Privacy Policy.

1. Who we are

Graft (“Graft”, “we”, “us” or “our”) helps sole traders, freelancers, contractors and small businesses organise financial administration, including receipts, invoices, statements, expenses, invoicing and financial reports.

Graft is currently operated by:

For the purposes of the General Data Protection Regulation (“GDPR”) and applicable Irish data protection law, YOUR FULL LEGAL NAME, trading as Graft, is the data controller in relation to personal data that Graft determines how and why to process.

If Graft is later operated through an incorporated company, this Privacy Policy will be updated to identify that company as the relevant controller.

2. Information we collect

Depending on how you use Graft, we may collect and process:

• your name, email address and contact information;
• your business name, business type and related business information;
• account credentials and authentication information;
• receipts, invoices, statements and other financial documents that you photograph, forward or upload;
• information contained in those documents, such as supplier or customer names, addresses, dates, amounts, transaction details, tax information, invoice numbers and descriptions of goods or services;
• information you enter when creating invoices, including customer contact details and invoice information;
• expense categories, financial summaries and reports generated through Graft;
• subscription, billing and payment information;
• communications you send to us, including support enquiries and feedback;
• your email address if you register for early access, updates or marketing;
• technical information such as IP address, browser type, device type, operating system, timestamps and diagnostic information; and
• website and application usage information collected through analytics technologies.

Because receipts, invoices and financial documents may contain information about customers, suppliers or other individuals, information you upload to Graft may include personal data relating to people other than you.

3. How we use personal data

We use personal data to provide and operate Graft. This includes receiving financial documents, extracting information from those documents, organising and categorising transactions, storing records, generating summaries and reports, providing invoicing features and allowing users to search, export and manage their financial information.

We may also use personal data to:

• create, authenticate and manage user accounts;
• process subscriptions and payments;
• provide customer support;
• maintain, secure and troubleshoot the Service;
• prevent fraud, misuse and unauthorised access;
• understand how the website and Service are used;
• improve Graft and develop new features;
• send important service communications;
• send product updates or marketing communications where permitted;
• maintain business and accounting records; and
• comply with legal, regulatory, tax and accounting obligations.

4. Document processing and Azure Document Intelligence

Graft uses Microsoft Azure Document Intelligence to analyse documents uploaded to the Service.

When you upload a receipt, invoice, statement or similar document, relevant document data may be transmitted to Microsoft Azure Document Intelligence so that information such as text, dates, suppliers, transaction amounts, invoice information and other document fields can be extracted.

The extracted information may then be returned to Graft and used to categorise, organise and report on your financial records.

Graft does not use automated document processing to make decisions about individuals that are intended to produce legal or similarly significant effects. You should review automatically extracted or categorised information before relying on it for tax, accounting or other important purposes.

5. Storage and Supabase

We use Supabase to provide backend infrastructure for Graft, including database, authentication and related application services.

Personal data associated with your account and information extracted from financial records may therefore be processed or stored using Supabase infrastructure.

6. Document storage and Cloudflare R2

We use Cloudflare R2 for object and document storage.

Financial documents that you upload to Graft, including receipts, invoices and statements, may be stored using Cloudflare R2. Access to stored documents is intended to be restricted to authorised users, systems and service providers that require access to operate the Service.

7. Payments and Stripe

We use Stripe to process subscription and other payments.

When you make a payment, Stripe may collect information such as your name, email address, billing information, payment method information and transaction details.

Payment-card information is processed by Stripe rather than being directly stored by Graft where Stripe's hosted payment infrastructure is used.

We may receive information from Stripe such as your payment status, subscription status, transaction identifiers and limited billing information so that we can administer your Graft subscription.

8. Google Analytics

We use Google Analytics to understand how visitors use the Graft website and, where applicable, the Service.

Google Analytics may process information including pages viewed, approximate location derived from IP address, device and browser information, interactions with the website and similar usage information.

Where consent is required for non-essential analytics technologies, we will request that consent before using them. You can withdraw or change your cookie or analytics preferences through the cookie controls made available on our website, where applicable.

9. Email and enquiries

Our contact email address is graftassistant.app@gmail.com.

If you contact us by email, the information contained in your message will be processed for the purpose of responding to your enquiry and maintaining appropriate records of our communications.

Because this mailbox is provided by Google, information contained in emails may also be processed through Google's email infrastructure.

10. Early-access forms and FormSubmit

If you provide your email address through an early-access, waitlist or similar form, we use that information to register your interest in Graft and communicate with you about availability, product updates and launch information.

We use FormSubmit to process and transmit submissions from our website forms. When you submit a form, the information you enter may be processed by FormSubmit for the purpose of delivering that submission to us at graftassistant.app@gmail.com.

You should only provide information through our forms that is reasonably necessary for your enquiry or registration.

11. Legal bases for processing

Where the GDPR applies, we rely on one or more legal bases for processing personal data.

We process information where necessary to perform our contract with you, including to create your account and provide the Graft Service.

We process certain information where necessary to comply with legal obligations, including applicable accounting, taxation and regulatory requirements.

We may process information where necessary for our legitimate interests, including securing and improving Graft, preventing fraud, providing customer support and administering our business, provided those interests are not overridden by your rights and interests.

Where required, we rely on your consent, including for certain marketing communications, cookies and analytics technologies. Where processing is based on consent, you may withdraw your consent at any time.

12. Information about other people

Documents uploaded to Graft may contain personal data relating to customers, suppliers, employees, contractors or other third parties.

If you provide Graft with personal data relating to another person, you are responsible for ensuring that you have a lawful basis or other appropriate authority to collect that information and provide it to Graft.

Where Graft processes such personal data solely to provide the Service on behalf of a business user, Graft may act as a processor and the relevant business user may act as the controller in respect of that information.

13. Service providers

We use third-party providers to help us operate Graft. Our principal providers currently include:

• Microsoft Azure / Azure Document Intelligence — document analysis and information extraction.
• Supabase — database, authentication, backend and related application infrastructure.
• Cloudflare R2 — file and document storage.
• Stripe — payment and subscription processing.
• Google Analytics — website and usage analytics.
• Google / Gmail — business email and communications.
• FormSubmit — transmission and processing of website form submissions.

We may also use other hosting, security, monitoring, communications and professional service providers where reasonably necessary to operate Graft.

14. Do we sell personal data?

No. Graft does not sell personal data to third parties.

We do not provide financial documents or their contents to third parties for them to independently advertise products or services to you.

15. International data transfers

Some of our service providers operate internationally, and personal data may therefore be processed outside Ireland or the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA and applicable law requires safeguards, we will rely on an appropriate transfer mechanism, which may include an adequacy decision, standard contractual clauses or another transfer mechanism permitted under applicable data protection law.

16. Data retention

We do not retain every type of personal data for the same length of time. We retain information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, accounting, tax, contractual and security requirements.

Financial records, invoices, receipts, transaction records and related accounting information may be retained for up to seven years from the relevant transaction, accounting period or creation date where this is reasonably necessary for accounting, tax, record-keeping, dispute-resolution or legal purposes.

The seven-year period is a maximum policy period for relevant financial records and does not mean that the GDPR requires all personal data to be retained for seven years.

Account information will generally be retained for as long as your account remains active and for a reasonable period afterwards where required for legitimate business, security or legal purposes.

Documents that are no longer necessary may be deleted earlier, including where you validly request deletion and we have no overriding legal or contractual reason to retain them.

Analytics information is retained according to our configured analytics retention settings. Support communications and business correspondence may be retained for as long as reasonably necessary to deal with enquiries, disputes, security matters and business record-keeping.

Backups may retain copies of information for a limited additional period before they are overwritten or securely deleted.

17. Deleting your account and data

You may contact us at graftassistant.app@gmail.com to request deletion of your account or personal data.

Where your request is valid, we will delete or anonymise personal data unless we are required or permitted to retain particular information for legal, tax, accounting, fraud-prevention, dispute-resolution or other legitimate purposes.

18. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, misuse or disclosure.

These measures may include encryption, access controls, authentication controls, secure communications, infrastructure security and limiting access to people and systems that require the information to provide the Service.

No internet-based service can guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and should contact us promptly if you believe your account has been compromised.

19. Your data protection rights

Where the GDPR applies, you may have rights including the right to:

• access personal data we hold about you;
• obtain a copy of certain personal data;
• correct inaccurate or incomplete information;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a data protection supervisory authority.

These rights are subject to conditions and exceptions under applicable law and will not apply in every circumstance.

To exercise your rights, contact graftassistant.app@gmail.com. We may need to verify your identity before acting on a request.

If you are in Ireland, you also have the right to lodge a complaint with the Data Protection Commission of Ireland.

20. Marketing communications

If you sign up for early access, product announcements or marketing communications, we may use your email address to send those communications.

You may unsubscribe at any time by using an unsubscribe mechanism included in the communication, where available, or by contacting graftassistant.app@gmail.com.

21. Cookies

Graft may use cookies and similar technologies that are necessary for the website or Service to function, including technologies used for security, authentication and remembering preferences.

We may also use non-essential cookies and similar technologies for analytics, including Google Analytics.

Where required, non-essential analytics technologies will not be used until you have made the relevant consent choice. Further details about cookies may be provided through our cookie banner or a separate Cookie Policy.

22. Children

Graft is intended for people carrying out business, professional or self-employed activities and is not designed as a service for children.

We do not knowingly seek to create accounts for or market Graft directly to children. If you believe that a child has provided personal data to Graft inappropriately, contact us at graftassistant.app@gmail.com.

23. Changes to this Privacy Policy

We may update this Privacy Policy as Graft develops, our technology providers change or our legal obligations change.

Where changes are material, we will take reasonable steps to bring them to users' attention. The “Last updated” date at the top of this Privacy Policy indicates the date of the latest revision.

24. Contact

If Graft becomes operated by an incorporated company, this section will be updated with that company's legal name, registration details and address.