Graphy

GDPR overview

Graphy applies the UK GDPR rather than the EU regime, consistent with a company registered in England and Wales. The privacy notice, last updated on 15 April 2024, names a legal basis for each purpose: Article 6(1)(b) for account creation, Article 6(1)(f) for onboarding calls, service messages and marketing. Seven data-subject rights are set out, including access, objection, erasure and portability; requests are free, answered within one calendar month, and sent to privacy@graphyapp.com or the London address. Complaints go to the UK Information Commissioner's Office. The terms add processor duties: documented instructions, no transfer outside the UK or EEA without safeguards, breach notification without undue delay, deletion or return at termination, and one audit a year. No EU Article 27 representative is named, and the site never writes the words GDPR compliant.

Who owns the data?

The terms draw a clear line. You own all right, title and interest in Customer Data that is not personal data, and you remain solely responsible for its legality, accuracy and quality. Where personal data is involved, you are the controller and Graphy is the processor, acting only on your documented written instructions. Your data is treated as your confidential information. Graphy may appoint third-party processors under substantially similar terms and stays fully liable for them. On termination it may destroy your data unless you ask in writing, within ten days, for the latest backup, which it then delivers within thirty days at your reasonable expense.

Reuse rights

You may reuse your own output freely and without asking: charts can be exported as images, embedded on other sites, shared by link or posted to social channels, and the free plan explicitly allows sharing anywhere. What the terms forbid is reselling or redistributing the software itself, or using it to build a competing product. On Graphy's side, account details such as work email, job title, company name and size are processed to perform the contract, while onboarding calls are recorded under legitimate interest. If you switch on the AI features, your data may be processed in the United States by OpenAI under Standard Contractual Clauses and the UK Addendum, and Graphy states that OpenAI will not use it for model training. Data reached through Google Workspace APIs by the Google Slides add-on is never shared, transferred or disclosed, including to develop or train generalised AI models.

Data retention & training

Hosting summary

Graphy states that most of the data it processes is stored in the European Economic Area, including its platform servers. No specific hosting country and no cloud provider is named. Transfers to a third country such as the United States are covered by Standard Contractual Clauses and, where necessary, the UK Addendum. Those transfers are concrete rather than theoretical: the AI features may be processed in the United States by OpenAI, the CRM, email and mail-merge tools sit in both the EEA and the United States, and hiring platforms and video interviewing are partly US-based. The terms add that personal data may be transferred or stored outside the United Kingdom and the EEA, but never without appropriate safeguards. One caveat on reading the technical record: the marketing site resolves to an Amazon anycast node in the United States, which describes how the website is delivered and not where customer data lives. The governing jurisdiction is the United Kingdom — the vendor is registered in England and Wales, applies the UK GDPR, and names the Information Commissioner's Office as its supervisory authority.