Last updated: August 2026 · Applies to graftum.com, the Graftum apps and the Graftum Network. · See also our plain-English data guarantee for companies.
1. Who we are
Graftum Ltd ("we", "us"), a company registered in England and Wales (company no. 17387844, registered office: 167-169 Great Portland Street, London, W1W 5PF), is the data controller and operates graftum.com — a job management platform and professional network for UK construction trades. Contact for anything in this policy: hello@graftum.com. We are registered with the UK Information Commissioner's Office (ICO), registration number ZC217261.
2. What we collect
Network profiles (workers & companies): name, phone/WhatsApp number, email (optional), trade(s), qualifications and cards you list (e.g. CSCS, ECS, NVQ), years of experience, team size, work area, availability, preferred language, and how you found us.
Company accounts: company details, the business data you put into the app (jobs, quotes, invoices, timesheets, team records) — this data belongs to your company and we process it only to run the service for you.
Check-in location stamps: only when a worker taps check-in/out, and only that single point. We never track location in the background — this is a firm product promise.
Technical basics: essential local storage to keep you signed in and remember preferences. No advertising trackers.
3. Why we use it (and our lawful basis)
To contact you about work opportunities matching your profile — by WhatsApp, SMS, phone or email — because you gave consent when you joined the Network.
To notify you about the Network launch and relevant Graftum updates — consent.
To let verified construction companies and agencies on Graftum find and contact you about work, once the full Network opens — consent. Your contact details are only shared for this purpose.
To run the platform for company accounts (contract) and keep it secure (legitimate interest).
4. What we never do
We never sell your data to anyone.
We never send spam or unrelated marketing.
We never share worker profiles outside the purposes above.
We never track your location in the background.
4a. The Graftum mobile apps (iOS & Android)
The Graftum apps handle the same data as the website, plus, only when you actively use those features:
Camera & photos — only when you take or attach a site photo. We never scan your photo library.
Location — a one-time location stamp when you clock in or out, so timesheets show where they were made. Never background tracking, never a movement history.
Offline storage — work you record without signal (timesheets, day sheets, signatures) is kept on your device and uploaded when you're back online.
ID badge photo — only if you take one for your company ID badge. It is stored privately, approved by your employer before use, and shown to a client only through an arrival pass your employer issues for one job and day (the link stops working after that, and can be cancelled at any time). It is never public and never used for anything else; ask your employer or us to remove it.
Push notifications (when available) — a device token is stored to deliver work notifications; removed when you log out or delete the app.
You can delete your account and data at any time — the process is described at graftum.com/delete-account.
4b. Cookies and advertising
Our own visit counter uses no advertising cookies. On some sign-up pages (such as /crew) we ask whether you agree to the Meta Pixel, so we can see whether our Facebook and Instagram ads bring people to Graftum. It only loads if you press agree; if you say no, nothing is sent to Meta. When it is on, Meta receives that you visited the page and, if you sign up, that a sign-up happened — not your name, phone or anything you type in the form. You can change your mind at any time by clearing this site's data in your browser, and Meta's own privacy policy applies to what Meta does with it.
5. Where your data lives
Data is stored with Supabase on servers in London, United Kingdom, protected by encryption in transit and at rest, with strict per-company access controls. Emails are sent through our email provider solely to deliver the notifications described above.
6. How long we keep it
Network profiles: for as long as you want to stay in the Network. If you ask to leave, we delete your profile within 30 days. Profiles inactive for 3 years are contacted before any renewal or deletion. Company account data: for the life of the account and up to 12 months after closure (then deleted), except records we must keep by law (e.g. invoicing).
7. Your rights
Under UK GDPR you can ask us at any time to: see the data we hold about you, correct it, delete it, restrict or object to its use, receive a copy, or withdraw your consent — which stops all notifications and removes you from the Network. One message to hello@graftum.com (or reply on WhatsApp) is enough — full deletion steps at graftum.com/delete-account. We answer within 30 days. If you're unhappy with our answer, you can complain to the ICO at ico.org.uk.
8. Changes
If this policy changes in a way that matters, we'll notify you before the change applies. The current version always lives at graftum.com/privacy.