Privacy notice
Who we are
Graftr HQ is run by GRAFTR SYSTEMS LTD, a company registered in England and Wales, number 16960119, registered office 46 Priorwood Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 0XH.
We are the "controller" of your personal data in the ways described below. Contact us about your data: privacy@graftrhq.com. We have not appointed a Data Protection Officer because we are not required to; the contact above deals with privacy.
What Graftr HQ is, in one paragraph
Graftr HQ lets people find tradespeople, send a request for a quote, and manage a job. We introduce customers and tradespeople. The work contract is between the customer and the tradesperson (see our customer terms). Tradespeople use our app, Graftr HQ. Customers use web pages sent to them by link, with no account.
This notice covers three groups: customers, tradespeople, and website visitors. Find your group below.
1. If you are a customer
This is you if you send a request or use a Graftr link.
What we collect
| What | Why we need it |
|---|---|
| Your first name, full name, email, and optional mobile number | To pass your request to the tradesperson you chose, and to send you your quote, booking and job updates |
| Your postcode, and once you book, your full address (you can type it or pick from a Google address search) | To check the tradesperson covers your area and works out distance, and so they can come to your home |
| What you want done, photos and one short video you upload | So the tradesperson can understand the job and price it |
| Your answers when you accept a quote, confirm a visit or pick a date: your name, time, device information and IP address | To keep a record that you agreed, so everyone can rely on it |
| Notes and photos you send on a booked job, "ask about extra work" requests, requests to change a date | To run the job |
| Reviews you write (rating, comment, first name) and any tip you pay | To show real reviews and to pass tips to the tradesperson |
| Whether you ticked "Get updates on WhatsApp", and when | So we only WhatsApp you if you chose it |
| Links to your pages (random codes, stored as scrambled codes in our database) | So only you can open your quote and job pages |
| Reports you make about content | To check the content |
We do not ask for card details. If you pay by card, you enter them on Stripe's secure page; we never see or store the full card number.
Who sees your details
- Before you book: the tradesperson sees only your first name, your postcode area (for example LS6), the distance, your description and photos. They do not see your phone, email or full address.
- After you accept a quote or confirm a visit: we share your full name, phone, email and address with that tradesperson (and only that one) so they can do the job.
- Reviews you write show your first name and rating on the tradesperson's page.
- We never sell your details, and never share them with other tradespeople for their marketing.
Why we are allowed to use your data
- Contract, or steps before a contract: passing your request to the tradesperson, quote and booking messages, booking emails, WhatsApp job updates you asked for.
- Consent: WhatsApp updates (tick box), and any marketing we send in future (we will ask separately). If a tradesperson wants to show photos of your job in a public post, they must confirm they have your permission first.
- Legitimate interests: keeping records of who agreed to what (acceptance records), keeping the service secure and preventing fraud and fake reviews, answering your questions, showing real work in Discover (anonymised work only), improving the service. We have weighed this against your rights and do not use it for anything you would not reasonably expect.
- Legal obligation: tax and accounting records, responding to lawful requests.
How long we keep it
See the table in section 5.
2. If you are a tradesperson
What we collect
| What | Why |
|---|---|
| Name, business name, email, trade, postcode or base location, phone (optional), password (stored scrambled by our login provider) | To set up and run your account |
| Business profile: photos, videos, captions, town, "about", reviews you receive, availability and working hours | To show your public page and Discover |
| Your customers' details as they reach you (see section 1) | So you can quote and do jobs |
| Quotes, invoices, payments records, job photos and notes, site-visit and booking details | To run your jobs and give you records |
| Card on file for fees: Stripe customer id, card brand and last four digits (the full card number is held by Stripe) | To collect Graftr fees |
| Stripe Connect details: Stripe account id, whether payouts and card payments are on. Identity and bank checks are done by Stripe, not us | To let customers pay you by card |
| VAT number (optional) | For invoices |
| Bank details you choose to add (account name, sort code, account number) | To show on your invoices so customers can pay you by bank transfer. We never move money to or from this account; we remove it when you close your account |
| Fees, collections and our records of them | To charge and audit our fees |
| Your device's push notification token and platform (iOS or Android) | To send you notifications you asked for |
| Login security records and an audit trail of important actions | To keep accounts safe and to investigate problems |
| App error reports (which screen failed, a technical message, the app version and your business account, so we can fix the fault; no names or customer details) | To find and fix faults |
| Support emails and reports about content | To help you and keep the platform safe |
Why we are allowed to use your data
Contract (running your account, fees, features), legitimate interests (security, fraud prevention, improving the service, audit trail), legal obligation (tax, accounting, anti-money-laundering checks done by Stripe), consent (push notifications, any marketing).
Your business name, photos, captions and reviews are shown publicly by design. Your phone, email and home address are never shown publicly.
3. If you only visit our website
We collect basic technical data when you load a page: IP address, browser, page and time (in server logs, so the site works and stays secure). We use no advertising cookies and no analytics cookies. See our cookies and storage page. Discover counts a view once per visit using a random code that lives only until you close the tab (no name or contact detail attached). If you hide a business on Discover, your browser remembers that on your device only.
Fonts: some pages load a font from Google. This sends your IP address to Google.
4. Who else handles your data
These are our suppliers. They act on our instructions. Each has an agreement with us. Some store data outside the UK (see section 6).
| Supplier | What they do | Data involved |
|---|---|---|
| Supabase | Database, login, file storage (our database is hosted in London) | Almost everything in this notice |
| Vercel | Hosting the website | Web requests, IP addresses |
| Stripe | Card payments, card on file, payouts, identity checks for tradespeople | Payment and identity data. Stripe is also an independent controller for its own legal duties; read Stripe's privacy policy |
| Resend | Sending emails | Name, email, message content |
| Meta (WhatsApp Business) | Sending WhatsApp job updates to people who opted in | Phone number, message content |
| Google (Places address search) | Suggests addresses as you type. Our server passes what you type; the search is limited to the UK | Partial address text |
| Postcode lookup (postcodes.io) | Turns a UK postcode into an area and a distance in miles. We send the postcode only, with no name or other detail | Postcode |
| Expo (push service), Apple, Google | Delivering notifications to tradespeople's phones | Push token, notification text |
| Our professional advisers (lawyers, accountants, insurers) | Advice | As needed |
| Authorities and courts | Where the law requires | As needed |
We do not sell personal data.
We may share information with other parties when you ask us to (for example, passing your quote to your tradesperson) or when a business is sold (the new owner must honour this notice).
5. How long we keep things
| Data | Kept for |
|---|---|
| Enquiry that never became a booking | 12 months after it closes, then deleted |
| Booked jobs, quotes, acceptances, notes, photos | 6 years after the job ends (the time limit for contract claims in England and Wales), then deleted. Photos the tradesperson chooses to post on their public page stay until they remove them or close their account |
| Invoices, payment and fee records | 6 years after the end of the tax year (HMRC) |
| Customer contact details on a closed enquiry the tradesperson never reached | 12 months |
| Reviews | While the tradesperson's page stays live, plus 6 years in our records if needed to handle disputes; first name only |
| WhatsApp opt-in time and opt-outs | Opt-outs: kept so we never message you again. Opt-ins: 3 years after last use |
| Login and security logs | 12 months |
| Push tokens | Until you sign out, delete the account, or the token goes stale |
| Deleted accounts | We delete what we can within 30 days and keep legal records. See delete your account |
6. Sending data outside the UK
Some of our suppliers are in the USA or elsewhere. When your data leaves the UK we make sure it is protected, using one of: the UK's adequacy decisions (for example the UK-US data bridge for certified companies), the ICO's International Data Transfer Agreement, or the UK Addendum with standard contract clauses. You can ask us for a copy of the safeguards.
7. Your rights
Under UK data protection law you can ask us to:
- show you the data we hold about you (and give you a copy);
- correct data that is wrong;
- delete your data (we will say what we must keep and why);
- stop or limit using it in some cases;
- give you your data in a usable file (where we use it by contract or consent);
- stop using it for direct marketing (always, at any time);
- object to uses based on our legitimate interests;
- withdraw your consent (for example the WhatsApp tick) at any time. Withdrawing does not affect what we did before.
How: tradespeople can use Profile, then Account and help in the app (Help and support to ask for a copy, or Delete my account). Customers can email privacy@graftrhq.com or see how to send a data request. We reply within one month. It is free unless a request is unreasonable.
We make no decisions about you by computer alone that have a legal or similar effect.
8. How to complain
Please tell us first so we can put it right: privacy@graftrhq.com. We will acknowledge your complaint within 30 days and reply as soon as we can.
You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113. You do not have to complain to us first.
9. Children
Graftr HQ is for people aged 18 and over. We do not knowingly collect children's data. If you think a child has given us data, email privacy@graftrhq.com and we will delete it. Photos of work sometimes show household items; tradespeople must not post images where a child can be identified (see our community rules).
10. Security
Our database uses row-level security so one business cannot see another's data. Customer links use random codes stored scrambled and expire. Payment card data is handled only by Stripe. No system is perfectly secure; if there is a breach that puts you at risk we will tell you and the ICO as the law requires.
11. Changes to this notice
If we change this notice in a way that matters we will tell you in the app or by email at least 15 days before for tradespeople, and put the date at the top.