GRAFT.TODAY is operated by Jacob Kotzee trading as GRAFT.TODAY, a sole proprietor registered in the Republic of South Africa. We are the “responsible party” for the personal information of our subscribers and website visitors, as defined by the Protection of Personal Information Act 4 of 2013 (“POPIA”).

This Privacy Policy covers our website at https://graft.today, the subscriber dashboard, any embedded chatbot widgets delivered through our service, and all related GRAFT.TODAY products.

• Information Officer: Jacob Kotzee — hello@graft.today
• Physical address: Parkview Heights, Cape Town, Western Cape, 7550, South Africa

Because GRAFT.TODAY is a multi-tenant platform, we process personal information in two distinct capacities:

We collect the following categories of personal information when you register for and use GRAFT.TODAY:

When you use GRAFT.TODAY’s products to serve your own customers, we process the following categories of data as your operator:

• Chatbot conversations: Messages exchanged between your end-users and your deployed GRAFT AI Assistant widget, including personal information they voluntarily share (name, email, contact details, queries).
• Triaged Detail Contact details and engagement data your end-users share through your deployed GRAFT AI Assistant widget.
• Appointment data: Booking information integrated via Cal.com on your behalf.

You are responsible for ensuring you have a lawful basis to collect and process your own customers’ data, and for complying with applicable data protection law in your jurisdiction.

We process your personal information only for the following purposes:

• Service delivery: Creating and managing your account, authenticating sessions, and delivering platform features
• Billing: Processing your subscription via Paddle, handling invoices and renewal events
• Transactional communications: Sending receipts, onboarding guides, important service notices, and alerts (via Resend)
• Security and fraud prevention: Monitoring for abuse, detecting suspicious activity, and maintaining audit logs
• Service improvement: Analysing aggregated, anonymised usage patterns to improve platform performance and features

We do not sell your personal information to third parties, and we do not use your data for targeted advertising.

Under POPIA, all processing of personal information must be lawful. The table below sets out the legal grounds we rely on:

We share your personal information only with trusted third-party service providers who process it on our behalf and under our instructions. Below is our current list of sub-processors:

All sub-processors are contractually required to process data in accordance with our instructions and applicable data protection law. We review our sub-processor list regularly and will update this policy if it changes.

We keep your personal information for as long as your account is active or as otherwise required by law. Specifically:

• Account and usage data is deleted within 90 days of account closure
• Billing records are retained for up to 7 years to satisfy South African tax and commercial law requirements
• Chatbot conversation logs are retained for the period configured in your dashboard; you may request earlier deletion at any time
• Where we are legally required to retain data for longer, we will do so and inform you if practicable

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, accidental loss, alteration, or destruction. These measures include:

• All data in transit is encrypted using TLS
• Database connections require SSL/TLS
• Production system access is restricted to authorised personnel
• Authentication is managed by Clerk with industry-standard credential security
• Third-party payment security is delegated entirely to Paddle (PCI-DSS compliant)

No method of transmission over the internet or electronic storage is completely secure. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator as required by POPIA Section 22.

Under POPIA (Sections 23–25), you have the following rights in relation to your personal information:

• Right of access: Request a description of the personal information we hold about you and how it is processed
• Right to correction: Request correction of inaccurate, irrelevant, outdated, or incomplete information
• Right to deletion: Request deletion or destruction of personal information that is no longer lawfully retained
• Right to object: Object to the processing of your personal information on grounds relating to your particular situation
• Right to complain: Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact our Information Officer at hello@graft.today. We will respond within a reasonable time, and in any event within the timeframes required by POPIA.

GRAFT.TODAY uses only essential cookies — those strictly necessary for session management and authentication. We do not use advertising cookies, third-party tracking pixels, or cross-site tracking technology.

You may configure cookie preferences in your browser settings. Disabling essential cookies will impair your ability to log in and use the platform.

GRAFT.TODAY serves customers globally. Your personal information may be processed by our sub-processors on servers located outside South Africa — primarily in the United States and European Union. In these cases, we take reasonable steps to ensure that cross-border transfers are subject to appropriate safeguards, consistent with POPIA Section 72.

By using GRAFT.TODAY, you acknowledge that your personal information may be transferred to and processed in jurisdictions outside South Africa.

We will only send you marketing communications if you have opted in, or where we have an existing business relationship that permits it, in compliance with POPIA Section 69. You may opt out of marketing emails at any time by clicking the unsubscribe link in any email or contacting us at hello@graft.today.

Note for GRAFT.TODAY subscribers: If you use the services to communicate with your own customers ortriaged initiated enquiries you are responsible for ensuring those communications comply with applicable electronic direct marketing laws in your jurisdiction (including POPIA Section 69 in South Africa, CAN-SPAM in the United States, and the GDPR in the European Union).

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Where changes are material, we will notify active subscribers by email at least 30 days before they take effect. Continued use of GRAFT.TODAY after the effective date constitutes acceptance of the revised policy.

For any privacy-related questions, data subject access requests, or to reach our Information Officer:

• Email: hello@graft.today
• Information Officer: Jacob Kotzee
• Operator: Jacob Kotzee trading as GRAFT.TODAY
• Physical address: Parkview Heights, Cape Town, WC, 7550, South Africa

This policy is a good-faith effort to comply with POPIA and applicable international data protection law.