Who operates Graft
The data controller is Graft, RBN1 No. 786354, Raheny, Dublin.
Privacy questions can be sent to [email protected]. General questions can be sent to [email protected].
Information Graft handles
Graft handles the information needed to provide bookkeeping through WhatsApp. This can include:
- Your WhatsApp phone number, message identifiers, message type and delivery status.
- Text, voice transcripts, receipt and invoice files, and details read from those documents.
- Your business name, contact details, tax profile answers, invoice numbering and other profile choices.
- Your Google account identifier and email address, encrypted Google access tokens, and identifiers for files and folders Graft created.
- Bookkeeping records, processing status, corrections, audit history and technical error information.
- Stripe customer, subscription and payment-status identifiers. Graft does not receive your full card number.
- Basic website request information needed for security and to rate-limit subscription checkout requests.
Why the information is used
The information is used to connect your account, process the documents and instructions you send, keep your records separate from every other customer, create invoices when requested, manage subscriptions, provide support, prevent duplicate work, secure the service and diagnose faults.
Graft relies on these lawful bases:
- Contract, to provide the service you sign up for.
- Legitimate interests, to keep the service secure, prevent fraud and fix faults.
- Legal obligation, to keep billing records required by law.
Your Google Drive and Graft Books
Graft creates folders and a Graft Books spreadsheet in the Google account you connect. These are owned by that Google account. Files are private to the owning account by default.
Graft still needs access to process documents and update those records. The service also stores operational and audit information in its own systems. It would not be accurate to say that nobody at Graft can access or process customer information.
Services that process information
Graft uses the following providers to operate the service:
- DigitalOcean hosts the app and worker in Amsterdam, the Netherlands. Its managed PostgreSQL database stores account, message, record, audit and billing data. Its private AMS3 Spaces storage holds temporary media while it is processed.
- Meta runs the WhatsApp Cloud API. It receives your WhatsApp number, messages, media, replies and delivery information. Graft does not select an EU-only processing region for Meta.
- Google provides sign-in, Drive and Sheets. It receives your Google identity, connected files and bookkeeping records. Optional location lookup and invoice-email paths can also use Google Places and Gmail. The storage region follows your Google account and Google's systems.
- OpenAI receives document images, voice-note audio, extracted text and instructions needed to read documents, transcribe audio and understand requests. Graft does not select a regional OpenAI endpoint.
- Stripe receives checkout details, your phone number, customer and subscription identifiers, and payment status. Card details go directly to Stripe and are not received by Graft. Stripe uses global systems.
- Cloudflare provides DNS, the public website through Cloudflare Pages, and public advert video through Cloudflare R2 on its global network. It receives normal website request data such as IP address, browser details and requested pages.
Some providers process information outside the EU or EEA. Where that happens, Graft relies on the provider's data processing terms and a recognised safeguard, such as the EU-US Data Privacy Framework for certified US organisations or the European Commission's Standard Contractual Clauses.
How long information is kept
Graft keeps a private processing copy of an uploaded file or voice note for about 24 hours. The service then deletes that copy automatically. If cleanup fails, it tries again.
Message text, voice transcripts, extracted records, job history, audit history, Stripe events and the latest generated invoice PDF are stored in Graft's operational database. The code does not currently delete these automatically.
Billing records are kept for six years to meet Revenue requirements. Other personal data will be deleted within 30 days after you close your account or make a valid deletion request, unless Graft must keep it by law.
Manual deploy backups older than 30 days are deleted automatically, except that the newest rollback backup is kept until it is replaced. Unverified backup retention statement: DigitalOcean automatic database backups expire after seven days. This period needs operational verification.
Files and Sheets in your own Google Drive belong to you. Graft does not delete them when your Graft account closes. You can delete them in Google Drive whenever you choose.
OpenAI keeps API data under its own service terms. Graft does not make a separate deletion request to them after each job.
Security
Customer data is separated by tenant. Google tokens are encrypted. Access keys and encryption material are kept outside the application code. Graft uses controls intended to prevent one customer's information being returned to another customer.
No online system can be promised as completely secure. Report a suspected security or privacy problem to [email protected].
Your choices and rights
Depending on the law that applies, you may ask for access, correction, deletion, restriction, objection, portability or withdrawal of consent. Contact [email protected]. Graft may need to verify your identity before acting.
You may also complain to Ireland's Data Protection Commission at dataprotection.ie.
Changes to this policy
Graft will give 30 days' notice of material changes by WhatsApp or email. The updated policy will also be posted here with a new date.