Privacy Policy

This policy explains what The Graphite Lab Inc. collects, why we collect it, who helps us handle it, and the choices you have. We wrote it to be read by a shop owner on a phone, not a lawyer at a desk. If something is unclear, email us at contact@thegraphitelab.com.

The short version

We sell software to trades businesses. Most of what we collect is business contact information: your name, work email, company, and phone number.
When a shop uses our tools, the data inside them (their customers, calls, jobs, and invoices) belongs to the shop. We handle it to run the tools, under our agreement with that shop. We don’t use it to train AI models.
Outside companies help us run the site and the business, including AI providers. We name the main ones below.
We don’t sell your personal information for money.
Our site uses cookies and analytics tools. The Cookie Settings link in our site footer turns the optional ones on or off. Session recordings only run if you say yes.
You can ask to see, fix, or delete your information by emailing contact@thegraphitelab.com.

Who this policy covers

“The Graphite Lab,” “TGL,” “we,” and “us” mean The Graphite Lab Inc., 1011 Hancock Street, Suite 102, Philadelphia, PA 19123. We work with shops in the United States and Canada.

This policy covers information we collect for our own purposes. That includes people who visit graphitelab.ai, chat with ELI, sign up for our emails, book a call, ask for a quote, or buy a plan, and the people at our customers who manage their account and billing. For that information, we decide how it’s used.

It works differently for data that flows through our tools on a shop’s behalf, like the shop’s customers, calls, jobs, and invoices. There, the shop decides how the data is used and we follow its instructions. The section “Data inside our tools” explains this.

What we collect

What you give us

Contact form.Your name, email, company, the reason you’re writing, your message, and the page you sent it from.
Booking a call. We use Calendly for scheduling. When you book on our site, we send Calendly your name, email, the answers you give, and a phone number if you ask for text reminders. We keep a record of the booking.
Quotes. If we prepare a quote for you, we store your name, company, email, phone number, website, and the answers you give about your business. Anyone with your quote link can open it, so treat the link like a private document.
Buying a plan. Checkout runs on Stripe. Stripe collects your name, business name, email, billing address, phone number, and payment card. Stripe shares your billing details with us. We never see or store your full card number.
Email sign-up. Your email address.
ELI chat.Whatever you type to ELI, and ELI’s replies.
Emails and calls with our team. What you tell us when you write to us or talk to us.

What we collect automatically

When you visit the site, our servers and tools record technical details: your IP address, browser and device type, the pages you view, how you got here (like the referring site or campaign tags in the link), and what you click. From your IP address we, or our tools, can estimate your general location (city or region) and sometimes the company you work for. We collect this through cookies and similar technologies, explained below.

What we get from other sources

Sales and marketing tools. Apollo and HubSpot may tell us which company a visitor works for, and add business details like company size, industry, or a work email.
Public sources. Business details from company websites, professional profiles, and business directories.
Partners and referrals. If someone refers you to us, they may share your contact details.

In legal terms

Some state privacy laws ask us to describe this using their categories. In the last 12 months we have collected:

Identifiers, like your name, email, phone number, IP address, and cookie IDs.
Customer records, like your billing address and the business you buy for.
Commercial information, like the plans you looked at, were quoted, or bought.
Internet activity, like pages viewed and clicks on our site.
Approximate location, estimated from your IP address.
Professional information, like your company and role.
Electronic information, like the text of your ELI chats and messages to us.
Inferences, like the company and industry a visitor likely belongs to.

We don’t ask for sensitive information, like Social Security numbers, health details, or precise location. Please don’t send it to us, including in ELI chats.

How we use it

To answer your questions and hold the calls you book.
To prepare quotes, sell plans, and bill you.
To set up and support your account.
To send the emails you sign up for.
To market our products to businesses, including following up with companies that visited our site or asked about us.
To understand how the site is used and make it better, like which pages help and which confuse.
To keep the site secure, block bots and spam, and prevent fraud.
To follow the law, enforce our Terms of Service, and protect our rights and other people’s safety.

If we want to use your information for something new that you wouldn’t expect from this list, we’ll tell you first, and ask for your permission where the law requires it.

ELI, our site chat assistant

ELI is an AI assistant, not a person. It can get things wrong, so don’t rely on it for decisions about your account, your bill, or anything legal or safety related. Book a call or email us for those.

ELI runs on ElevenLabs. When you open the chat, your messages go to ElevenLabs, which uses Anthropic’s Claude model to write ELI’s replies. ElevenLabs may also use other AI models, such as Google’s Gemini, to analyze or summarize conversations for us. ElevenLabs stores chat transcripts for us, and we can read them. We use them to answer follow-up questions and to make ELI better.

These providers handle chat data under their own terms and privacy policies, which may let them use it to run and improve their services. Don’t put anything in the chat you wouldn’t put in an email to a stranger, like card numbers, passwords, or your customers’ personal details. If you want a transcript deleted, email us with roughly when you chatted and what you asked.

The chat only loads when you open it. Nothing is sent to ElevenLabs if you never click “Ask ELI.”

Data inside our tools

Our tools connect to the systems a shop already uses, like ServiceTitan, BuildOps, Housecall Pro, Jobber, ServiceNow, and Acumatica. Depending on the tools a shop turns on, they may handle the shop’s customer names, addresses, and phone numbers, job and invoice records, reviews, emails, text messages, and phone calls, including call recordings and transcripts.

That data belongs to the shop. For it, we act as the shop’s service provider (in some laws, a “processor”). We use it to provide the tools the shop asked for, to support and secure them, and as our agreement with the shop allows. Our Terms of Service and Data Processing Addendum with the shop control how we handle this data. If that agreement and this policy disagree, the agreement wins.

Some tools use AI models to do their work, like answering a call, writing up a call, or drafting a reply. The AI providers we use are OpenAI, Anthropic, and ElevenLabs. Phone calls and texts run through Twilio and ElevenLabs. Each provider receives only the data it needs for the task.

We don’t use data inside our tools to train AI models, and we don’t let our AI providers train on it. If you’re a customer, our Data Processing Addendum lists every provider that handles your data.

Shops decide whether to use features that answer, record, or transcribe calls, or that send texts and emails. The shop is responsible for giving any notice and getting any consent the law requires, like telling callers a call may be recorded. Some states, including Pennsylvania and California, require consent from everyone on a call before it’s recorded.

If you’re a customer of a shopthat uses our tools and you have a question about your information, contact that shop. It controls the data and can act on your request. We’ll help the shop respond. If you contact us by mistake, we’ll point you to the shop.

We share personal information with companies that help us run the business. Most may use it only to do work for us. Some, like the analytics, marketing, and AI providers noted below, can also use what they collect under their own terms. The main ones today:

Hosting and infrastructure. Vercel hosts the site and stores some files. Supabase stores form submissions, quotes, and booking records. Cloudflare (R2) stores and delivers blog images.
Payments. Stripe processes payments and subscriptions.
Sales, marketing, and email. HubSpot is our customer database and tracks visits to our site. Apollo helps us identify businesses that visit and find business contact details. Resend sends our emails. Calendly schedules calls. Slack carries internal alerts to our team when someone submits a form or books a call.
Analytics. Google Analytics (loaded through Google Tag Manager), PostHog, and Vercel Web Analytics and Speed Insights.
AI and phone providers. ElevenLabs runs ELI, using models from Anthropic and others. ElevenLabs also reads our blog posts aloud, which uses only our own writing, not your data. Our tools use OpenAI, Anthropic, and ElevenLabs for AI, and Twilio and ElevenLabs for calls and texts.
Security. Arcjet screens traffic for bots and abuse, which means it sees your IP address and browser details, and checks whether an email address can receive mail.

We may also share personal information:

With professional advisers, like lawyers and accountants, who need it to advise us.
When the law requires it, like a valid subpoena, or to protect the rights, property, or safety of TGL, our customers, or others.
As part of a merger, acquisition, financing, or sale of assets. The new owner would have to treat it the way this policy says.
With anyone else, when you ask us to or agree to it.

Cookies and analytics

Cookies are small files a website stores in your browser. We and our tools use cookies, browser storage, and similar technologies. They fall into three groups:

Necessary. These keep the site working and secure and remember your cookie choices. Examples: your cookie choice (kept in your browser) and a cookie noting which privacy rules apply where you are.
Analytics. These show us how people use the site. Google Analytics and PostHog set cookies that recognize your browser across visits. PostHog records what you click and, only if you agree, a replay of your visit with typed inputs hidden. Vercel Web Analytics and Speed Insights measure traffic and page speed without cookies.
Marketing.HubSpot’s cookies connect your visits to your contact record if you’ve given us your email, and HubSpot can capture what you submit in forms on our site. Apollo’s cookie and your IP address help identify the company you work for.

We don’t run ad network pixels, like Meta’s or LinkedIn’s, on our site.

Your cookie choices

What’s on by default depends on where you are. In the EU, the UK, Switzerland, and Quebec, analytics and marketing tools don’t load until you turn them on. Everywhere else they’re on by default, and you can turn them off. Session recordings only run if you say yes, wherever you are. Use (also in our site footer) to make or change your choice. If you turn something off, we delete its cookies and reload the page without it. We ask again after a year. You can also:

Block or delete cookies in your browser settings.
Use a browser or extension that blocks trackers.
Install Google’s Analytics opt-out add-on.

Blocking cookies may break parts of the site, like booking a call.

We don’t sell personal information for money, and we don’t sell or share information about anyone we know is under 16.

Some state laws define “selling” and “sharing” broadly enough to include letting analytics and marketing companies collect data on a website, when those companies can also use it for their own purposes. Google, Apollo, and HubSpot collect information like your IP address, cookie IDs, and pages viewed on our site. In the last 12 months, they collected identifiers, internet activity, approximate location, and inferences about your company, to help us analyze our site and find and reach likely customers. If you want to opt out of this, decline cookies in Cookie Settings, use the browser steps above, or email contact@thegraphitelab.comwith “Do not sell or share” in the subject line.

Global Privacy Control (GPC) is a browser setting that tells sites you want to opt out. When your browser sends it, we treat it as an opt-out: marketing cookies stay off and can’t be turned on. We don’t respond to “Do Not Track” signals.

Emails from us

If you sign up for our emails, we send you one when we publish something new. We may also email you about a call you booked, a quote, or your account. Every marketing email has an unsubscribe link, or you can email us. Unsubscribing from marketing doesn’t stop emails about your account, billing, or a quote you asked for.

We only send marketing emails to people who signed up or otherwise agreed to hear from us, as Canada’s anti-spam law requires. After you unsubscribe, we keep your email address on a do-not-email list so we don’t write to you again by mistake.

How long we keep it

We keep personal information only as long as we need it for the reasons in this policy, then delete it or strip out what identifies you. How long depends on what it is:

Contact, booking, and quote records:while we’re talking with you and for a reasonable time after, in case you come back.
Customer and billing records:while you’re a customer, and after that for as long as tax, accounting, and other laws require.
Email list: until you unsubscribe. Then only on our do-not-email list.
ELI transcripts: until we no longer need them to run and improve ELI, or until you ask us to delete yours.
Analytics data: for the period set in each analytics tool.
Data inside our tools:as set by the shop’s agreement with us.

We may keep information longer if we need it to resolve a dispute, meet a legal obligation, or enforce our agreements.

Your privacy rights

Depending on where you live, you may have the right to:

Know what personal information we have about you, where it came from, why we use it, and who we share it with.
Get a copy of it in a usable format.
Correct it if it’s wrong.
Delete it, with some exceptions the law allows.
Opt out of selling, sharing, or targeted advertising, as described above.
Appeal if we turn down your request.
Not be treated differently, like being charged more, for using these rights.

You can ask even if you’re not sure your state’s law covers you.

How to make a request

Email contact@thegraphitelab.comwith “Privacy request” in the subject line. Tell us what you want us to do and the email address or phone number you’ve used with us.

To protect you, we’ll confirm the request came from you, usually by matching it to the contact details we have or by asking you to confirm from that email address. We’ll only ask for what we need to verify you, and we’ll use it only for that.

You can have someone else, an authorized agent, make a request for you. We’ll ask for your signed permission and may still need to verify your identity with you directly.

We’ll respond within the time your state’s law requires, usually 45 days. If we need more time, we’ll tell you why. If we turn down your request, we’ll explain why. To appeal, reply to our decision with “Appeal” in the subject line and we’ll review it again. If you still disagree, you can contact your state attorney general.

For data inside our tools, send your request to the shop you deal with. See “Data inside our tools” above.

If you’re in Canada

You can ask to see the personal information we hold about you, have it corrected, and withdraw your consent to how we use it, subject to legal and contract limits. We’ll respond within 30 days. Our Privacy Officer is responsible for how we handle personal information and can be reached at contact@thegraphitelab.com. If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec, the Commission d’accès à l’information.

How we protect it

We use reasonable safeguards for the kind of information we hold. The site uses encrypted connections (HTTPS). We limit who on our team can see personal information, and we rely on established providers for hosting, payments, and storage. No system is perfectly secure, so we can’t promise your information will never be accessed without permission. If a breach affects you, we’ll tell you as the law requires. For data inside our tools, we’ll tell the shop, and the shop will tell you.

Children

Our site and services are for businesses and adults. They are not meant for anyone under 18, and we don’t knowingly collect personal information from children. If you believe a child has given us personal information, email us and we’ll delete it.

Where your data is processed

We’re based in the United States and serve businesses in the United States and Canada. Your information is stored and processed in the United States, and in other countries where our service providers operate. If you’re in Canada, that means your information may be accessed by courts, law enforcement, and government authorities there under those countries’ laws.

Changes to this policy

We’ll update this policy when our practices change. The date at the top shows when it last changed. This version was last updated on October 10, 2026. If we make a change that matters, like using your information in a new way, we’ll give notice on the site or by email before it takes effect.

Contact us

Questions, requests, or complaints about privacy go to our Privacy Officer at contact@thegraphitelab.com, or by mail to The Graphite Lab Inc., Attn: Privacy Officer, 1011 Hancock Street, Suite 102, Philadelphia, PA 19123.