Privacy Policy

This explains what personal data Graft (thegraft.ie, an ALINX Company) collects, why, and what rights you have over it. Graft is the data controller for the information described here.

1. What we collect

If you're a Worker	Name, county, trade, years of experience, phone number, a short bio, and any certifications you choose to list. Your account email and password (handled securely via our authentication provider).
If you're a Company	Company name, your name, phone number, and email. Payment details are collected and processed directly by Stripe — we never see or store your card details ourselves.
Usage data	Basic activity on the platform — e.g. which profiles a Company unlocks, and reviews left — so the marketplace and your dashboard actually work.

2. How we use it

• To run your account and show your profile or dashboard;
• To let Companies find and unlock Worker profiles, and to notify Workers by text when this happens;
• To process subscription payments and keep your billing status accurate;
• To send account emails, such as password resets;
• To keep the platform safe — e.g. detecting unusual account activity or fair-use breaches;
• To improve the product, using aggregated, non-identifying statistics.

We don't sell your personal data, and we don't share it with anyone beyond what's needed to run the service (below).

3. Who we share data with

We use a small number of trusted providers to run Graft. Each only receives what it needs to do its job:

Supabase	Hosts our database and handles account authentication.
Stripe	Processes Company subscription payments. Card details go directly to Stripe — we never store them.
Twilio	Sends the text message to a Worker when their profile is unlocked.

These providers may process data on servers outside Ireland/the EEA. Where that happens, it's covered by their own standard contractual safeguards.

4. How long we keep it

We keep your data for as long as your account is active, and for a reasonable period after in case you return or for legitimate record-keeping (e.g. billing history). You can ask us to delete your data at any time — see below.

5. Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Ask us to delete your data ("right to be forgotten");
• Object to or restrict certain processing;
• Request a portable copy of your data;
• Complain to the Irish Data Protection Commission (dataprotection.ie) if you think we've got something wrong.

To exercise any of these, email hello@thegraft.ie. We'll get back to you within 30 days.

6. Cookies

Our marketing site uses minimal cookies needed for the site to function. We don't use third-party advertising trackers.

7. Children

Graft is for adults (18+) only. We don't knowingly collect data from anyone under 18.

8. Changes to this policy

If we make a material change to how we handle your data, we'll update this page and, where appropriate, let you know directly.

9. Contact

Questions about your data or this policy? Email hello@thegraft.ie.

← Back to Graft