Privacy Policy
Last updated 18 September 2026. This policy explains what Modern Technologies, Inc. collects when you use Graft Cloud and this website, how we use it, and the choices you have.
1. Who we are
Graft is made by Modern Technologies, Inc., a Delaware corporation. When this policy says “we”, “us” or “Graft”, that is who it means.
Graft comes in two forms. Graft Cloud is the hosted service we run for you, and this policy describes what we collect there and on this website. The self-hosted form runs on your own computers with your own AI provider key; in that form nothing about your account, your connections or your tools reaches us, and this policy does not apply to it beyond the website.
For your account and the data we collect on our website, we are the data controller. For the data your agents work with through Graft Cloud, we process it on your instructions and you remain the controller of it. If you need a data processing agreement with us, email privacy@getgraft.ai.
2. What we collect
When you sign up we collect account information: your name, your email address, and, if you sign in with Google or GitHub, the identifier that service gives us.
When you connect a service, such as your email or an application your business uses, we store the credential you enter, encrypted under keys we control. It is write-only after you enter it: nobody, including you, can read it back through Graft. We decrypt it in exactly one place, the moment a call you have approved leaves for that service.
When Graft writes a tool for your agent, we keep the record of that work: the documentation it read, the code it wrote, the results of its checks and test calls, and any error a service returned, with credentials removed before storage.
When your agent uses a tool, we record who called what, which service and path it reached, the outcome and how long it took. We never store the headers or the bodies of those calls.
We also collect usage data automatically: your IP address, browser and device type, the pages you visit and diagnostic logs when something goes wrong.
Graft Cloud is free during the alpha and we collect no payment details. When we introduce paid plans, payment details will be collected by our payment processor, not by us, and we will update this policy first.
3. How we use it
We use your information to run Graft: to write and run the tools your agents ask for, to keep your account working, to answer support requests and, later, to bill you.
We use the records of how tools were built, including the ones that failed, to make Graft better at building tools. That work looks at patterns across many builds; it does not train AI models, and we do not share your records with other customers.
We also use your information to keep the service safe, detecting fraud and abuse, and to understand how Graft is used so we can improve it.
We will email you about the service: security notices, important product updates and, occasionally, news. You can opt out of news at any time; service emails keep coming while you have an account.
Where the GDPR applies, our legal bases are performing our contract with you for your account and the data your agents work with, our legitimate interests for usage and security data, and your consent for marketing, which you can withdraw at any time.
4. AI and your data
Graft uses AI to write tools. In Graft Cloud, the public documentation of the service your agent is connecting to, and the responses of the read-only test calls Graft makes while checking a tool, pass through our AI provider so the model can write and verify the code. Your credentials never do: they are not in the code, not in the sandbox the code runs in, and never visible to any model.
We do not use your data to train AI models, and the providers we build on are under agreements that stop them training on anything Graft sends them too.
If you bring your own AI provider key on Graft Cloud, that documentation and those responses go to your provider instead of ours. In the self-hosted form they never leave your machines.
5. Connected services
When you connect a service, Graft reaches it only to do what your agent asked and you approved. Every call goes through Graft’s proxy, which sends it only to the addresses you saw when you connected the service, and you can disconnect a service at any time. Disconnecting deletes its credential and every approval you gave for it.
Data we receive through Google services is handled according to Google’s API Services User Data Policy, including its Limited Use requirements, and we do not use it to develop, improve or train generalised AI or machine learning models.
Some services connect through a provider you choose, such as Pipedream, which then holds the credential and relays the calls. That provider handles your information under its own privacy terms, and we tell you which provider is involved before you connect.
8. Keeping and deleting data
We keep your information for as long as you use Graft Cloud, or as long as we need it for the purpose it was collected. Tools Graft wrote for you stay in your toolbox until you delete them; nothing is deleted by the system on its own.
You can ask us to delete your account and its data at any time by emailing privacy@getgraft.ai. We delete or de-identify your personal information within 90 days of your account closing, except what the law requires us to keep. Deleted data leaves our backups on their normal rotation, within 35 days.
9. Security
Your data is encrypted in transit and at rest. Credentials are encrypted under keys we control and decrypted in one component only, the proxy, at the moment a call is made. Tools run in isolated sandboxes whose only route out is that proxy. Access inside our team is limited to people who need it for their work.
If a security incident affects your data, we will tell you promptly what happened, what information was involved and what we are doing about it, and we will notify you and the relevant regulators within the timeframes the law requires.
No method of transmission or storage is completely secure. We use strong, commercially reasonable protections, but we cannot promise absolute security; nobody honestly can.
10. Where your data lives
Graft Cloud runs on servers in Australia and the United States, so your information is processed there even if you are somewhere else.
When we move data out of the European Economic Area, the United Kingdom or Switzerland, we rely on the EU Standard Contractual Clauses and equivalent safeguards.
11. Your rights
You can access, correct, export or delete your personal information, ask us to restrict or stop processing it, and withdraw consent you have given. Email privacy@getgraft.ai and a person will handle it.
If you are in the EU or the UK, these are your GDPR rights, and you can also complain to your local data protection authority. If you are in California, the CCPA gives you the right to know what we collect, to ask us to delete it, and not to be discriminated against for asking; we do not sell personal information in the first place.
If you are in Australia, you also have rights under the Privacy Act 1988, including access and correction, and you can complain to the OAIC if you think we have got something wrong.
12. Children
You must be 18 or over to use Graft Cloud. We do not knowingly collect information from children, and if we learn that we have, we will delete it.
13. Changes to this policy
We will update this policy as Graft grows. If we make a meaningful change we will email you before it takes effect. The date at the top shows the latest version.