Legal
Data processing addendum
For organizations on Team or Enterprise whose own data-protection rules need it. It adds to the terms and follows the privacy policy; where they disagree on personal data you give Graft to process, this addendum wins.
Last updated: October 30, 2026
This addendum is between your organization (the "customer", the controller) and Craig Merry, a sole proprietor doing business as Graft ("Graft", the processor). It applies once your organization uses Team or Enterprise. To have a copy signed by both sides, email support@graftfork.com with your organization's legal name; we send it back by email.
What Graft processes, and why
- Subject matter: keeping your organization's forks current with their upstream releases: syncs, fork scans, early warnings, reviews and the records of each.
- Personal data: your members' email addresses and roles; names and email addresses that appear in your repositories' commit history, which Graft reads but doesn't extract or store apart from the code; who did what in the organization's audit log; sign-in records (a hash of the IP address, the country, the time).
- Data subjects: your members, and the authors of commits in the repositories you connect.
- Duration: while your organization uses Graft, then the deletion below.
- Instructions: Graft processes this data only to run the service as you configure it in /app and as these terms describe, and on your other written instructions by email. Graft tells you if it thinks an instruction breaks the law.
Subprocessors
The subprocessors are the ones named in the privacy policy: Cloudflare (hosting, database, storage, email), Anthropic (the sandboxes and agents that run each sync), Stripe (payments), Google (the support inbox), your git host and OSV.dev. On Enterprise with syncs in your own Anthropic account, Anthropic processes your code under your own agreement with it, not Graft's. Graft gives 30 days' notice by email before adding a subprocessor; you may object by email, and if we can't resolve it you may end the service and get back any fee paid for the time after it ends.
Security
The measures are described on the security page. In short: each run is a short-lived sandbox with limited networking; each run's clone token is read-only for one repository and lives in that run's vault (only a copy that chose pull requests and isn't a fork gets a token that can write, to that repository, for its graft/ branch); secrets are encrypted at rest; sign-in needs an authenticator code; the operator console needs a secret token. Graft is run by one person, who is the only one with access to production and is bound by these terms.
If something goes wrong
Graft emails your organization's owners without undue delay, and within 72 hours, after it learns of a breach of security that affects your personal data: what happened, what data, what Graft has done, and who to write to. Graft keeps a record of each incident.
Your people's requests, and your audits
- Graft helps you answer your data subjects' requests (access, correction, deletion) within what the service holds, and passes on any such request it receives directly.
- Graft answers your security questionnaire by email once a year, and more often after an incident. Graft has no SOC 2 or ISO 27001 report. An on-site audit is by agreement, at your cost.
When you leave
Disconnecting a copy deletes its conflicts, its kept move and its vault at once. When your organization stops using Graft, ask by email and Graft deletes the organization, its members' accounts if they ask, and its remaining data within 30 days, except the signed records of each run and the account history, which are kept for seven years for tax, accounting and accountability (see how long we keep it), and anything a legal hold keeps.
Where data goes
Graft is in the United States, and its subprocessors may process data in other countries (Cloudflare serves from its worldwide network). If you transfer personal data from the EU, the UK or Switzerland, the European Commission's standard contractual clauses (module two, controller to processor) apply as part of this addendum, with the details above as their annexes, and the law of Ireland where the clauses need one.
Contact
Craig Merry, doing business as Graft, Carmichael, California. support@graftfork.com.