Privacy Policy

1. Who we are

Greymill ("we", "us", "our") operates the Greymill platform at greymill.ai. Greymill is a trading name of a company registered in England & Wales. We are registered with the UK Information Commission's Office (ICO). We are the controller of the personal data described in this policy, which means we are responsible for protecting it and for answering to you, and to the ICO, for how it is used. This policy explains what personal information we collect, how we use it, and the rights you have over your data, whether you are located in the UK, European Union, United States, or elsewhere.

2. Scope

This policy applies to all users of the Greymill platform worldwide. Where specific regional laws grant additional rights - such as the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) - those rights are respected and are explained in sections 9 and 10 below.

3. What data we collect

We collect the following categories of personal information when you use Greymill:

• Signup form email (if you do not finish signing up): when you type your email address in the first step of our signup form and continue, we keep that address, the time, your approximate country and the invite link you came through, if any, so that we can see who started signing up and did not finish and so that you can pick up where you left off. We do not add it to any mailing list or send it automated emails. It is deleted as soon as you sign up with that address, or 30 days after you last entered it.
• Account information: your email address, an encrypted password hash, your chosen workspace name, and optionally your full name and phone number.
• Business information: details about your business that you choose to share during onboarding, including industry, company name, and any context you provide to your AI specialists.
• Conversation data: the messages you send to Greymill's AI specialists and the responses you receive.
• Documents: any files or documents you upload to the platform.
• Voice recordings (optional): if you use voice input, the recordings you make with the microphone button so that they can be turned into text, and how long each one was. Section 7 explains how they are handled.
• Usage data: which specialists you interact with, the frequency and length of your conversations, response times, and approximate timestamps.
• Connected account data (optional): if you connect Xero, QuickBooks, Google, Gmail, Outlook, Instagram, Facebook, X, LinkedIn or YouTube, the data we read from those accounts on your instruction, described in sections 7b, 7c, 7e and 12.
• Tax data (optional): if you use Greymill for VAT or Income Tax, the records and figures you enter or import, your VAT registration number or National Insurance number, and what you send to and receive from HM Revenue & Customs (HMRC) through Making Tax Digital, together with the device information HMRC requires with each submission, described in section 7d.
• Technical data: IP address, browser type, device type, and approximate location (city-level) derived from IP address, collected automatically for security and analytics purposes.
• Notification addresses (optional): if you turn notifications on, the address that Apple's push service (in the Greymill iPhone app) or your browser's push service gives that device, so that we can send your notifications to it. We stop using it when you turn notifications off, sign out on that device or the address stops working.
• Error reports: when something goes wrong in the app or on our servers, a report of the error with technical details such as the page and the type of device, and your account number, never your name or email address. Passwords, keys and payment details are removed before a report is sent.
• Referral information: if you arrive through a partner's link (greymill.ai/?ref=) or a customer's Refer a friend link (greymill.ai/?friend=), the code in that link and the partner or customer it belongs to, recorded with your account when you sign up. When you follow a partner's link we log the click with the page you landed on and your browser type, against that partner; when you follow a Refer a friend link we log the click with the page only, against that customer. Neither click log stores your IP address. If you refer friends yourself, we keep your Refer a friend link, which friends joined through it, and your Refer a friend credit and how it was applied to your bills.
• Partner data (partners only): if you join our Partner programme, your name, company, contact details, country, business type and payout currency; your bank details and any tax identifier, encrypted with AES-256-GCM before they are stored; the clients tagged to your link and the fees earned and paid for them; your payout history; and the clicks on your link, with the page and browser type.

4. How we use your data

We use your data to:

• Provide and operate the Greymill service, including powering your AI specialists with the business context you have shared.
• Process subscription payments and manage your account.
• Generate usage reports and savings summaries that are visible only to you.
• Send transactional emails such as welcome messages, password resets, billing notifications, and weekly savings reports.
• Run our Partner programme and Refer a friend: record which partner or customer introduced a new customer, pay partners their one-off fee, apply a friend's discount and the referring customer's bill credit, and check referrals for self-referral and other misuse.
• Detect and prevent abuse, fraud, and security incidents.
• Respond to support requests and feedback.
• Improve the Greymill product based on aggregated, anonymised usage patterns.

What partners and referring customers see. A partner sees, for each client tagged to their link, a masked email address (for example j***@gmail.com), the plan, whether the client is on a trial, paying or has left, and the client's payment events (when they paid and how many payments they have made), so that the partner can follow what they will be paid. A customer who refers friends sees, for each friend who joined through their link, the friend's first name (or a masked email address), when they joined and first paid, their status and the credit earned for them. Neither ever sees your conversations, documents, business data or payment details.

5. Lawful basis for processing (UK and EU users)

For users in the UK and European Economic Area, we process your personal data on the following legal bases under UK GDPR and EU GDPR:

• Contract: to provide the service you have subscribed to, including keeping your tax records and sending your VAT and Income Tax submissions to HMRC when you ask us to, including applying any Refer a friend discount or credit, and, if you are a partner, to perform the Partner Agreement and pay you.
• Legitimate interests: to secure the platform, prevent fraud, and improve our product, to see who started signing up and did not finish (section 3), and to record which partner or customer introduced a new customer and check referrals for self-referral and misuse, where these interests are not overridden by your rights.
• Legal obligation: where we must retain or disclose data to comply with law, including the fraud prevention information HMRC requires software to send with each Making Tax Digital request (section 7d).
• Consent: for any non-essential cookies or marketing communications, which you may withdraw at any time.

6. How we protect your data

Your data is stored in encrypted databases hosted in the United Kingdom. Passwords are hashed using bcrypt. All communications with Greymill servers are encrypted in transit using HTTPS (TLS 1.2 or above). Access to production systems is restricted to authorised personnel using multi-factor authentication. We do not sell, rent, or trade your personal data to third parties for their marketing purposes under any circumstances.

7. AI processing and your conversations

Your conversations with Greymill's AI specialists are processed by large language models provided by a specialist AI infrastructure partner under a commercial agreement that prohibits the use of your data to train AI models.

So that your specialists can recall relevant details from your earlier conversations, the text of your messages and the business facts derived from them are also converted into numerical representations (known as embeddings) by a specialist retrieval infrastructure partner. We have contracted with that partner on terms that prohibit the use of your content to train or improve their models and that require your content to be deleted immediately after it has been processed for us. Embeddings themselves are stored in our own database alongside the facts they describe, inside your workspace, and are deleted when the underlying data is deleted.

Voice input. When you use the microphone button, Greymill turns your recording into text and places it in your message box for you to read and edit before you send it; nothing is sent to your specialists until you send it yourself. The speech recognition runs on a specialist speech recognition infrastructure partner, contracted under a Data Processing Agreement to process your recordings only to turn them into text for us. Greymill does not store your recordings on its servers: we keep only how long each recording was, so that we can run the service and understand its cost. Recording stops when you tap the button again, or by itself after a quiet stretch, and quiet at the end of a recording is trimmed before it is sent. Until a recording has been turned into text, it is kept on your own device (in your browser's storage) so that nothing you said is lost if your connection drops, and it is removed from your device as soon as the text has arrived. Voice input is optional, and only works after you allow Greymill to use your microphone in your browser or device settings.

Your business data and conversation history are used to personalise your experience within your own Greymill workspace. Each workspace is logically isolated - users cannot see or access any other user's conversations, documents, or business information.

The AI services we use

These are the outside AI services that receive what you share with Greymill, what each one receives and why. In the Greymill iPhone app we ask for your permission before the app sends anything from you to any of them. You can withdraw that permission at any time in Settings in the app, and the app then stops sending them anything new. Withdrawing it in the app does not stop what runs on its own for your account, such as sorting the email that arrives in an inbox you have connected and preparing your morning brief, or what you do on our website: those carry on as this policy describes until you disconnect the inbox or close your account.

The companies that provide these services are Anthropic (answering your questions), Voyage AI (finding earlier details), Google (making pictures) and ElevenLabs (voice notes to text).

7a. Anonymous industry benchmarks

There is one exception to the workspace-only rule above, and we want to be plain about it rather than bury it.

When you tell a specialist an operating figure about your business - for example a gross margin, a staff cost ratio, or an average order value - we may record that figure as a single anonymous observation, together with your industry, country, and broad revenue and headcount bands. We do not record who said it in any form that we can trace back to you, and we never record the surrounding conversation.

These observations are pooled so that we can tell any customer how their numbers compare with similar businesses. The following limits are built into the system rather than being a matter of policy:

• A comparison is only ever produced from a pool of five or more separate businesses. Below that threshold no benchmark is shown at all, because a comparison drawn from one or two companies would effectively reveal their figures.
• Only ranges and percentiles are shown. An individual business's number is never displayed to anyone else, and there is no way to work backwards from a benchmark to a particular company.
• Your own figures are excluded from the pool when a benchmark is shown to you, so you are compared against other businesses rather than against yourself.

We rely on legitimate interests as our lawful basis for this, the interest being the ability to give every customer a realistic sense of how their business is performing, which is a core part of what Greymill is for. We have weighed this against your rights and consider the impact to be low, because what is retained is a number and a set of broad categories rather than anything identifying.

You can object to your figures being used this way at any time by emailing support@greymill.ai, and we will exclude your account from the pool. Doing so does not affect your ability to see benchmarks yourself.

7b. Connected Google data

If you choose to connect a Google account, you can give Greymill read-only access to your Google Search Console and Google Analytics data so that your marketing specialist can advise you on your own figures rather than on general assumptions. This is optional, it is off unless you turn it on, and it can be disconnected at any time from Settings.

What we read: the search queries your site appeared for, impressions, clicks, average position, pages, sessions by channel, landing pages, and the conversion events you have configured. We read aggregate reporting data only. We do not read individual visitor records, and we never write, post or change anything in your Google account.

What we store: an encrypted access credential, which site and property you selected, and a cached summary of those figures so that your specialist can answer without calling Google on every message. Disconnecting deletes the credential and the cached figures, and we also ask Google to revoke our access.

Greymill's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, we do not sell it, and we do not transfer it except as needed to provide the feature you asked for. No human at Greymill reads it except where you have asked us to help with a specific problem or where the law requires it, and it is never used to train any AI model.

7c. Connected email (Gmail and Outlook)

If you choose to connect a Gmail or Outlook mailbox, you give Greymill access to it so that your specialists can sort your email and help you deal with it. Your specialists also read emails you have sent yourself to learn how you write, so that posts and emails they draft for you sound like you; what they keep is a short description of your writing style that you can see and change, not the emails. Outlook can be connected now. Gmail is coming soon: until Greymill shows Gmail as available to your account, it cannot be connected, and what this section says about Gmail applies from then. A Gmail connection is read-only. When you connect Outlook, Microsoft asks you once whether Greymill may read your mail, save drafts and send emails you approve (Mail.Read, Mail.ReadWrite and Mail.Send), so that you never have to approve anything again when you press Send. Where saving drafts or sending is not yet open to your account, Microsoft is asked only for what is. Greymill uses the draft and send permissions only for an email you choose, when you press the button, as described below. This is optional, it is off unless you turn it on, and it can be disconnected at any time from Settings.

Shared mailboxes: if you use Microsoft 365, you can also connect a shared mailbox, such as accounts@ or info@, that your own Microsoft account can open. You sign in as yourself, and Microsoft asks whether Greymill may read, save drafts in and send from the mailboxes you have access to (Mail.Read.Shared, Mail.ReadWrite.Shared and Mail.Send.Shared). Greymill then reads only the shared mailbox you named, in the same way as your own inbox, and everything on this page applies to it. Your Microsoft 365 administrator decides who can open a shared mailbox.

What we read: the sender, subject, date and a short preview of the messages that arrive in your inbox, so that each one can be sorted to the specialist best placed to help and marked by urgency. When you open a message in Greymill, we fetch its text from your mailbox at that moment to show it to you.

What we never do: we never send an email you have not approved by pressing Send on it, we never send anything on our own initiative or in bulk, and we never delete, move or label anything in your mailbox. Greymill uses the permission to save drafts or send only for an email you chose, as described below. When you ask a specialist about an email, Greymill places it in that specialist's message box, and nothing happens in your mailbox until you choose to act.

Drafts you approve: a specialist can write an email for you, such as a payment reminder or a reply to a customer, and put it on its desk in Greymill (the panel beside your conversation on a large screen, or the desk button at the top on a phone), where you can read it, change it or dismiss it. Only if you then choose to save it to your drafts does Greymill create that one email in the Drafts folder of your own mailbox, where you can check it and send it yourself. Saving a draft sends its recipient, subject and text to Microsoft or Google so that they can create it. For Outlook the permission is Mail.ReadWrite (Mail.ReadWrite.Shared for a shared mailbox), which Microsoft asks for when you connect; for a mailbox connected before October 2026 it asks the first time you save a draft. For Gmail it is gmail.compose, which Google asks for the first time you do this. These are the narrowest permissions either provider offers for creating a draft, and each one covers more than that: Microsoft's also allows mail to be changed or deleted, and Google's also allows mail to be sent. Greymill uses the permission only to create the email you chose, one at a time, when you press the button, and it never changes or deletes anything else in your mailbox. When the email answers one you brought in from your inbox, the draft is made as a reply in that conversation. Saving drafts is available for Outlook now and will follow for Gmail. You can withdraw the permission at any time by disconnecting the mailbox in Settings, and for Outlook also at myapps.microsoft.com.

Sending, only when you press Send: where your account offers it, you can send an email from the desk instead of saving it. You read it, change it if you wish and press Send. Greymill holds it on its servers for a few seconds, so that you can undo it, then sends that one email from your mailbox, or from the shared mailbox you chose. You can instead choose a later time, up to 30 days ahead: Greymill keeps the email until then and sends it at that time, even if you are offline, unless you cancel it first. It appears in your Sent folder like any email you send. For Outlook the permission is Mail.Send (Mail.Send.Shared for a shared mailbox), which Microsoft asks for when you connect, or the first time you send from a mailbox connected before October 2026; for Gmail the gmail.compose permission above already covers sending. Greymill never sends an email you did not press Send on, never chooses a time to send by itself, never sends in bulk, and never sends from a mailbox you did not choose. Sending from a shared mailbox also needs the Send As or Send on Behalf permission your Microsoft 365 administrator gives. You can withdraw the permission in the same way as drafts.

Your email signature: emails from the desk end with the signature of the mailbox they go from, so that they read as yours. Microsoft does not let other apps read the signatures saved in Outlook, so the first time the desk knows an Outlook mailbox, and again when you ask, Greymill reads the last 50 emails sent from it, sets aside the email each one answered, and finds the lines they end with in common. It keeps only that signature; nothing else from those emails is stored. You can instead write your own, have one made from your name and business details, or remove it, in Settings, for each mailbox. You see the signature in the email before it is sent, and a draft saved to your mailbox carries it there for you to check.

Rewrites and follow-ups you ask for: if you ask for an email to be made shorter, warmer or firmer, or its spelling fixed, its text is sent to the same AI infrastructure partner that runs your specialists, under the same agreement, to rewrite it; Greymill checks that no figure, date or amount changed before it shows you the new text, and keeps your own text if one did. If you ask Greymill to tell you when someone has not replied, it looks for a reply in that conversation among the emails it already sorts for you, and tells you on your desk and by email if none has come by the day shown.

What we store: an encrypted access credential, the email signature for each mailbox if it has one and, for each sorted message, the sender, subject, date, a preview of no more than 400 characters and the result of the sorting. We do not store the full text of your emails or their attachments. Sorted messages are deleted automatically 30 days after we receive them. For each email a specialist drafts for you, the recipient, subject and text are kept on the desk in your account, with a link to the draft if you saved it, and are deleted with your account. For each email you send from Greymill, we keep a record of it (who it went to, the subject and text, the mailbox it went from, when it was sent and whether a reply came) for 400 days, so that you can always see what was sent on your behalf; it is then deleted, or sooner if you delete your account. Disconnecting deletes the credential and every sorted message straight away; for Gmail we also ask Google to revoke our access, and for Outlook you can remove Greymill at myapps.microsoft.com.

How it is processed: the sender, subject and preview are sent to our AI infrastructure partner, under the terms described in section 7, solely to sort the message. The full text of a message is only sent there if you ask a specialist about it. That includes questions that need your mailbox searched: when you ask a specialist about something that would be in your email, the specialist searches your mailbox at that moment, reads up to a handful of matching emails, and uses them to answer. Those emails are not stored by Greymill; the search happens live each time you ask.

Greymill's use and transfer of information received from Google APIs, including Google Workspace APIs, adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your email data only to provide the sorting and assistance features you can see in Greymill. We do not use it for advertising, we do not sell it, we do not transfer it to anyone except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with your notice, and no human at Greymill reads it unless you ask us to or the law requires it. We never use data from your mailbox to develop, improve or train generalised AI or machine learning models, whether ours or anyone else's.

7d. Making Tax Digital (VAT and Income Tax)

If you use Greymill to keep your VAT or Income Tax records and to send them to HMRC, this section explains the personal data involved. It is optional, and it is off until you connect to HMRC.

What we hold: the records and figures you enter or import; your VAT registration number, or your National Insurance number and the businesses HMRC has on record for you; the returns and updates you prepare, the declaration you confirm and HMRC's receipt for each one you send; and what HMRC tells Greymill about your obligations, liabilities, payments and tax calculations when you ask for them. We also keep an encrypted access credential for your HMRC connection, a log of each request we make to HMRC (what was asked, when and HMRC's reply code, without your figures or credentials) and the time you last confirmed a submission with the code we email you.

Why: to work out your returns from your records, to show you what HMRC holds, and to send a return or update to HMRC only when you press the button to send it. Our lawful basis is the contract with you. Nothing is sent to HMRC on our own initiative.

Fraud prevention information: HMRC requires software that connects to Making Tax Digital to send information about the device and connection with each request, to help it protect your tax account against fraud. Greymill sends your IP address (and port, where it is known) and the time it was seen, a random identifier for your browser, your Greymill user identifier, your browser's description, your screen and window size, your time zone, and whether and when you confirmed a submission with a second factor. Our lawful basis is legal obligation. HMRC uses this information under its own privacy notice, at gov.uk.

Who sees it: HMRC, for the requests you make; HMRC is a separate controller of what it receives. Your tax data is not used to train any AI model. If you ask a specialist about your tax, the figures you ask about are sent to our AI infrastructure partner under the terms in section 7.

Disconnecting: you can disconnect from HMRC at any time from the VAT or Income Tax screen. That deletes the access credential at once; your records and returns stay in your workspace until you delete them or close your account. You must keep VAT and tax records yourself (in the UK, generally for at least five or six years), so download your returns and records before you close your account.

7e. Connected social accounts (Instagram, Facebook, X, LinkedIn and YouTube)

If you choose to connect your Instagram professional account, a Facebook Page you manage, your X account, a LinkedIn Company Page you administer or your own LinkedIn profile, or your YouTube channel, you give Greymill access to it so that your specialists can advise you on your own audience and posts rather than on general assumptions. This is optional, it is off unless you turn it on, and it can be disconnected at any time from Settings.

What we read: your follower (or subscriber) count and, where the platform gives them, how many accounts you follow and how many posts or videos you have made; the views, reach, watch time and engagement figures each platform reports for your account over the last 28 days and, where it gives them, the 28 before; and your recent posts or videos with their figures. For Facebook and LinkedIn, we also read the names of the Pages you manage so that you can choose which one to connect. On LinkedIn we also read your name and your own profile's follower count and the totals for your own posts (LinkedIn does not let us read the posts themselves). We also read the web address of each account's profile picture (on LinkedIn, the Page's logo and your profile photo), so that your stats and posts show it; your browser loads the picture from the platform, and we keep only its address with the latest figures. Instagram, Facebook and YouTube are read-only: Greymill never posts, comments, likes, follows, uploads or sends messages there.

X: when you connect X, you choose the level of access. If you choose posting, Greymill publishes a post only when you press Post on that post, with the text you saw. If you choose messages, Greymill reads your recent X direct messages only when you ask about them, and sends a reply only when you press Send on that reply. If you add a photo or video to a post, we keep it privately only until it is posted, or until you remove it or dismiss the post. Greymill never likes, follows or reposts on X.

LinkedIn: when you connect LinkedIn, you choose read only, or read and post. If you choose posting, Greymill publishes a post to the Page you connected, or as you if you choose to post as yourself (or connected your profile alone), only when you press Post on that post, with the text you saw and the one photo you added, if any. We keep that photo privately only until it is posted, or until you remove it or dismiss the post. Greymill never comments, reacts, follows, reposts or sends messages on LinkedIn.

What we store: an encrypted access credential, the latest figures, one follower count a day for up to 120 days (not for YouTube or a LinkedIn profile), the first 120 characters of each recent post or video title, and, if you ask about your X messages, those messages for up to a day. The latest figures are replaced by each daily read; if they stop being refreshed, we delete them after 30 days for YouTube and after 48 hours for LinkedIn. For each post or reply you send through Greymill, we keep a record that it was sent and the platform's reference for it, without its text.

How it is processed: when a specialist uses these figures or posts to answer you, they are sent to our AI infrastructure partner under the terms described in section 7. They are not used for advertising, we do not sell them, they are shown only to you in your workspace, and they are never used to train any AI model.

YouTube: Greymill uses YouTube API Services to read your channel. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of your information is covered by the Google Privacy Policy. Greymill shows YouTube's figures as YouTube reports them and works out no new figures from them. YouTube uses its own Google connection, separate from Google Search Console and Analytics, so disconnecting one never affects the other. Greymill's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Greymill's access at any time on Google's security settings page at https://security.google.com/settings/security/permissions; if you do, we delete what we read from YouTube as soon as we learn of it, and always within 7 days.

Disconnecting and deletion: disconnecting an account in Settings deletes its credential and everything we read through it straight away, and for LinkedIn and YouTube it also withdraws Greymill's access at the platform. You can also remove Greymill in the platform's own settings (Apps and websites, in Instagram or Facebook; Connected apps, in X; Permitted services, in LinkedIn; the Google page above, for YouTube). When you remove Greymill in Instagram or Facebook, or ask there for your data to be deleted, Meta tells us and we delete every connection to that account that was made before your request, and everything we read through it, and give Meta a confirmation code you can use to check that the deletion is complete. When another platform tells us you have removed Greymill, or Greymill finds its access withdrawn, we stop reading and ask you to reconnect, and the figures go as described above. You can also ask us to delete it by emailing support@greymill.ai.

8. Cookies and analytics

We use strictly necessary cookies to maintain your login session and deliver the service.

We also use referral cookies, which are not strictly necessary and are set only when you follow a referral link, so that the referral you followed is honoured when you sign up:

• gm_ref: set when you follow a partner's link (?ref=), holding that partner's code, for 60 days. The same code is kept in your browser's local storage (gm_ref, with the time it was set in gm_ref_ts) and is used for up to 90 days.
• gm_friend: set when you follow a customer's Refer a friend link (?friend=), holding that customer's code, for 60 days. The same code is kept in local storage (gm_friend, with gm_friend_ts and gm_friend_ok, which records that the code was checked) and is used for up to 90 days.

Following one kind of link clears the other, and both are cleared once you sign up. A short-lived flag in your browser's session storage makes sure a click is counted only once per visit. These cookies and keys are used only to credit the right partner or apply the right Refer a friend discount and credit; they are never used for advertising. You can remove them at any time by clearing your browser's cookies and site data for greymill.ai.

We use a product analytics tool, hosted in the EU, to understand how the platform is used. When you are signed in it receives your account number, email address, name, workspace name and plan together with the pages and features you use. We do not use advertising cookies and do not sell your personal information. When you arrive from one of our adverts, we measure whether that advert led to a signup using cookieless, consent-restricted conversion measurement (Google consent mode with every storage signal denied); no advertising cookies are set, no advertising profile is built, and we do not share your data for cross-context behavioural advertising. You can control cookies through your browser settings, though disabling essential cookies will prevent you from using the service.

9. Your rights under UK and EU GDPR

If you are located in the UK or EEA, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct any inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data.
• Restriction: ask us to stop processing your data in certain circumstances.
• Portability: receive your data in a structured, commonly-used format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Complain: lodge a complaint with your local supervisory authority. In the UK, this is the Information Commission's Office (ico.org.uk).

To exercise any of these rights, email support@greymill.ai. We will respond within one month.

10. Your rights under California law (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct: request that we correct inaccurate personal information.
• Right to opt out of sale or sharing: Greymill does not sell your personal information and does not share it for cross-context behavioural advertising, so there is nothing to opt out of.
• Right to limit use of sensitive personal information: we do not use sensitive personal information beyond what is necessary to provide the service.
• Right to non-discrimination: you will not receive discriminatory treatment for exercising any of your privacy rights.

California residents may exercise these rights by emailing support@greymill.ai. We will verify your identity before acting on any request and respond within 45 days.

11. International data transfers

Greymill is operated from the United Kingdom, and our primary database is hosted in the United Kingdom. For users in the European Economic Area, transfers to the United Kingdom are covered by the European Commission adequacy decision for the UK. Your data may also be transferred to and processed in other countries, including the United States. Where we transfer personal data from the UK or EEA to a country not deemed to have adequate data protection, we rely on Standard Contractual Clauses approved by the UK ICO and European Commission to ensure an equivalent level of protection.

12. Data retention

We retain your personal data for as long as your account is active.

Some logs are deleted on a rolling basis whether or not your account is still active: our email delivery log (the address each email went to, its subject, and whether it was delivered, opened or clicked) and our product analytics events, after 13 months, except the record of an email that bounced for a reason other than a temporary delivery problem, which we keep so that our scheduled account emails, weekly savings reports and checkout reminders skip that address; and our security event log, which can include your IP address, together with the records of our automated checks on specialists' answers, after 24 months. The record of each time you sign in, with the IP address and approximate location it came from, is kept for as long as your account is active and deleted with it.

If you cancel, we keep everything for 30 days so that you can reactivate without losing your history. After those 30 days an automated process runs and permanently deletes the following, with no way for us to recover it:

• every conversation with every specialist;
• every document and file you uploaded, including from our file storage;
• everything the specialists had learned and remembered about your business;
• any contracts, briefs and saved work held in your workspace;
• your connections to Xero or QuickBooks, and any accounting figures we had cached from them;
• your Google connection, and any Search Console or Analytics figures we had cached from it;
• your Gmail or Outlook connection, and the sorted list of emails we kept from it;
• your Instagram, Facebook, X, LinkedIn and YouTube connections, the figures, posts and messages we read from them, any photo or video waiting to be posted, and the record of the posts and replies you sent through Greymill;
• your HMRC connection, your VAT and Income Tax records, the returns and updates you prepared or sent, HMRC's receipts, and the log of requests made to HMRC for you;
• the emails we sent you, and the record of their delivery, opens and clicks;
• your feedback, and anything you told us when you cancelled;
• the security and analytics logs tied to your account, including your IP addresses, the names of files you uploaded and the pages you viewed on our website before and after you signed up;
• your Refer a friend link, which stops working, and the record of clicks on it;
• your password and login sessions.

A few things are deliberately kept, and we would rather explain them than describe this as a complete erasure when it is not:

• A reduced account record. We keep a stripped-back record of the account itself. Your email address is replaced, and your name, phone number, workspace name, company name, website, password and IP address are all erased, along with the record of how you first found us. What remains is the plan you were on, the dates you joined and left, your industry and your country (for a US business, its state). We keep this because we are required to retain business and tax records (in the UK, generally for six years), and because it lets us understand why customers leave without holding anything that identifies you.
• Anonymous benchmark observations. Any operating figures described in section 7a stay in the pooled dataset. Once the reduced account record above has been stripped, these can no longer be connected to you or to your business.
• Usage and cost history. For each request you made, which specialist answered, which AI model was used, how large the request was and what it cost us, with no message content, and for each voice recording, how long it was and what it cost us, with no audio or text. Alongside it, your plan changes, the revenue we recorded from the account, and which of our emails we sent you, and when (not the emails themselves). All of it is held against the reduced account record above, so it no longer identifies you, and we keep it to understand our costs and why customers leave.
• Billing records. The record of each payment, of any discount or plan offer you accepted, of any Refer a friend discount or credit earned, applied to your bills or withdrawn, and of any fee we paid to a partner who referred you is kept for six years, because tax law requires it. Your email address in these records is replaced with the same anonymous one, and the billing name, phone number and street address are removed.
• Email opt-outs. If you unsubscribed from any of our emails or reported one as spam, your email address stays on our suppression list, no longer linked to the account, so that we never email it again.

Backup copies may persist for up to a further 30 days before being overwritten. During that window they are not accessed for any purpose and are not used in any decision about anyone.

You may request immediate deletion at any time by emailing support@greymill.ai, subject to any legal or contractual retention obligations we may have. If you do, the same process runs straight away rather than after 30 days. In the Greymill iPhone app you can also delete your account yourself, straight away, in Settings, Account, Delete account.

13. Children's privacy

Greymill is not intended for use by anyone under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact support@greymill.ai and we will delete it promptly.

14. Service providers

To deliver the Greymill service, we share certain personal data with a small set of trusted infrastructure providers, including those who provide AI model inference, speech recognition for voice input, search and retrieval indexing, authentication and database hosting, web hosting and edge delivery, transactional email, product analytics, error monitoring and the delivery of notifications. HM Revenue & Customs is not one of our service providers: it receives your tax submissions as a separate controller, as section 7d explains. Each is contractually bound by a Data Processing Agreement with Greymill and may only process your data on our instructions. A current named list with full company details is available on request to support@greymill.ai, and is provided to enterprise customers as part of our Data Processing Agreement. We will notify active users by email at least thirty (30) days before adding or replacing a service provider that materially changes how personal data is processed.

If you are a partner, we pay you through Wise (Wise Payments Limited), which receives your name, your bank details and the amount of each payout so that it can make the transfer, and processes them under its own privacy policy as a regulated payment provider.

For data transferred to the United States or other third countries, we rely on the European Commission's Standard Contractual Clauses (or the equivalent UK International Data Transfer Agreement) together with supplementary technical measures, including encryption in transit and at rest.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify active users by email and update the "Last updated" date at the top of this page. Your continued use of the Greymill service after the effective date of an updated policy constitutes acceptance of the changes. If you do not agree to an updated policy, you may close your account at any time.

Every change to this policy is listed in the change history below, whether or not we also emailed active users about it.

Change history

• 6 November 2026. Section 3 now lists the notification address of each device you turn notifications on for and the error reports we receive; section 8 now says exactly what our analytics tool receives; section 12 says the iPhone app deletes your account straight away from Settings; and section 14 adds error monitoring and the delivery of notifications to our kinds of provider.
• 6 November 2026 (earlier). Section 7 now lists each outside AI service by what it does, as the iPhone app does, with the companies that provide them named under the list. The services and what each one receives are unchanged.
• 5 November 2026. Section 7 now names the outside AI services that receive what you share (Anthropic, Voyage AI, Google and ElevenLabs), what each one receives and why, says that the Greymill iPhone app asks for your permission before it sends anything from you to any of them, and says what withdrawing that permission stops and what carries on.
• 30 October 2026. Section 7e now says that we read the address of each connected social account's profile picture (on LinkedIn, the Page's logo and your profile photo) so your stats and posts can show it, keeping only that address, and that with LinkedIn read and post you can post as your Page or as yourself.
• 30 October 2026 (earlier). Section 7c now says that Outlook can be connected now and Gmail only once Greymill shows it as available to your account, and sections 1 and 9 use the UK regulator's new name, the Information Commission's Office (ICO), in force since 30 September 2026.
• 27 October 2026. Sections 3 and 5 now describe the email you type in the first step of our signup form: if you do not finish signing up, we keep it with the time, your approximate country and any invite link, never add it to a mailing list or send it automated emails, and delete it when you sign up or 30 days after you last entered it.
• 26 October 2026 (third update). Section 7e now describes posting to LinkedIn: if you choose read and post when you connect LinkedIn, a post goes to your Page (or as you, for your profile) only when you press Post on it, with the text you saw and at most one photo, which we keep only until it is posted.
• 26 October 2026 (later). Section 7e, and sections 3 and 12, now also describe connecting a LinkedIn Company Page or your own LinkedIn profile, or a YouTube channel: what we read and store, that they are read-only, how long their figures are kept, that Greymill uses YouTube API Services under the YouTube Terms of Service and the Google Privacy Policy and how to remove its access on Google's security settings page, and that disconnecting withdraws Greymill's access at the platform.
• 26 October 2026. New section 7e, and sections 3 and 12, describe connecting an Instagram professional account, a Facebook Page or an X account: what we read and store, that Instagram and Facebook are read-only, that on X a post or reply is sent only when you press its button, how disconnecting or removing Greymill in Instagram or Facebook deletes what we read, and that it is deleted with your account.
• 12 October 2026. Sections 3, 7, 12 and 14 now describe voice input: the recordings you choose to make with the microphone button are turned into text by a speech recognition partner under a Data Processing Agreement, Greymill keeps only how long each one was (not the audio), a recording waits on your own device until its text has arrived, and the length and cost of each recording is part of the usage and cost history kept after an account closes.
• October 2026. Section 12 now sets out in full what is deleted 30 days after you cancel and what is kept (a reduced account record, usage and cost history with no message content, billing records and email opt-outs), and states that our email and analytics logs are deleted after 13 months (except the record of an email that bounced for a reason other than a temporary delivery problem, which keeps our scheduled emails from going to that address) and our security event log after 24 months, while the record of each sign-in is kept for as long as the account is active. We have recorded this update here rather than emailing active users: it describes in more detail what happens when an account closes, and it shortens how long some logs are kept.
• 7 October 2026. Sections 3, 4, 5, 8, 12 and 14 now describe our two referral programmes, the Partner programme for professionals and Refer a friend for customers: what we record when you arrive through a partner's or a customer's link, what partners and referring customers can see, the gm_ref and gm_friend referral cookies and browser storage and how long they last (section 8 no longer says that we use only strictly necessary cookies), the partner data we hold, including encrypted bank details and payouts through Wise, and that billing records include Refer a friend discounts and credit.

16. Contact

For any questions about this policy, to exercise your data protection rights, or to raise a privacy concern, please contact our data protection team at support@greymill.ai. We aim to respond to all enquiries within five working days.

Subscription billing is provided by FastSpring (Bright Market, LLC, United States) acting as Merchant of Record. See our Terms of Service for the billing relationship and FastSpring's privacy policy for how billing data is handled.

Greymill Limited · Registered in England and Wales · Company number 17144930 · 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ