Privacy Policy

We are the controller, meaning we decide how and why data is used, for:

• account and organisation data of builders and their team members, and team invitations;
• product analytics, and security and technical logs;
• our record of people who message our WhatsApp number without having connected it to a Gromatik account;
• content we use to improve the accuracy of Gromatik (see below).

For data about a builder's clients, the builder (our customer) is the controller and we are their processor. This covers projects, uploaded plans and photos, quotes, what clients do on a quotation link, and WhatsApp quote requests a builder received before 4 November 2026. We handle it only on the builder's instructions, under our Data Processing Agreement. Builders must give their clients their own privacy information.

We have not appointed a Data Protection Officer, as the law does not require one. You can reach us at contact@gromatik.ai.

Account. Your full name, email address and password (stored in hashed form by our authentication provider). Also your role, the organisations you belong to, your usage-statistics setting, and when you accepted our Terms.

Organisation. Company name, address, company or VAT number, trade, region and measurement units. Also your logo, signature image, quote disclaimer, and contract template. For a sole trader, this is personal data.

Your work. Projects, quotes, contracts, uploaded files, exports, price lists, supplier catalogues and saved versions. Also your AI chats (when you describe a job, and in the AI Assistant), including dictated text, and your replies to clients on a quotation link, which show your name.

WhatsApp. If you connect WhatsApp: your number and WhatsApp profile name, when you connected and last used it, your messages and button taps to our WhatsApp assistant and its replies, the photos and PDFs you send it, and the changes it suggested and whether you applied them.

Activity. Who did what and when in your organisation, such as sending a quote or inviting a member. For each AI quote generation we record who ran it, the quote, timings and the outcome, but no content.

Technical. Essential cookies, technical logs, and analytics if you consent.

Support. If you email us: your name, email address and what you tell us.

You give us this data, or your organisation's owner does. An account needs a name, email address, password and, for a new organisation, a company name. Without them we cannot provide the service.

An organisation owner can invite you by entering your email address and a role, so we receive your email address from them. The invitation link works for 14 days. We do not currently send invitation emails; the owner passes the link to you. If you accept, the section above applies.

Our lawful basis is legitimate interests: letting customers add their team. A cancelled invitation is deleted. Otherwise the invitation (your email address, role and who invited you) is kept after it expires or is accepted, and a note of it stays in the activity history, until the organisation is erased.

If a builder uses Gromatik to quote for you, the builder decides how your data is used and we process it for them. Please read the builder's privacy information and send requests about your data to them. If you write to us, we will pass your request on to the builder.

We receive your data from the builder: your name, contact details and property address, notes about the job, and plans, drawings and photos. Quotes, contracts and exports made for you show your name and address. Our AI may read a site address printed on a drawing to fill in the property address.

If the builder sends you a quotation link, we record for them:

• how many times the link was viewed and downloaded, and when it last was (not who viewed it, and not your IP address);
• your messages, with any name you give;
• if you decline, your reason and any name you give;
• if you accept, the name you type (optional), the date and time, your IP address and a copy of the quote as accepted. This is the builder's evidence of what you agreed.

The link sets no cookies for you, and our analytics tools collect nothing from it. We count downloads, acceptances, declines, messages and contract views against the builder's account, with no details about you.

Our WhatsApp number is an assistant for builders who use Gromatik. It no longer takes quote requests from homeowners.

If you are a Gromatik user, you connect your WhatsApp in Settings → Profile by sending a one-time code from your number and confirming with a tap. We then keep your number, WhatsApp profile name, your messages and button taps, the photos and PDFs you send, and our replies, as part of your account. To answer you, our AI receives your messages and the quotes they are about, but not your WhatsApp number or name (see the AI section). Only you can read your WhatsApp conversation in Gromatik; your colleagues, owners included, cannot. Files you add to a quote become part of that quote. Nothing on a quote changes until you tap Apply, and nothing is sent to a client until you tap Send. You can disconnect at any time in Settings → Profile, or by sending *disconnect*.

Anyone else, including homeowners using an old quote-request link (starting GK-): we reply at most once every ten minutes to say how the number works, and do not keep what you send. We keep only a record of your number, WhatsApp name and when you messaged. We are the controller of that record, and our lawful basis is legitimate interests: running the number and preventing misuse.

Messages pass through Meta's WhatsApp Business Platform, and WhatsApp's own terms and privacy policy apply to your use of WhatsApp. To have our record of your number deleted, write to contact@gromatik.ai with your number. A quote request you sent a builder before 4 November 2026 stays in that builder's account; ask them about it.

• Providing the service: accounts, organisations and teams; storing your work; drafting quotes with AI; the AI Assistant, in the app and on WhatsApp; quotation links; exports; account emails. Basis: contract (our Terms) where you are our customer, such as a sole trader. Otherwise legitimate interests: providing the service your business or organisation signed up for. For your clients' data, we act on your instructions.
• Security and fair use: sign-in, idle sign-out, keeping each organisation's data separate, preventing misuse, the monthly AI-generation limit, and investigating problems from logs. Basis: legitimate interests in a secure, reliable and fairly shared service.
• Activity history: showing your team who did what, and keeping evidence of what a client was sent and accepted. Basis: legitimate interests in accountability and reliable records. For clients' data, we act on the builder's instructions.
• Running the service: an internal overview of each organisation (name, counts of members, projects and quotes, AI use, last activity), and counting quotation-link events per organisation. Basis: legitimate interests in operating and improving the service.
• Support: answering your emails. Basis: contract, or legitimate interests for non-customers.
• Product analytics: understanding how the app is used, only if you choose Accept all. Basis: consent.
• Improving accuracy (next section), and running our WhatsApp number for people who have not connected an account (above). Basis: legitimate interests.
• Legal duties and claims: complying with the law and lawful requests from authorities, and establishing or defending legal claims. Basis: legal obligation, or legitimate interests in protecting our rights.

We have weighed these legitimate interests against your rights and interests. You can object at any time (see Your rights). We do not send marketing emails.

Our customers permit us, under our Terms and Data Processing Agreement, to use uploaded content and quotes to test and improve the accuracy of the service. For example, we re-run our tools on real drawings to check how well they read room areas and quantities. We de-identify this material where practicable and use it solely for this purpose.

For this use we are the controller, relying on our legitimate interest in making the service more accurate. We keep test copies secure and confidential. We never sell them or share them with anyone for their own use, and we never use them to train third-party AI models. We keep them only while that testing needs them, and delete them when the organisation they came from is erased.

Builders can opt out, and anyone whose data is involved can object, by writing to contact@gromatik.ai. We will then stop.

We use OpenAI models, through Vercel's AI Gateway, to read uploaded documents and supplier price lists automatically and to draft quotes. To draft a quote, the AI receives the job description, what it read from the files and the file names. The AI Assistant, in the app and on WhatsApp, receives the quote and the conversation, and the contents of the quote's documents when it reads them. Client names and contact details typed into a project are not sent to the AI, but anything printed on an uploaded document is.

The AI produces a draft; a person decides. You review and edit it. AI Assistant changes apply only when you approve them (on WhatsApp, by tapping Apply), and a quote goes to a client only when you send it. We make no decisions based solely on automated processing that have legal or similarly significant effects on anyone.

Dictation. The microphone button uses your browser's own speech service (Google in Chrome, Microsoft in Edge, Apple in Safari), under that provider's terms and possibly outside the UK. It is not our sub-processor and the audio never reaches us. We receive the text only when you press send.

Essential cookies keep you signed in, sign you out after 60 minutes without activity, and remember your cookie choice for 12 months. We also remember display preferences you choose, such as the sidebar and the light or dark theme.

Product analytics (PostHog, and Vercel Web Analytics) run only after you choose Accept all on the cookie banner, and collect nothing on a client's quotation link. Session recordings, if used, mask all text and everything typed into forms, and leave out images such as plans, photos and signatures. Access tokens in links, such as invitation links, are removed before analytics sees them. Analytics does not identify you by name or email address.

To change or withdraw consent, use the Cookie settings link in the footer of our home page, our sign-in pages and these legal pages, or at the bottom of the app's sidebar. If you are signed in, you can also use Turn off usage statistics in Settings → Privacy. Analytics then stays off whenever you are signed in, whatever your cookie choice. Withdrawing consent stops new collection but does not delete what was already collected. See our Cookie Policy.

We do not sell personal data. These service providers process data for us under contract:

• Supabase: database, authentication, and account emails such as sign-up confirmation and password reset (EU, Frankfurt).
• Vercel, Inc.: hosting and serverless functions in Frankfurt, file storage, queues, the AI Gateway that routes AI requests, and Web Analytics with consent. Vercel is a US company, so data may be processed in the USA.
• OpenAI, through the Vercel AI Gateway: AI processing of uploaded documents, job descriptions and AI Assistant messages to draft quotes (USA).
• PostHog: product analytics with consent, and counts of quotation-link events per organisation (PostHog EU Cloud).
• Meta Platforms: the WhatsApp Business Platform, for our WhatsApp assistant.
• Our email provider, which hosts the contact@gromatik.ai mailbox, for messages you send us.

Your browser's speech service, if you use dictation, is not one of our providers (see above).

We also share data:

• within your organisation: members see its projects, quotes and activity history, according to their role;
• with your clients: a quote or quotation link shows your organisation's details, logo and signature, and the name of whoever replies to a client;
• with authorities, courts or regulators, where the law requires it.

Supabase and PostHog EU Cloud process data in the EU. These transfers rely on the UK's adequacy regulations.

Vercel, OpenAI and Meta may process data in the USA. These transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK International Data Transfer Agreement. Where the recipient is certified, the UK–US data bridge applies instead. Write to us for a copy of the relevant safeguards.

We do not delete data automatically after a set period. Data stays while its account or organisation exists, unless deleted sooner:

• Accounts and organisations: until you delete your account or an owner erases the organisation.
• Projects, quotes and files: until you delete them. AI chats are deleted with their quote. Exported documents stay until their project is deleted. An accepted quote, its project, the acceptance record and saved versions cannot be deleted on their own. They are kept as evidence of the agreement until the organisation is erased.
• Activity history: until the organisation is erased, even if the project or quote is deleted. If a member deletes their account, their work stays with the organisation, and a note of the deletion with their email address stays in the history.
• Quotation links: stop working at the expiry the builder chose (7, 14, 30 or 60 days, or none) or when revoked. A link's record, messages and any acceptance stay with the quote.
• Invitations: links work for 14 days; see the invitations section.
• WhatsApp: a connected user's conversation stays until they delete their account or the organisation is erased; disconnecting stops new messages but keeps the history. Our record of other senders is kept until they ask us to delete it. Quote requests passed to a builder before 4 November 2026 stay in that builder's account until their organisation is erased.
• Emails to us: as long as needed to deal with your message and any follow-up.
• Analytics: for the retention period set in our PostHog account, and under Vercel's policy for Web Analytics.
• Backups and logs: our database provider keeps backups, and our hosting provider keeps technical logs, for a limited period under their own policies. Deleted data can remain in backups until they expire.

Builders: keep your own copies of quotes and contracts before erasing an organisation. Erasure cannot be undone.

Your right to object. Where we rely on legitimate interests, you can object at any time. We will then stop, unless we have compelling grounds that override your interests or need the data for legal claims. Where we rely on consent, you can withdraw it at any time, without affecting use before you withdrew.

You also have the right to:

• access your data and rectify it;
• erase it, or restrict how we use it;
• portability of data you gave us, where we rely on contract or consent;
• safeguards, including human review, for significant decisions based solely on automated processing. We make none.

How to use them. Write to contact@gromatik.ai. We answer within one month of receiving your request, or of any identity check we need. For complex or numerous requests we may extend this by up to two months; if so, we will tell you why within the first month. Requests are usually free. If your request is about data we hold for a builder, we will pass it to them and help them answer.

Tools in the app (Settings → Privacy):

• Export (JSON) downloads your data. For owners: your profile, and the current organisation's details, projects, quotes with sections and line items, price list, supplier catalogues and a list of documents (not the files). For other members: your profile, memberships and own activity entries. Other data, including the files, client messages and acceptances, saved versions, activity history, AI chats and WhatsApp records, is available on request.
• Permanently delete my account removes your account. If you are an organisation's only owner, first make another member an owner or erase the organisation.
• Permanently erase organisation (owners only) deletes the organisation and its data, including accepted quotes and acceptance records, and the accounts of members who belong to no other organisation.
• Turn off usage statistics switches off product analytics whenever you are signed in.

You can change your name and password in Settings → Profile, and owners can change company details in Settings → Company. To change your account email address, or to have us erase your data for you, write to us.

If you are unhappy with how we handle your data, please contact us first at contact@gromatik.ai. We acknowledge complaints within 30 days and respond without undue delay, telling you the outcome.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Gromatik is a business service, not directed at anyone under 18, and we do not knowingly collect children's data. If you think a child has given us data, contact us.

We do not ask for sensitive data, such as health information. Please leave it out unless the work needs it.

We protect data with encrypted connections, access controls that keep each organisation's data separate, and private file storage that only signed-in members of the organisation can open.

We may update this policy and will change the date at the top. If a change materially affects how we use your data, we will tell account holders before it takes effect.