Privacy Policy

Who we are

Grapeworks Ltd is a company registered in Scotland (company number SC782424). Our registered office and studio is at Studio One, 89 Middlesex Street, Kinning Park, Glasgow G41 1EE. We are the data controller for the personal data described in this policy.

The information we collect

When you contact us

When you complete a form on this site or email us, we collect the details you give us — typically your name, email address, company name, phone number, and the content of your message. We also record basic campaign attribution (for example, the marketing source that brought you to the site) so we understand which of our channels are working.

We use this to respond to your enquiry, arrange a call, and — if you become a client — to deliver our services. The lawful basis is our legitimate interest in responding to people who contact us and, where relevant, taking steps to enter into a contract with you. Enquiries are handled in our customer relationship management (CRM) system (see “Who we share data with” below).

When you browse the site

We use cookies and similar technologies for analytics and, if you allow it, marketing measurement. These are only set once you make a choice on our cookie banner. Until you consent, Google Consent Mode keeps advertising and analytics storage switched off, and any measurement is limited and aggregated. You can change or withdraw your cookie choices at any time from the cookie settings on the site.

Cookies and consent

We group cookies into three categories, and you control the optional ones:

• Strictly necessary — needed for the site to work. Always on.
• Analytics — Google Analytics 4 (via Google Tag Manager) and Microsoft Clarity, which help us see how the site is used so we can improve it. Set only with your consent.
• Marketing — advertising cookies (for example Google and Meta) that measure and improve campaigns. Off by default; set only if you switch marketing consent on.

We implement Google Consent Mode v2, so we do not set advertising or analytics identifiers for anyone who has not consented.

Advertising and marketing analytics data

Grapeworks provides managed advertising and marketing analytics as a service to contracted clients. As part of that service, and only with the client’s written authorisation, we access their own advertising and analytics accounts — including Google Ads, Google Analytics 4, Google Search Console, and Meta — on a read-and-manage, least-privilege basis. We use this access to:

• pull campaign performance data (impressions, clicks, cost, conversions) into our own reporting warehouse;
• produce unified cross-channel reporting and revenue attribution; and
• set up, manage, and optimise campaigns on the client’s behalf, with human sign-off on every change.

All of this happens under our own Google Ads manager account (MCC), for the accounts we are asked to manage. We do not access accounts we do not manage, we do not sell or share this data, and the client keeps ownership of every account and can revoke our access at any time.

Where we access data through Google APIs (including the Google Ads API), our use of that data complies with the Google API Services User Data Policy, including its Limited Use requirements. We use the data only to provide and improve the reporting and advertising-management service the client has asked for.

Who we share data with

We only share personal data with the providers who help us run our business, and only as far as they need it:

• GoHighLevel — our CRM, where enquiries and client communications are managed.
• Google(Analytics, Tag Manager, Google Ads) — analytics and advertising measurement, subject to your consent.
• Meta — advertising measurement, subject to your consent.
• Microsoft Clarity — anonymised product analytics, subject to your consent.
• Vercel — our website hosting provider.

We do not sell your personal data. We may disclose data where the law requires it.

International transfers

Some of our providers are based outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as the UK’s adequacy regulations or the International Data Transfer Agreement and Addendum — to keep it protected.

How long we keep it

We keep enquiry data for as long as we need it to deal with your enquiry and for a reasonable period afterwards in case you come back to us. Client data is kept for the life of the engagement and for as long as we are legally required to retain it afterwards (for example, for tax and accounting). Analytics data is retained according to the provider’s settings and our configured retention period.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, or restrict how we use it;
• object to us using your data, including for direct marketing;
• ask us to move your data to another provider (portability); and
• withdraw consent at any time where we rely on it.

To exercise any of these, email aitp@grapeworks.ai. You also have the right to complain to the Information Commissioner’s Office (ICO), though we would appreciate the chance to put things right first.

Keeping your data safe

We use appropriate technical and organisational measures to protect personal data, and we work with reputable providers who do the same. No system is perfectly secure, but we take reasonable steps to guard against loss, misuse, and unauthorised access.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “last updated” date at the top. Significant changes will be made clear on this page.