Graftr Privacy Policy
Last updated: 16 October 2026
This policy explains how Eman Curmi, trading as Orpyxis Technologies handles personal data in Graftr: the Graftr iPhone app, the Graftr web app and the Graftr service behind them. Graftr is a business tool for quoting, job costing and invoicing, sold to businesses, not to consumers.
1. Who we are
Eman Curmi, trading as Orpyxis Technologies ("Orpyxis", "we", "us") 42, Triq it-Tin, Sannat SNT1443, Gozo, Malta
- Email (support and privacy requests): [email protected]
- WhatsApp support: +1 904 479 8353
We haven't appointed a Data Protection Officer. Privacy questions go directly to the company owner at the email address above.
2. Our two roles
Graftr holds two kinds of personal data, and our role is different for each.
| Data | Our role | Who decides how it's used |
|---|---|---|
| Company data that a business and its team put into Graftr: clients, suppliers, jobs, hours, rates, machinery, quotes, invoices, payments, bank and cash accounts, journals, company details and logo | Processor (GDPR Art. 28) | The business using Graftr (our customer) is the controller |
| Account and billing data: your Graftr login, your company memberships, your plan, our invoices to your company, and support messages with us | Controller | Orpyxis |
If you're a client, supplier or employee of a business that uses Graftr, that business controls your data in Graftr. Please contact the business first. We'll help it deal with your request. Our processing for the business is governed by the data processing terms in section 13 of the Graftr Terms.
3. What we collect
3.1 Account data (we are controller)
- Your name, email address and a hashed password (we never store your password itself).
- Your company memberships and role (owner, office or field) and when you joined.
- Sign-in sessions and security tokens, password reset codes and invitation records (the invitee's email, role, who invited them and when).
3.2 Billing and plan data (we are controller)
- The company's plan, its status (trial, active, grace period, read-only), number of users and included modules, and licence records.
- Payment details are handled by Stripe. We see the billing name, email, amount, date and card type and last four digits, never the full card number.
- Our own invoices and receipts to your company.
3.3 Support data (we are controller)
- Messages you send us by email or WhatsApp, and our replies.
3.4 Company data (we are processor for our customer)
What a business and its team enter, for example:
- Clients and suppliers: names, contact names, email addresses, phone numbers, postal addresses, VAT numbers and notes.
- Team and hours: members' names and roles, hours worked against jobs, hourly cost and charge-out rates.
- Jobs and documents: jobs, sites, phases, estimates and their versions, invoices, credit notes, delivery notes, supplier bills, machinery and plant logs.
- Money: payments received and made, bank and cash account names and balances, journals, and the company's IBAN and BIC printed on invoices.
- Company details and logo, printed on quote and invoice PDFs.
3.5 Bot activity log (Agent Connect; we are processor for our customer)
If a business connects its own AI agents or bots to Graftr (Agent Connect), we record, for every bot request: the bot's name, the action (for example "update job"), the item affected, the outcome (allowed, denied, not found, rejected or rate-limited), a short before/after summary of the fields changed, the IP address the request came from and the time. The business's owners see this log in the app.
Why: so the business can see and check what its bots did, and so the service can be kept secure (spotting leaked tokens, misuse or attacks, and enforcing limits). We keep it for the business as part of its company data.
How long: while the company account exists, including the 30-day restore period after deletion, then it's deleted with the rest of the company's data (section 7).
Bots and AI providers: a bot the business connects (for example one built on ChatGPT, Claude or Grok) acts for that business. Company data the bot reads is sent to the business's own AI provider (such as OpenAI, Anthropic or xAI) on the business's instruction. That provider is chosen by the business and isn't one of our providers; its handling of data is governed by its terms with the business. Ask the business about it.
3.6 Technical data
- IP address, time, request type and status, and app version, in our server logs, and used for rate limiting to protect sign-in and other endpoints.
3.7 What the iPhone app does not collect
- No location. Addresses open in Apple Maps; the app never reads your device's location.
- No contacts, camera or photo library access. The only image the app handles is a company logo you choose with the system picker; it's resized on your phone and uploaded.
- No advertising, no tracking, no analytics, no crash-reporting SDKs and no advertising identifier.
4. Why we use it (controller data) and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, signing you in, password resets, team invitations | Contract |
| Providing the plan your company chose, trials, renewals and plan status | Contract |
| Taking payment and issuing and keeping our invoices | Contract; legal obligation |
| Answering support requests | Contract; legitimate interests |
| Security, preventing abuse and fraud, enforcing plan limits | Legitimate interests |
| Complying with the law and handling legal claims | Legal obligation; legitimate interests |
We don't sell personal data, we don't use it for advertising, and we don't make decisions about you based solely on automated processing.
Company data (section 3.4) is used only to provide Graftr to the business that owns it, on its instructions: storing it, showing it to that business's team according to their roles, producing PDFs, share links and exports, and keeping the service secure. We don't use it for our own purposes.
5. Who receives data
| Recipient | What for | Data | Location |
|---|---|---|---|
| Orpyxis's own server | Hosting the Graftr service, database and backups | All Graftr data | Ireland |
| Cloudflare, Inc. | Network protection and secure connection to our server; all traffic to the Graftr service passes through Cloudflare | Traffic in transit, IP addresses | US company, global network |
| Google (Gmail) | Sending service emails: password reset codes and team invitations | Recipient email address, name, company name, the inviter's name and the link or code | US |
| Apple (iCloud Mail) | Receiving and storing email sent to our orpyxis.com addresses, including [email protected] | Your messages and email address | US company |
| WhatsApp (Meta) | Support chats, if you choose to contact us on WhatsApp | Your phone number, profile name and messages | US company; WhatsApp acts under its own terms |
| Stripe | Card payments for Graftr plans | Billing and payment data | EU / US |
| Apple (App Store) | Distributing the iPhone app | Apple handles its own App Store data as an independent controller | Global |
| People your company chooses | When your team shares a quote or invoice PDF by link or from the share sheet, whoever has the link or file can see it | The document's contents | Wherever the recipient is |
| AI providers chosen by a business (e.g. OpenAI, Anthropic, xAI) | Only if the business connects its own bot: data the bot reads is sent to the business's provider on the business's instruction. These aren't our providers | Whatever the bot reads within its permissions | Depends on the provider |
| Professional advisers, authorities | Where needed, or required by law | As needed | — |
No third party receives Graftr data for advertising or analytics. Graftr does not sell or rent personal data.
6. International transfers
The Graftr database is hosted on our own server in Ireland, in the EU. Some providers above are based in the US (Cloudflare, Google, Apple, Meta, Stripe), so data may be processed outside the EEA. Where that happens we rely on the EU-US Data Privacy Framework for providers certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Ask us at [email protected] for details.
7. How long we keep data
| Data | How long |
|---|---|
| Company data (processor role) | While the company account exists. When a company account is deleted (in the app or by asking us), it's deactivated straight away, can be restored for 30 days, and is then permanently deleted with no copy kept (section 8). If our agreement ends another way, the owner has at least 30 days to export first. |
| Bot activity log, including caller IP addresses (processor role) | Same as company data: while the company exists and during the 30-day restore period, then deleted with it. |
| Your user account | While your account exists. When you delete it, your name and email are removed and replaced with "Deleted user" and an unusable placeholder, and all your sessions are ended. We keep only an anonymous user ID, so records of companies you were part of (and which still exist) keep a valid "created by". |
| Our invoices to your company and related payment records | As long as Maltese tax law requires (at least 6 years for VAT records, and longer where other tax rules apply). We keep these even if your company deletes its Graftr account. |
| Record that an account was deleted (when and by whom) | As long as needed to show we followed the instruction and to deal with disputes. |
| Backups | Our database backups roll over within 35 days (currently 14 days). Deleted data isn't restored from backups on request; if a backup is ever used to recover our systems, anything deleted is deleted again. |
| Support emails and WhatsApp messages | Up to 3 years after our last contact. |
| Server and security logs | Up to 12 months. |
| Expired invitations and reset codes | Reset codes expire after 30 minutes; invitations expire on their stated date. |
8. Deleting your account and your company's data
In the app: Settings → Delete account. Before anything is deleted, Graftr shows you what will happen and lets you download a copy of your data. You confirm with your password and by typing DELETE.
- If you're the only member of a company, the account and company are deactivated straight away and share links stop working. You can restore everything by signing in within 30 days. After that, a daily clean-up permanently deletes the company and all its Graftr data: clients, jobs, hours, machinery, quotes, invoices, purchasing records, payments, the ledger, company details, logo, invitations, bot tokens and the bot activity log. You can ask us to delete straight away instead.
- If you're the only owner and others are still members, Graftr asks you to make someone else an owner, or remove the other members, first.
- If the company has another owner, or you're an office or field member, you leave the company. The records you created stay with that company, shown as "Deleted user", because they belong to the business.
Closing a company account by asking us: an owner can also ask us at [email protected] to close the company account. We then deactivate it and delete everything 30 days later, unless the owner asks for immediate deletion. During those 30 days no one can use the account, but an owner can ask us to cancel the deletion or to provide an export.
Keep your records first. Graftr is not an archive. A business must keep its own accounting and tax records for as long as the law requires, so export before you delete. The export is a ZIP file containing CSV files of every table, your quote and invoice PDFs (up to 200 per export) and your logo, or a single JSON file. It covers every company where you're an active owner. After deletion we can't recover anything, even if a tax authority, auditor or client later asks for it.
If you're a client of a business that used Graftr, ask that business for copies of your invoices; we can't provide them after deletion.
9. Your rights
Under the GDPR you can ask us to give you access to your personal data, correct it, delete it, restrict or object to our processing, or give you your data in a portable format. Where we process data on a business's behalf (section 3.4), we'll pass your request to that business and help it respond.
You can do much of this yourself in the app: edit your details, download your data, and delete your account. For anything else, email [email protected]. We reply within one month and may need to confirm your identity first.
Complaints: you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or to the data protection authority where you live (in Ireland, the Data Protection Commission, dataprotection.ie). We'd appreciate the chance to sort it out with you first.
10. Security
All connections use encryption in transit (HTTPS). Passwords are stored only as hashes. Sign-in tokens on your iPhone are kept in the iOS Keychain. Access to company data is limited by company and by role (owners and office staff see pay and cost rates; field staff don't). Sign-in and other sensitive actions are rate-limited. Shared document links are signed and expire (you choose 1, 7 or 30 days in the app); a link can't be withdrawn before it expires, but it stops working if the document or company is deleted. If a personal data breach is likely to put you at risk, we'll notify you and the regulator as the law requires, and as processor we'll notify the business concerned without undue delay.
11. Cookies
The Graftr web app uses only essential cookies to keep you signed in securely. Stripe may set its own fraud-prevention cookies on its checkout pages. We don't use analytics or advertising cookies.
12. Children
Graftr is a business tool for people aged 18 and over. We don't knowingly collect data from children.
13. Changes
We'll post any update here with a new date, and tell account owners about significant changes by email or in the app.
14. Contact
Eman Curmi, trading as Orpyxis Technologies 42, Triq it-Tin, Sannat SNT1443, Gozo, Malta Email: [email protected] · WhatsApp: +1 904 479 8353