Plain-English version: we only collect what we need to run your day sheets, we keep it locked down, we never sell it, and you can ask us to delete it. The detail is below.
Grafa is operated by Grafa Ltd (“Grafa”, “we”, “us”), based in Invercargill, Southland, Aotearoa New Zealand. Grafa provides machine-hour day sheet software for earthworks and civil contractors, delivered through our mobile apps (iOS and Android) and web portal.
This policy explains what information we collect, why we collect it, how we use and protect it, and the choices you have. We handle personal information in line with the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles.
We aim to collect the minimum needed to run the service. We do not ask for or store sensitive information such as government ID numbers, health information, or full card numbers.
Account information. When you or your company creates an account we collect your name, email address, password (stored only as a secure hash by our authentication provider, so we never see or store your plain-text password), company / organisation name, and your role within it.
Operational data you enter. The content you create while using Grafa: day sheets, machine and equipment details, hour-meter readings, labour hours, job and site references, subcontractor and customer details, and notes. Some of this (for example operator and customer names and contact details) may be personal information about you or third parties your business deals with.
Billing information. If your organisation subscribes to a paid plan, payments are handled by Stripe. Stripe collects and processes your payment details directly; we receive only limited billing metadata (such as plan, subscription status, and the last four digits / card brand). We never receive or store full card numbers.
Technical and usage data. Basic information needed to keep the app secure and working: device and app version, log and diagnostic data, and anti-abuse signals (for example, app integrity checks). We do not use third-party advertising trackers.
We do not sell your personal information, and we do not use your operational data for advertising.
We use a small number of trusted third parties to run the service. They may process information on our behalf and are bound to keep it secure and use it only for the services they provide to us:
We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a business transfer (such as a merger or acquisition), in which case we will let you know.
Your data is stored using Google Firebase (Firestore) and the providers listed above, which may store and process information on servers located outside New Zealand, including in the United States. Where information is transferred overseas, we take reasonable steps to ensure it is protected by comparable safeguards to those required under the Privacy Act 2020.
We use industry-standard safeguards including encryption in transit (HTTPS), hashed passwords, scoped access rules so each organisation can only access its own data, and app-integrity checks. No system is ever completely secure, but we work to protect your information and to notify you and the Office of the Privacy Commissioner if a notifiable privacy breach occurs.
We keep your information for as long as your account is active and as needed to provide the service. If you close your account, we will delete or anonymise your personal information within a reasonable period, except where we are required to retain certain records (for example, billing and tax records) to meet legal obligations.
Under the Privacy Act 2020 you have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it if it is wrong. You can also ask us to delete your account and associated personal information.
Note that much of the operational data in Grafa belongs to your employer or the organisation whose account you use. If your request relates to that data, we may direct you to your organisation’s administrator, or ask them to authorise the change.
To make a request, email us at casey@vivurastudio.co.nz, or use our data deletion request page. We will respond within 20 working days.
Grafa is a business tool intended for use by people in the workforce. It is not directed at children and we do not knowingly collect personal information from anyone under 16.
We may update this policy from time to time. When we make material changes we will update the date at the top of this page and, where appropriate, notify you in the app or by email. Continued use of Grafa after a change means you accept the updated policy.
Questions, requests or complaints about privacy? Get in touch:
Grafa Ltd
Invercargill, Southland, Aotearoa New Zealand
Privacy enquiries: casey@vivurastudio.co.nz
General: hello@grafa.co.nz
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner.