Who we are

Grafta is an independently operated service based in Ireland, a product of Axial Design (a registered business name). The data controller for the purposes of GDPR is the owner of Grafta, a sole trader trading as Axial Design, based in Ireland, contactable at privacy@grafta.ie. If you need a postal address for formal correspondence — for example, to exercise a data subject right or file a complaint — email us and we'll provide one for that request.

What information we collect

When you sign up, we collect your name, email address, and the business details you enter (business name, address, VAT number, bank details for invoice footers, etc.).

When you use Grafta, we store the customers, jobs, quotes, invoices, receipts, tasks, compliance items and voice notes you create.

When you use Voice Notes, we send your audio to OpenAI to convert your speech to text and then to interpret the transcript into suggested actions (create a task, draft an invoice, etc.). The recording is deleted as soon as it's transcribed — we keep the resulting text and the actions you approve, never the audio itself. Nothing is committed to your account until you review and approve each action. You can edit or discard any suggestion before it becomes real data.

We also store minimal technical data: IP address on login, login timestamps, and device/browser information needed to keep your account secure.

Why we collect it

We collect your data to run the service — so you can create invoices, track jobs, and manage your business — and to meet our legal obligations (tax record retention, security, fraud prevention). We don't sell your data and we don't use it for advertising.

Where your data is stored

Your account data (database records) is hosted on Railway's EU region. Uploaded files (receipt photos, business logos) are stored in a Cloudflare R2 bucket with EU jurisdiction, meaning the files stay physically within the European Union. Voice-note audio passes through the same EU storage only briefly while it's transcribed, then it's deleted.

Some of our sub-processors (Stripe, OpenAI, Sentry, Resend) are US-based. Transfers to these processors are covered by Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

Who we share it with (sub-processors)

Under Article 28 GDPR we disclose every third-party processor that touches your data:

Railway (US, EU region) — hosts the Grafta application and Postgres database in the EU. Sees all application data in transit while the app is running.
Cloudflare R2 (EU jurisdiction) — stores uploaded files (receipt photos, logos) physically in the EU; voice-note audio only transiently while it's transcribed, then deleted. Covered by Cloudflare's DPA and Standard Contractual Clauses.
Stripe (US/IE) — handles subscription payments. Receives your name, email, and billing details. We never see or store full card numbers.
OpenAI (US) — receives voice note audio (Whisper model) and resulting transcripts (Chat Completions model) to return a text transcription and suggested actions. OpenAI API traffic is, per their published policy, not used to train their models. Zero-retention enrolment is a separate OpenAI programme that we have not independently confirmed is active on our account — we do not rely on it in this policy.
Resend (US) — delivers transactional emails (sign-up verification, password resets, team invites, billing notifications). Receives recipient name and email address.
Sentry (US) — receives error reports, performance traces and masked session replays so we can diagnose crashes. We mask every text field and every input in session replays, strip emails/IBANs/Eircodes/phone numbers before sending, and disable default PII collection. Covered by Standard Contractual Clauses.
Microsoft Clarity (US) — optional, opt-in only — loaded solely if you accept analytics in the cookie banner. It records masked session replays and heatmaps of how the site is used so we can improve it. Text and inputs are masked, and we don't use it in the authenticated app in a way that exposes your customer or financial data. Never loaded if you decline. Covered by Microsoft's DPA and Standard Contractual Clauses.
Meta Platforms (US/IE) — optional, opt-in only — if you accept analytics in the cookie banner, the Meta Pixel measures whether our Facebook/Instagram ads led to a sign-up (an anonymous "someone signed up" event — never your business data, customers or invoices). Never loaded if you decline. Covered by Meta's data processing terms and Standard Contractual Clauses.

We don't share your data with anyone else unless we're legally required to (e.g., a court order or a Revenue inspection).

How long we keep it (retention)

Account data — kept while your account is active. When you delete your account, all customers, jobs, quotes, tasks, voice notes, compliance items and account-level records are deleted immediately in a single transaction, and their files in R2 are removed on a best-effort basis right after.
Financial records (invoices and receipts) — retained in anonymised form for 6 years as required by Irish tax law (Section 886, Taxes Consolidation Act 1997). The retained records contain amounts, VAT, dates and a masked VAT number only — no customer names, addresses or line-item descriptions.
Account deletion log — a hashed (SHA-256) copy of your email plus a deletion summary is kept for 6 years so we can respond to regulator inspections and prove the deletion happened.
Error logs (Sentry) — retained for Sentry's default ~90 days, then auto-deleted.
Request/infrastructure logs (Railway) — retained for Railway's default period (~30 days) and then rotated out.
Stripe billing records — retained by Stripe for as long as Stripe requires for its own financial reporting.

Your rights

Under GDPR Articles 15–22 you have the right to:

Access / portability — use "Export All Data" in Settings to download a machine-readable copy of your data.
Rectification — edit your business profile, customers, jobs and other records directly in the app.
Erasure — use "Delete Account" in Settings. Deletion runs immediately (subject to the 6-year financial-record retention above).
Restriction and objection — email privacy@grafta.ie and we'll act on requests within 30 days.
Withdraw consent — where we rely on consent, you can withdraw it at any time.
Complain — to the Irish Data Protection Commission at www.dataprotection.ie.

Cookies and local storage

Grafta always sets a small number of strictly-essential cookies to keep you signed in. The only non-essential cookies are for optional analytics (Microsoft Clarity), and they're set only if you accept in the cookie banner. We don't use advertising cookies or cross-site tracking that profiles you across other websites.

The cookies and browser storage actually set are:

access_token and refresh_token — HttpOnly, Secure, SameSite cookies set by our backend when you log in. These keep you signed in. Essential.
Local storage (not cookies) — we use your browser's local storage for UI state only: the cookie-banner dismissal flag, onboarding dismissal, your "My Work" filter preference, schedule view mode, and a non-sensitive session hint that lets us skip a speculative auth check on first load. Nothing in local storage is shared with anyone.
Service Worker / PWA cache — if you install Grafta as an app, your browser caches static assets and some API responses for offline support.
Sentry session replay — when enabled in production, Sentry stores a short, masked replay of your session in your browser's memory so that if an error happens it can be sent to us for debugging. All text and inputs are masked.
_clck / _clsk (Microsoft Clarity) — set only if you accept analytics in the cookie banner. They let Clarity stitch together a masked recording of your visit so we can see where the site can be improved. Decline and they're never set; you can withdraw later by clearing cookies. Not essential.
_fbp (Meta Pixel) — set only if you accept analytics in the cookie banner. It lets Meta attribute a sign-up to one of our Facebook/Instagram ads. Decline and it's never set. Not essential.

Security issues and abuse

To report a security vulnerability, email security@grafta.ie. To report abuse of Grafta (spam, fraudulent invoices, impersonation), email abuse@grafta.ie.

Data Processing Addendum (business customers)

If you use Grafta to process data about your own customers, you are the data controller for that data and Grafta acts as your data processor under Article 28 GDPR. The commitments in this Privacy Policy and our Terms of Service form the core of our processor obligations. A standalone Data Processing Addendum is available on request by emailing privacy@grafta.ie.

Contact

For privacy questions, data subject rights requests, or to receive a postal address for formal correspondence, email privacy@grafta.ie. We respond within 30 days as required by GDPR.