRC and passes HMRC's reply back to your iPhone. It does not store them.

Fraud-prevention information HMRC requires

HMRC requires every Making Tax Digital app to send information that helps it detect fraud with each request. Graft sends:

• a random device ID and a random Graft user ID, created on your iPhone (not Apple's advertising or vendor identifiers)
• your iPhone's time zone and the local IP addresses of its network connections
• your public IP address and port, as seen by our server
• your iPhone model, iOS version, screen size, scale and colour depth, and the size of the app's window
• the version of Graft, and our server's own IP address and product name

This information goes to HMRC only and is not used for anything else.

Purchases

Recording your income and expenses is free. Sending updates to HMRC needs Graft Pro, an optional auto-renewing subscription sold through the App Store. Apple handles payment and we never see your card details. Graft checks on your iPhone whether you have an active subscription; our server doesn't receive your purchase details. You can manage or cancel the subscription in your Apple account settings.

Technical information

To keep the service secure and working, our server keeps short logs that record the kind of request, HMRC's response code and a reference for fault-finding. National Insurance numbers and business IDs are removed before anything is logged, and amounts are never logged. The logs are overwritten automatically as new ones are written.

The app contains no analytics, advertising or crash-reporting software, does not track you across other apps or websites, and does not use cookies. If you test a pre-release version through TestFlight, Apple may share crash reports and any feedback you choose to send with us.

Who we share information with

• HMRC receives your quarterly totals, identifiers and the fraud-prevention information when you send an update or Graft checks your deadlines. HMRC's own privacy notice then applies to what it receives.
• DigitalOcean hosts our server in London, United Kingdom, and acts only on our instructions.
• Apple handles App Store payments and subscriptions under its own privacy policy.

We do not sell personal data and do not share it with anyone else unless the law requires us to. Anything you choose to share yourself, such as an export sent to your accountant, goes wherever you send it.

Where your information is kept

Your records are on your iPhone. Our server and the encrypted HMRC connection are in the United Kingdom.

How long we keep information

• Your records stay on your iPhone until you delete them or remove the app. Entries can be deleted until they have been sent to HMRC.
• Your HMRC connection stays on our server until you disconnect in Settings, which deletes it straight away, or until HMRC ends it (HMRC allows up to 18 months before you must connect again). If you remove Graft without disconnecting first, email us and we will delete it.
• Server logs are overwritten as new logs are written.
• A few random identifiers kept in your iPhone's Keychain (the device and user IDs and the key to your HMRC connection) can remain after the app is removed. They contain no personal details.

Keeping your records is your responsibility. HMRC requires you to keep business records for at least five years after the 31 January submission deadline for each tax year. Keep your iPhone backed up and use Export for your accountant in Settings to save a copy. Records that have been sent to HMRC can't be changed in Graft.

Our legal basis

Under UK data-protection law we process this information to provide the app you have asked for (performance of a contract), to send the fraud-prevention information HMRC requires (legal obligation), and to keep the service secure and working (legitimate interests).

Your rights and controls

Most of your information is only on your iPhone, where you control it. Export for your accountant saves your records for a tax year as a spreadsheet and a PDF, Disconnect from HMRC deletes our copy of your connection, any entry that hasn't been sent to HMRC can be changed or deleted, and removing the app deletes the records on your phone. You also have the right to ask us for a copy of the personal data we hold, to correct it, to delete it, to receive it in a portable form, or to object to how we use it. Email us at the address above and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Permissions

Graft asks for these only when a feature first needs them, and you can change them at any time in the Settings app:

• Camera, to scan receipts.
• Microphone and speech recognition, to log jobs by voice, transcribed on your iPhone.
• Notifications, to remind you of deadlines. Reminders are scheduled on your iPhone.
• Face ID, to confirm it's you before sending an update to HMRC, and to unlock Graft if you turn on the app lock. Face ID is handled by iOS and Graft never receives your face data.

Graft does not ask for your location, contacts or photo library.

Security

Everything between Graft, our server and HMRC is encrypted in transit, your HMRC connection is encrypted on our server, and you can turn on the app lock in Settings.

Children

Graft is for people running a business and isn't meant for anyone under 18.

Changes to this policy

If the app changes in a way that affects your privacy, for example adding iCloud sync, this page will be updated and the effective date changed before the update is released. If a change affects what leaves your iPhone, the app will tell you first.