Privacy statement

Graft is a business management system operated by Graft. This statement explains what personal data the service handles, why, and what you can do about it. Questions and requests go to team.agora.hub@gmail.com.

Graft is used in two ways, and your relationship with us depends on which one applies to you. If you hold a Graft account, we handle your data as described below. If you reached Graft only by filling in a form published by one of our customers, that customer decides what is collected and why — they are the data controller, and Graft processes it on their instructions. Ask them first; we will help them answer you.

Account and workspace data you give us:

• Your email address, and your name if you provide one.
• Your password, stored only as an argon2id hash — we cannot read it, and we never store or log the password itself.
• The workspace name, business profile answers from onboarding, and your role in each workspace you belong to.
• Everything you build in the product: entities and their fields, the records stored against them, forms, dashboards and plugin settings. We treat this as yours; we do not mine it, sell it, or use it to train anything.

Billing data, if you subscribe:

• Your plan, billing period and subscription status.
• A Stripe customer identifier. Card numbers are handled by Stripe and never reach our servers or logs.

Technical data the service produces by running:

• Server request logs, each with a request identifier, the route, the response status and how long it took. Credentials and tokens are redacted from these.
• Short-lived rate-limit counters in Redis, keyed by IP address, email address or user id, kept for minutes at a time to stop brute-force and abuse.
• Two cookies, described under Cookies below.

We do not run analytics, advertising, session-replay or fingerprinting software of any kind. There are no third-party trackers on any Graft page.

• To provide the service you signed up for — creating your account, keeping you signed in, storing and showing your workspace data. Basis: performance of our contract with you.
• To take payment and meet accounting obligations. Basis: performance of the contract, and legal obligation for the records we must keep.
• To keep the service secure and available — rate limiting, abuse prevention, debugging failures. Basis: our legitimate interest in a service that stays up and is not abused.
• To send transactional messages such as email verification. Basis: performance of the contract. We do not send marketing email from the product.

Graft sets two cookies, both strictly necessary to keep you signed in. There are no analytics or advertising cookies, which is why the product shows no cookie banner.

• graft_access — your short-lived signed session token, sent with each request so the server knows who you are.
• graft_refresh — a longer-lived token, restricted to the refresh endpoint, used to renew the session without asking you to sign in again.

Signing out clears both. Blocking them makes the product unusable.

We do not sell personal data and we do not share it for advertising. We use a small number of processors to run the service:

• Stripe — payment processing and subscription billing, for subscribers only.
• Our hosting and database infrastructure, which stores the data at rest.

Beyond that, we disclose data only where the law requires it, and we will tell you when we are permitted to.

Inside a workspace, your data is visible to the other members of that workspace according to their roles. Data is isolated per workspace: no query in the product can read another tenant's data.

• Account and workspace data: for as long as your account exists. Ask us to delete it and we will, subject to the records below.
• Billing records: for as long as tax and accounting law requires us to keep them, typically several years, even after an account closes.
• Request logs: a short operational window, then discarded.
• Rate-limit counters: minutes.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. The Privacy page inside your account has a one-click export of your workspace data as a JSON file, so you do not have to ask us for the common case.

Email team.agora.hub@gmail.com for anything else. We answer within 30 days. If you are unhappy with our answer, you can complain to your local data protection authority.

• Passwords are hashed with argon2id and are never recoverable, by us or by anyone who obtains the database.
• Sessions use asymmetrically signed (RS256) tokens with short lifetimes and rotating keys.
• Every data access is scoped to one workspace at the query layer, not merely filtered in the interface.
• Traffic is served over TLS.

No system is perfect. If we ever suffer a breach affecting your data, we will tell you and the relevant authority as the law requires. If you believe you have found a vulnerability, please report it to team.agora.hub@gmail.com before disclosing it publicly.

Graft stores data on infrastructure in the European Union. Where a processor such as Stripe transfers data outside it, that transfer relies on the safeguards published by that processor, such as the European Commission's standard contractual clauses.

This is version 1.0, effective 2026-08-21. When we change it materially we will raise the version, change the date, and tell account holders in the product before the change takes effect. Every version is downloadable from this page so you can keep the one you agreed to.