Privacy
Last updated: 29 October 2026
DRAFT — NOT YET IN FORCE. Prepared for David Curtin's review. A practising Irish solicitor or privacy adviser must review this policy before Grafkit relies on it or publishes it. Items in [square brackets] are placeholders or facts to confirm; see review-checklist.md.
This policy explains how Grafkit collects and uses personal data: on our websites (grafkit.com, grafkit.ie, grafkit.ca), in the Grafkit app (app.grafkit.com), by email, and in our marketing. It is written to meet the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and the ePrivacy Regulations (S.I. No. 336 of 2011).
The short version
- We collect what we need to run the service: your work contact details, your briefs and files, billing details (card and bank details stay with Stripe), and basic security logs.
- We don't sell your data, run ads, or track you across the web. Our websites set no tracking cookies.
- Your files are stored in the EU (Germany). A few providers are in the US, under EU-approved safeguards.
- AI helpers in the app send only the text the task needs to our AI provider, which doesn't train on it.
- We send marketing emails only if you've agreed, or if you're a client and haven't opted out. Every email has an unsubscribe link.
- You can see, correct, export or delete your data. Email us at [email protected].
1. Who we are
1.1 The controller of your personal data is David Curtin, a sole trader trading as Grafkit and Brainstorm Design, of PH Floor, Rivercourt HQ, River Court Business Centre, Robert St, Cornmarket Row, Limerick V94 FVH4 ("Grafkit", "we", "us").
1.2 Contact for privacy questions: [email protected], or by post to the address above, marked "Privacy". We have not appointed a Data Protection Officer because the law does not require one for our business.
1.3 When we are not the controller. When our clients upload files, briefs and other material to the app, any personal data in it (for example, photos of the client's staff or a client's customer list for a mailing design) belongs to that client. We process it for them as a processor under our Data Processing Agreement. If your data is in a client's material, please contact that client first.
2. What we collect, why, and our lawful basis
| What | Where it comes from | Why we use it | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Enquiries: name, email, company, message, what you tell us about your work | Website forms, email, booking a call | To answer you and, if you ask, prepare a proposal | Steps at your request before a contract (6(1)(b)); our legitimate interest in replying to business enquiries (6(1)(f)) |
| Account data: name, work email, role, company, market, user settings | The app, when you or your account owner invite you | To create and run your account and sign you in | Contract (6(1)(b)) with the client; for invited users, our and the client's legitimate interest in giving their team access (6(1)(f)) |
| Sign-in and security data: one-time sign-in links, session records, IP address, browser type, time of sign-in, audit log of account actions | The app, automatically | To keep accounts secure, prevent fraud and investigate problems | Legitimate interest in security (6(1)(f)); legal obligation to keep data secure (6(1)(c), Art. 32) |
| Work data: briefs, comments, feedback, approvals and the files you upload or we deliver | The app | To deliver the design service | Contract (6(1)(b)). Personal data inside client files: we act as processor (see 1.3) |
| Billing data: billing contact, company name and address, VAT/tax number, plan, invoices, payment status. Card and bank details are collected by Stripe, not by us; we see only the type, last four digits and expiry | Checkout, Stripe | To take payment, invoice, handle failed payments and keep accounts | Contract (6(1)(b)); legal obligation to keep tax and accounting records (6(1)(c)) |
| Service emails: email address, delivery and open status of service messages | The app, Resend | To send sign-in links, proofs, reminders, receipts and account notices | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| AI helper content: text you type into the brief helper, brief writer or brand assistant, and the relevant brief or brand material | The app | To suggest questions, draft briefs and summarise brand guidelines | Contract (6(1)(b)); legitimate interest in making briefs clearer (6(1)(f)) |
| Marketing data: name, email, company, country, your consent record (what you agreed to, when, where), and whether you opened or clicked our emails | Website forms, checkout, events | To send news, offers and design tips | Consent (6(1)(a)); for existing clients who did not opt out, our legitimate interest in telling clients about our own similar services (6(1)(f)), as permitted by Reg. 13(11) of S.I. 336/2011 (see section 6) |
| Website technical data: IP address, browser, pages requested | Our websites and hosts, automatically | To deliver pages, protect against attacks, and fix faults | Legitimate interest (6(1)(f)) |
| Correspondence: emails and call notes | Email, calls | To manage our relationship and keep a record | Legitimate interest (6(1)(f)); contract (6(1)(b)) |
2.1 We do not sell personal data, use it for third-party advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.
2.2 Special category data. We do not ask for it. Please do not send health, religious, political or similar sensitive data unless a project needs it and we have agreed how to handle it.
2.3 If you do not give us data. Some data is needed to run the service (for example, an email address to sign in, and billing details to subscribe). Without it, we cannot provide the service.
2.4 Our legitimate interests, where we rely on them, are: replying to business enquiries; running and securing our service and preventing fraud; letting clients give their team and guests access; keeping records of our dealings; improving briefs and the app; and telling existing clients about our own similar services. We have weighed each against your interests and rights, and you can ask us for the assessment.
2A. If we got your data from someone else
2A.1 Invited users and guests. If your employer or a client invited you to the app, they gave us your name and work email. We use them as described above.
2A.2 People in client files. If you appear in material a client uploads (for example a staff photo or a quote), the client is responsible for that data and we process it on their instructions (see 1.3). The categories are whatever the client provides, usually name, image, job title and contact details.
2A.3 Payment status comes from Stripe, and email delivery status from Resend.
2A.4 Shared brand book and guidelines links (app.grafkit.com/b/…). When you view one, we count a page view once you have stayed on a page for five seconds, at most once per page per browser tab, and we count downloads. Counts are kept per link, per day and per page, with no IP address, cookie, device ID or other personal data, so they are not personal data. The client who shared the link sees only totals for the last 30 days. To avoid double counting, your browser keeps a marker in session storage that is cleared when you close the tab. If the link is password-protected, entering the password sets a strictly necessary cookie for that link for 12 hours (see the Cookie Policy).
3. AI-assisted features
3.1 Some app features use AI models supplied by Anthropic (Claude) to help write and check briefs and summarise brand guidelines. When you use them, the text you enter and the relevant brief or brand material are sent to Anthropic to generate a response.
3.2 Under Anthropic's Commercial Terms for its API, Anthropic does not use this content to train its models. Anthropic acts as our processor and keeps API inputs and outputs only for a limited period (currently up to 30 days) for safety and abuse monitoring, unless law requires longer.
3.3 The helpers do not decide anything about you: they suggest; a person decides. Plans, prices and dates are set by our systems and people, not by AI.
3.4 We tell clients in our Terms of Service when AI-assisted tools are used, and we tell them before any AI-generated imagery appears in their work, in line with the transparency rules of the EU AI Act (Regulation (EU) 2024/1689).
3.5 We have assessed these features for data protection risk (a DPIA screening) and limited what is sent to the AI provider to what each task needs.
4. Who we share data with
4.1 Sub-processors. We use the service providers below to run Grafkit. Each processes personal data only on our instructions, under a written contract meeting Article 28 GDPR. The full, current list is at grafkit.com/subprocessors.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Hetzner Online GmbH | App hosting, database, backups (incl. Storage Box) | Germany (EU) |
| Cloudflare, Inc. | Content delivery, DNS, security, file storage (R2, EU jurisdiction), email routing | R2 stored in the EU; edge network global; company in the US |
| Stripe Payments Europe, Ltd. | Payments, invoices, tax calculation | Ireland (EU), with transfers to Stripe, Inc. (US) |
| Resend (Plus Five Five, Inc.) | Sending service and sign-in emails | United States |
| Anthropic Ireland, Limited | AI helpers in the app | United States |
| Google LLC / Google Ireland Limited (Gmail) | Forwarding and handling of email to our hello@ addresses | EU and US |
| VBOUT, Inc. (planned; not yet in use) | Marketing email and contact management | United States |
| Google Fonts (Google LLC) | Web fonts on our websites (your browser requests them directly) | Global; US company |
4.2 Stripe as independent controller. Stripe also processes some payment data as a controller for its own purposes, such as fraud prevention and meeting its legal duties as a payment provider. See Stripe's privacy policy at stripe.com/privacy.
4.3 Others. We may share data with our professional advisers (accountants, lawyers, insurers) under confidentiality; with authorities where the law requires; and with a buyer of all or part of our business, under the same protections.
4.4 Freelance designers. Some work may be done by freelance designers engaged by us under confidentiality and data-processing terms. They access work data only in our systems.
5. International transfers
5.1 Our main systems (Hetzner, Cloudflare R2) store data in the EU. Some providers are based in, or access data from, the United States or other countries outside the European Economic Area.
5.2 Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses (2021) in our contract with each provider, with supplementary measures where needed, such as encryption in transit and at rest. Where a US provider is certified under the EU–US Data Privacy Framework, we also rely on the Commission's adequacy decision for that framework. Canada has an EU adequacy decision for commercial organisations subject to PIPEDA.
5.3 You can ask us for a copy of the safeguards that apply (with commercial terms removed).
6. Marketing
6.1 We send marketing emails only: (a) where you have given consent (for example, by ticking a box on our website or at checkout); or (b) to people at existing clients, about our own similar services, where you were given the chance to object when we collected your details and in every message ("soft opt-in").
6.2 Every marketing email includes an unsubscribe link and our postal address. Unsubscribing does not affect service emails, which we need to send to run your account.
6.3 We keep a record of your consent (what you saw, when and where) to prove it.
7. Cookies
Our websites set no cookies and run no analytics, advertising or tracking. The app uses only strictly necessary cookies and local storage, for sign-in, security and remembering your theme. See our Cookie Policy.
8. How long we keep data
| Data | How long |
|---|---|
| Enquiries that do not become clients | 12 months from last contact, then deleted |
| Account data and work data | While the account is open, including after a plan is cancelled. Deleted when the account owner closes the account or asks us to erase it, or after the inactivity period (no plan and no sign-in: export reminder at 12 months, closure with 30 days' notice at 24 months). Deleted from live systems within 30 days; backups roll off within 60 days after that. Invoices are kept as tax law requires |
| Sign-in links | 15 minutes (welcome links up to 3 days) |
| Session records | Up to 30 days of inactivity |
| Security and audit logs | While the account is open; erased with it, except billing and erasure records kept as the law requires |
| Billing records, invoices and tax records | 6 years from the end of the financial year they relate to (Taxes Consolidation Act 1997, s. 886) |
| Marketing data | Until you unsubscribe or withdraw consent, then a suppression record (email only) so we do not contact you again; inactive contacts are deleted after 24 months without engagement |
| AI helper content at Anthropic | Up to 30 days at Anthropic; in our app as part of the brief, for as long as the work data |
| Correspondence | 6 years where it relates to a contract; otherwise 12 months |
We may keep data longer where needed to establish, exercise or defend legal claims.
9. Security
We keep a record of our processing activities, as Article 30 GDPR requires. We use encryption in transit (TLS) and at rest, passwordless sign-in with short-lived links, step-up checks for sensitive account actions, role-based access, audit logging, EU-hosted encrypted backups with restore testing, and contracts with every provider. No system is completely secure; if a breach is likely to put your rights at risk, we will tell you and the Data Protection Commission as the law requires.
10. Your rights
10.1 Under the GDPR you have the right to: access the personal data we hold about you; rectification of inaccurate data; erasure; restriction of processing; data portability (data you gave us, processed by consent or contract, in a machine-readable format); object to processing based on legitimate interests, and to object at any time to direct marketing; and withdraw consent at any time, without affecting processing before withdrawal.
10.2 To use your rights, email [email protected]. We reply within one month, which we may extend by two further months for complex requests, and tell you if we do. We may need to confirm your identity. There is no charge unless a request is manifestly unfounded or excessive.
10.3 Complaints. You can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie, or to the supervisory authority where you live or work. We would appreciate the chance to put things right first.
10.4 Canada. If you are in Canada, you also have rights under PIPEDA and applicable provincial law, including access and correction, and you may complain to the Office of the Privacy Commissioner of Canada. Our contact in 1.2 is accountable for our compliance.
10.5 United States. We do not sell or "share" personal information for cross-context behavioural advertising as those terms are used in US state privacy laws. US residents may contact us using 1.2 to request access, correction or deletion.
11. Children
Grafkit is a business service. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you think a child has given us data, contact us and we will delete it.
12. Changes
We will post any changes here and update the date at the top. If changes are significant, we will tell clients by email before they take effect.
13. Earlier versions
This policy replaces the short privacy notice published at grafkit.com/privacy/ in October 2026.
Terms · Privacy · Cookies · Sub-processors · Company details · Accessibility ·