Graft

PRIVACY POLICY

Last updated: May 2026

Who we are

Graft is a WhatsApp-based tool for Irish contractors and sole traders. It is operated by NXeraTech in Dublin, Ireland.

You can contact us at privacy@graftr.ie.

What data we collect

For waitlist signups, we collect your first name, company name and email address.

For active users, we collect your WhatsApp phone number, Google account connection through OAuth, plan tier and usage counts.

We do not store receipt images, VAT amounts, invoice content or any financial data on our servers. This data is written directly to your own Google Drive and Google Sheets account.

Why we collect it

We use waitlist data to contact you when Graft is ready for beta. We do this because you asked to join the waitlist and gave us consent.

We use account data to deliver the Graft service to you. That includes connecting WhatsApp to your Google Drive and Google Sheets account, tracking your plan and keeping the service working.

We never sell your data. We never share it with third parties except where needed to run the service.

Where your financial data lives

Your receipts, expenses and invoices are saved directly to your own Google Drive and Google Sheets: the account you connect during setup.

Graft writes to your account on your behalf. We do not store or retain any of this data ourselves. You remain in full control of your own financial data at all times.

Third parties we use

  • 360dialog for WhatsApp message routing. 360dialog is EU-based and GDPR compliant.
  • Google for the Drive and Sheets APIs used to store your data in your own account.
  • OpenAI for receipt image processing. Images are processed in transit and not retained.
  • Cloudflare for website hosting and delivery.

Your rights

Under GDPR you have the right to access the data we hold about you, have your data deleted, correct inaccurate data and withdraw consent at any time.

To exercise any of these rights, email privacy@graftr.ie and we will respond within 30 days.

Data retention

We keep your account data for the duration of your account, plus 12 months after closure.

Waitlist data is deleted once the product launches or earlier if you ask us to remove it.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.

Changes

We may update this policy from time to time. The date at the top of this page shows when it was last updated.

Continued use of Graft after changes means you accept the updated policy.