Graft

PRIVACY POLICY

Last updated: May 2026

Who we are

Graft is a WhatsApp-based tool for Irish contractors and sole traders. It is operated by NXeraTech in Dublin, Ireland.

You can contact us at privacy@graftr.ie.

What data we collect

For waitlist signups, we collect your first name, company name and email address.

For active users, we collect your WhatsApp phone number, Google account connection through OAuth, plan tier and usage counts.

We do not store receipt images, VAT amounts, invoice content or any financial data on our servers. This data is written directly to your own Google Drive and Google Sheets account.

Why we collect it

We use waitlist data to contact you when Graft is ready for beta. We do this because you asked to join the waitlist and gave us consent.

We use account data to deliver the Graft service to you. That includes connecting WhatsApp to your Google Drive and Google Sheets account, tracking your plan and keeping the service working.

We never sell your data. We never share it with third parties except where needed to run the service.

Where your financial data lives

When you sign up to Graft, you connect your own Google Drive. Every receipt, invoice and record we process on your behalf is written directly into that Google account - the one you own and control.

We do not store your financial data on our servers. We never have access to it. Graft is the bit in the middle that reads your WhatsApp message and puts the result into your folder. That's all.

If you want to see everything in one place, just message us and we'll send you a link straight to your folder.

Third parties we use

  • 360dialog for WhatsApp message routing. 360dialog is EU-based and GDPR compliant.
  • Google for the Drive and Sheets APIs used to store your data in your own account.
  • OpenAI for receipt image processing. Images are processed in transit and not retained.
  • Cloudflare for website hosting and delivery.

Your rights

Under GDPR you have the right to access the data we hold about you, have your data deleted, correct inaccurate data and withdraw consent at any time.

To exercise any of these rights, email privacy@graftr.ie and we will respond within 30 days.

Data retention

We keep your account data for the duration of your account, plus 12 months after closure.

Waitlist data is deleted once the product launches or earlier if you ask us to remove it.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.

Changes

We may update this policy from time to time. The date at the top of this page shows when it was last updated.

Continued use of Graft after changes means you accept the updated policy.