Privacy Policy

Last updated: August 2026 · Applies to graftum.com, the Graftum apps and the Graftum Network.

🇷🇴 Pe scurt, în română

Îți păstrăm datele de profil (nume, telefon, meserie, calificări, zonă) ca să te putem contacta despre oportunități de lucru și noutăți Graftum, și — când Rețeaua se deschide — ca firmele de construcții de pe platformă să te poată găsi. Nu vindem datele nimănui, niciodată. Te poți retrage oricând cu un singur mesaj la hello@graftum.com sau pe WhatsApp, și îți ștergem profilul.

1. Who we are

Graftum ("we", "us") operates graftum.com — a job management platform and professional network for UK construction trades. Contact for anything in this policy: hello@graftum.com. We are registered with the UK Information Commissioner's Office (ICO).

2. What we collect

Network profiles (workers & companies): name, phone/WhatsApp number, email (optional), trade(s), qualifications and cards you list (e.g. CSCS, ECS, NVQ), years of experience, team size, work area, availability, preferred language, and how you found us.
Company accounts: company details, the business data you put into the app (jobs, quotes, invoices, timesheets, team records) — this data belongs to your company and we process it only to run the service for you.
Check-in location stamps: only when a worker taps check-in/out, and only that single point. We never track location in the background — this is a firm product promise.
Technical basics: essential local storage to keep you signed in and remember preferences. No advertising trackers.

3. Why we use it (and our lawful basis)

To contact you about work opportunities matching your profile — by WhatsApp, SMS, phone or email — because you gave consent when you joined the Network.
To notify you about the Network launch and relevant Graftum updates — consent.
To let verified construction companies and agencies on Graftum find and contact you about work, once the full Network opens — consent. Your contact details are only shared for this purpose.
To run the platform for company accounts (contract) and keep it secure (legitimate interest).

4. What we never do

We never sell your data to anyone.
We never send spam or unrelated marketing.
We never share worker profiles outside the purposes above.
We never track your location in the background.

5. Where your data lives

Data is stored with Supabase on servers in London, United Kingdom, protected by encryption in transit and at rest, with strict per-company access controls. Emails are sent through our email provider solely to deliver the notifications described above.

6. How long we keep it

Network profiles: for as long as you want to stay in the Network. If you ask to leave, we delete your profile within 30 days. Profiles inactive for 3 years are contacted before any renewal or deletion. Company account data: for the life of the account and up to 12 months after closure (then deleted), except records we must keep by law (e.g. invoicing).

7. Your rights

Under UK GDPR you can ask us at any time to: see the data we hold about you, correct it, delete it, restrict or object to its use, receive a copy, or withdraw your consent — which stops all notifications and removes you from the Network. One message to hello@graftum.com (or reply on WhatsApp) is enough. We answer within 30 days. If you're unhappy with our answer, you can complain to the ICO at ico.org.uk.

8. Changes

If this policy changes in a way that matters, we'll notify you before the change applies. The current version always lives at graftum.com/privacy.

graftum.com · Terms of use · hello@graftum.com