Last updated: August 2026 · Applies to graftum.com, the Graftum apps and the Graftum Network. · See also our plain-English data guarantee for companies.
1. Who we are
Graftum Ltd ("we", "us"), a company registered in England and Wales (company no. 17387844, registered office: 167-169 Great Portland Street, London, W1W 5PF), is the data controller and operates graftum.com — a job management platform and professional network for UK construction trades. Contact for anything in this policy: hello@graftum.com. We are registered with the UK Information Commissioner's Office (ICO), registration number ZC217261.
2. What we collect
Network profiles (workers & companies): name, phone/WhatsApp number, email (optional), trade(s), qualifications and cards you list (e.g. CSCS, ECS, NVQ), years of experience, team size, work area, availability, preferred language, and how you found us.
Company accounts: company details, the business data you put into the app (jobs, quotes, invoices, timesheets, team records) — this data belongs to your company and we process it only to run the service for you.
Check-in location stamps: only when a worker taps check-in/out, and only that single point. We never track location in the background — this is a firm product promise.
Technical basics: essential local storage to keep you signed in and remember preferences. No advertising trackers.
3. Why we use it (and our lawful basis)
To contact you about work opportunities matching your profile — by WhatsApp, SMS, phone or email — because you gave consent when you joined the Network.
To notify you about the Network launch and relevant Graftum updates — consent.
To let verified construction companies and agencies on Graftum find and contact you about work, once the full Network opens — consent. Your contact details are only shared for this purpose.
To run the platform for company accounts (contract) and keep it secure (legitimate interest).
4. What we never do
We never sell your data to anyone.
We never send spam or unrelated marketing.
We never share worker profiles outside the purposes above.
We never track your location in the background.
4a. The Graftum mobile apps (iOS & Android)
The Graftum apps handle the same data as the website, plus, only when you actively use those features:
Camera & photos — only when you take or attach a site photo. We never scan your photo library.
Location — a one-time location stamp when you clock in or out, so timesheets show where they were made. Never background tracking, never a movement history.
Offline storage — work you record without signal (timesheets, day sheets, signatures) is kept on your device and uploaded when you're back online.
Push notifications (when available) — a device token is stored to deliver work notifications; removed when you log out or delete the app.
You can delete your account and data at any time — the process is described at graftum.com/delete-account.
5. Where your data lives
Data is stored with Supabase on servers in London, United Kingdom, protected by encryption in transit and at rest, with strict per-company access controls. Emails are sent through our email provider solely to deliver the notifications described above.
6. How long we keep it
Network profiles: for as long as you want to stay in the Network. If you ask to leave, we delete your profile within 30 days. Profiles inactive for 3 years are contacted before any renewal or deletion. Company account data: for the life of the account and up to 12 months after closure (then deleted), except records we must keep by law (e.g. invoicing).
7. Your rights
Under UK GDPR you can ask us at any time to: see the data we hold about you, correct it, delete it, restrict or object to its use, receive a copy, or withdraw your consent — which stops all notifications and removes you from the Network. One message to hello@graftum.com (or reply on WhatsApp) is enough — full deletion steps at graftum.com/delete-account. We answer within 30 days. If you're unhappy with our answer, you can complain to the ICO at ico.org.uk.
8. Changes
If this policy changes in a way that matters, we'll notify you before the change applies. The current version always lives at graftum.com/privacy.