XGRAFTER

Privacy Policy

Effective 31 October 2026

X Grafter Pty Ltd, ABN 49 703 685 072 (“XGrafter”, “we”) is committed to protecting the privacy of individuals whose personal information we handle. This Policy explains how we collect, use, disclose, and store personal information, in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. What information we collect

  • Account information — name, email, phone, company name, ABN.
  • Customer Data — jobs, quotes, invoices, contacts, employees, and other records you upload to run your business through XGrafter.
  • Usage data — anonymised logs of feature use, browser, device, and IP address to operate and improve the Service.
  • Website visits — on xgrafter.com, the pages you view and where you came from (see section 8).
  • Communications — records of support requests and correspondence.

2. How we use it

We use personal information to:

  • Provide, maintain, and improve the Service.
  • Bill and communicate with you.
  • Detect and prevent fraud, abuse, and security incidents.
  • Comply with legal obligations.

We do not sell your personal information or use Customer Data to train machine-learning models that leave your account.

3. Where your data lives

Customer Data is stored in Australia. We use the following sub-processors:

  • Supabase / AWS Sydney (ap-southeast-2) — primary database, file storage, authentication. All Customer Data resides in Sydney.
  • Resend — transactional email (welcome emails, invoice notifications). Email content in transit is stored briefly by Resend for delivery diagnostics.
  • Vercel — application hosting. Requests routed via edge locations globally but no Customer Data is stored at the edge.

4. Disclosure

We disclose personal information only to our sub-processors as listed above, and where required by law. We do not share Customer Data with third parties for marketing purposes.

5. Security

We employ industry-standard safeguards including TLS encryption in transit, encrypted storage at rest, principle-of-least-privilege access controls, and regular security review of our infrastructure. No system is perfectly secure — we recommend enabling multi-factor authentication on your account.

6. Retention

We retain Customer Data for the duration of your subscription and for 60 days after it ends, so you can export it (Settings › Billing › Your data) or come back. After 60 days, Customer Data is permanently deleted from active systems, and encrypted backups roll off within a further 30 days. This matches clause 10 of the Subscription Agreement.

7. Your rights

You may request to:

  • Access the personal information we hold about you.
  • Correct any information that is inaccurate.
  • Delete personal information (subject to legal retention obligations).
  • Export your Customer Data in a machine-readable format.

Send requests to ops@xgrafter.com. We will respond within 30 days.

8. Cookies and tracking

In the XGrafter app we use only strictly necessary cookies: they keep you signed in and remember your settings.

On xgrafter.com (our public website) a small banner asks first. If you tap Accept, we set our own cookies so we can see which pages are useful and improve the site:

  • xg_consent: remembers your answer to the banner (12 months).
  • xg_vid: a random visitor number that ties your page views together (13 months).
  • xg_sid: groups the pages you read in one sitting (30 minutes).

With them we record the pages you view, how long you spend on each, the site or ad that brought you, your device and browser type, and your approximate location (state and suburb, worked out from your IP address; we don’t keep the IP address itself). This stays on XGrafter’s own systems in Australia and is kept for 13 months.

If you later book a demo, sign up or ask for something by email, we link your earlier visits on that device to the details you gave us, so we know what you were interested in. We never buy or match information about you from other companies.

If you choose Essential only, or your browser sends Do Not Track or Global Privacy Control, we set no visitor cookies and only count page views without anything that identifies you.

We may also use Meta’s pixel to measure our Instagram and Facebook ads. It loads only if you tap Accept, and Meta handles that data under its own privacy policy. You can change your answer at any time with Cookie settings at the bottom of every page.

Marketing emails.We only send our weekly know-how email if you tick the box asking for it. Every email says who it’s from and has an unsubscribe link, and we act on an unsubscribe within 5 working days.

9. Mobile app (XGrafter Field for iOS)

The XGrafter Field iOS app is a companion to the web platform for on-site crew. It signs in with the same credentials as the web dashboard and does not collect any additional personal information beyond what's covered above.

Device permissions the app may ask for:

  • Camera — used only when you tap "Add photo" on a site task or job note. Photos are uploaded directly to your tenant's storage in AWS Sydney and are never transmitted to any third party.
  • Photo library — used only when you tap "Attach from library". Only the photos you explicitly select are read; the app has no background access to your library.
  • Face ID / Touch ID — optional. If you opt in, iOS grants the app a local device gate that unlocks the app faster than typing your password. The biometric check happens entirely on-device — no facial data, fingerprints, or biometric templates ever leave your phone or reach XGrafter. You can turn this off any time from the profile screen or by revoking permission in iOS Settings.

What the app does NOT do:

  • No third-party analytics or tracking SDKs.
  • No advertising identifiers collected.
  • No cross-app or cross-website tracking.
  • No location data collected.
  • No push notifications sent in the current build.

If the app is uninstalled, any biometric opt-in preference and cached session data stored on-device are deleted by iOS as part of the standard uninstall process.

10. Children

The Service and the XGrafter Field app are business tools intended for use by employees of a subscribing business. We do not knowingly collect personal information from anyone under 16 years of age. If you believe we have inadvertently collected information from a minor, contact us at ops@xgrafter.com and we will delete it.

11. Complaints

If you believe we have breached the APPs, contact us at ops@xgrafter.com. If unresolved, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au).

12. Changes to this Policy

We may update this Policy from time to time. The effective date at the top reflects the most recent revision. Material changes will be notified by email.