This policy explains what personal information Grafters Global Agency collects, what we do with it, who we share it with, how long we keep it, and the rights you have. It covers people who apply to join us, our members, the businesses we work for and the people who work at them, anyone who contacts us, and visitors to our websites.
It also explains exactly what we do with your social media accounts: what we read from them, what we post to them, and how to stop us. That part is in section 4.
1. Who we are
Grafters Global Agency is a trading name of Grafters Creator Network Ltd, a company registered in England and Wales, company number 16561478. Our registered office is 8 Oxcliff, Scarborough, United Kingdom, YO12 6HA.
Grafters Creator Network Ltd is the controller of the personal information described here. That means we decide how it is used and we are responsible for it.
- Questions about your data, or to use any of your rights: email admin@graftersglobalagency.com, or write to us at the registered office above.
- We have not appointed a Data Protection Officer. Questions about your data are handled by the director of Grafters Creator Network Ltd.
2. What we collect
When you apply or sign up
- Your name, email address and password. Your password is stored only in scrambled (hashed) form.
- Your confirmation that you are 18 or over. We no longer ask for your date of birth. If you joined before we stopped asking, the date you gave us is still on your account.
- Your answers to the application questions.
- The social channels you tell us about: which platforms, your handles and links, and your website if you have one.
- If you contact us through our website: your name, email, phone number if you give it, your business name and your message. We also keep the internet (IP) address the message came from, to stop spam.
When you are a member or a client
- Membership and payment: your plan, payment history and invoices. Card payments are taken by Stripe. We never see or store your full card number. For tax reasons we keep evidence of the country you are in, such as your billing country and the IP address you paid from.
- Training records: lessons started and completed, quiz answers, goals, the figures you record (for example followers, hours or earnings), feedback you leave on lessons, messages with your manager and our team, support tickets, and notes and tasks your manager keeps about your progress.
- Social Studio content: the photos, video and other files you upload, the posts we write and make for you, every version of each post, who approved which version and when, and the disclosure and AI labels each post carried.
- Your social channels: see section 4.
- A Discord username, if you have entered one on your account page. We do not use it for anything, and you can remove it from your account page at any time.
- For businesses: the contact details of the people we deal with, your brand details, and your approvals and comments on content.
- Introductions: if you ask us to introduce you to a brand or partner, the details of that request.
When you use our websites
- Sign-in and security records: when you signed in, and security settings such as two-step sign-in and passkeys.
- If you click a tracked link we made for a client, we record the time, the website you came from and the general type of browser. We do not record your IP address or set a cookie for this.
- The cookies listed in section 11.
Some boxes, such as messages, lesson comments and support tickets, let you type freely. Please do not include health or other sensitive details. We do not ask for them and we do not need them.
3. Where it comes from, and what happens if you do not give it
Most of this comes from you. Some comes from the social platforms, either as public information or because you connected an account (section 4). Some comes from Stripe, which tells us whether a payment succeeded.
We need your name, email, your 18-or-over confirmation and at least one channel to consider an application. We need payment to provide a membership. We cannot post for you on a platform unless you connect it. Everything else is optional.
4. Your social media accounts
There are two separate things here, and they work differently:
- Public information about your channels, which we read to write your channel report and to assess an application. You do not need to connect anything for this.
- Connected accounts. You give us permission, through the platform's own sign-in screen, to post approved content to your account and read back how it did.
4.1 Public information we read about your channels
When you apply, or when you ask for a report on your own channels, we read what is publicly visible on the channels you gave us. We use the platform's official route wherever there is one. We read only the channels you named, and your website if you gave us one.
| Platform | How we read it | What we read | How long we keep what the platform tells us |
|---|---|---|---|
| YouTube | YouTube Data API (YouTube API Services) | Channel name, description, subscriber, view and video counts, recent uploads | No longer than 30 days, then deleted or refreshed |
| Twitch | Twitch API | Channel name, description, whether you are live, recent streams | No longer than 24 hours, then deleted |
| Kick | Kick API | Channel name, description, whether you are live, recent streams | No longer than 24 hours, then deleted |
| Facebook, Instagram | Meta's approved features, only once Meta has approved them for us. Not read today. | Public Page or professional account details: about, category, follower and like counts, recent public posts and their engagement | No longer than 30 days, then deleted or refreshed |
| TikTok, YouTube | The public profile page, read the way a visitor's browser would | What the page shows: bio, counts, recent posts. A screenshot is taken for one check and deleted straight away. | The screenshot is not kept. Our written report is kept (below). |
We do not read X, Snapchat, LinkedIn, Pinterest, Threads or E.P.I.C. Studios automatically. If you want those included, you can type your figures in yourself.
Your report is written in our own words, with the help of an AI model (section 6). It records which platforms were read and when. It does not keep the figures the platforms gave us: those sit in a separate store and are deleted on the clocks above. On your Channels page you can see which platform figures we hold and when each will be deleted, and you can delete them yourself at any time. See our Deleting your data page.
4.2 Connected accounts: posting for you
Grafters Global Agency is adding direct posting one platform at a time, as each platform approves us. We never connect to a platform before it has approved our app. Your account shows which platforms you can connect. Until a platform is connected, our team posts for you by hand.
When you connect an account, you sign in on the platform's own screen and the platform shows you what you are allowing. We never see or ask for your password. The platform gives us an access key (a "token") instead.
| Platform | What you need | What we read | What we post |
|---|---|---|---|
| A Facebook Page you manage | The Pages you manage, and figures for the posts we publish and for the Page | Posts and Reels you have approved, to the Page you choose | |
| An Instagram professional (Business or Creator) account | Your account's ID, username and profile details, and figures for the posts we publish and for the account | Posts, carousels and Reels you have approved | |
| Threads | A Threads profile | Your profile's ID and username, and figures for the posts we publish | Posts you have approved. Threads asks you to renew the connection every 90 days, and we will remind you. |
| YouTube | A YouTube channel | Your channel's ID, name and basic statistics, and figures for the videos we upload | Videos you have approved, with their title, description and settings |
| TikTok | A TikTok account | Your account's ID, display name and profile picture, the posting options TikTok offers you, and the status of each post | Videos you confirm on our posting screen, with the privacy and disclosure settings you choose there |
| A LinkedIn Company Page where you are an Administrator | The Pages you administer, and total (aggregated) figures for the posts we publish | Posts you have approved, to the Page you choose | |
| A Pinterest business account | Your account's ID and boards, and figures for the pins we create | Pins you have approved, one by one, to the board you choose |
We never post anything that has not been approved in the Social Studio. Each post carries the advertising disclosure and AI label it needs. We check that a post is live by reading it back from the platform, and only then mark it as posted.
Platforms we do not connect to: X, Snapchat and E.P.I.C. Studios. Our team posts on those by hand if you ask us to. Kick and Twitch are read-only (section 4.1), because neither lets an app post or stream for you.
How long we keep connected-account data
| What | How long |
|---|---|
| Your access token | Kept encrypted while the account is connected. Destroyed within 24 hours of you disconnecting, the platform withdrawing it, or your membership ending. It is never shown on any screen, to anyone, including our own staff. |
| Figures we read from a connected account | No longer than 30 days, then deleted or refreshed. LinkedIn figures are kept only as totals, and all LinkedIn data is deleted within 10 days of you disconnecting or leaving us. |
| The record of what we posted: which post, which approved version, where, when, and the link | For as long as your account is with us. It is the evidence of what went out in your name and what disclosure it carried. |
| The record that you connected, what you allowed, and when you disconnected | Kept, because it is the record of your permission. |
4.3 What we never do with your social media data
- We never sell it, and we never give it to advertisers, ad networks or data brokers.
- We never use it for advertising, ours or anyone else's.
- We never read your private messages on any platform.
- We never use information from Facebook, Instagram or Threads to decide whether to accept an application.
- We never use Kick or Twitch information to market our own services to you.
- We never use it to train AI models.
- We show it only to you, and to the Grafters Global Agency staff who work with your account. If you are a business, that includes the people in your business who use our client portal.
4.4 Notices for particular platforms
YouTube. Grafters Global Agency uses YouTube API Services. By letting us read or post to your YouTube channel, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's handling of your information is described in the Google Privacy Policy (https://policies.google.com/privacy). You can remove our access to your Google account at any time from your Google security settings (https://security.google.com/settings/security/permissions). We do not place cookies or advertising on your device through YouTube API Services.
Google user data. Grafters Global Agency's use, and transfer to any other app, of information received from Google APIs will follow the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements.
Meta (Facebook, Instagram, Threads). We use information from Meta's platforms only for the purposes in this section. We delete it when we no longer need it, or sooner if you ask. Instructions are on our Deleting your data page.
TikTok, LinkedIn and Pinterest. We use information from these platforms only to post what you have approved and to show you how it did. We keep it no longer than the periods in section 4.2.
4.5 How to stop us
You can remove our access to any platform at any time, either from inside that platform or by asking us. Step-by-step instructions for each platform are on our Deleting your data page. Removing access stops us reading from or posting to that account. It does not delete posts already published. You delete those on the platform itself, and we can help.
5. Why we use your information, and the law that allows it
| What we use it for | Lawful basis (UK GDPR Article 6) |
|---|---|
| Considering your application, including your channel report | Taking steps you have asked for before entering a contract with you |
| Running your membership: training, coaching, your channel reports, the Social Studio, and posting to accounts you have connected | Performing our contract with you |
| Running services for a business client, and dealing with the people who work there | Performing our contract with the business, and our legitimate interest in dealing with its staff |
| Taking payment, and sending service emails such as receipts, sign-in links and account notices | Performing our contract with you |
| Keeping payment, invoice and tax records, including evidence of your country for tax | Complying with our legal obligations |
| Keeping your training records after your membership ends (section 9) | Our legitimate interest in being able to look back over an account's history, answer questions about it later, and hand it over properly to a new manager |
| Keeping a record of what we posted, what was approved and what disclosure it carried | Our legitimate interest in showing what went out in a member's or client's name, and that it met advertising rules |
| Reminding you if you started paying and did not finish | Our legitimate interest in completing an application you started |
| Answering an enquiry from our website | Our legitimate interest in replying to you, or steps before a contract if you are asking to join |
| Keeping our services secure, preventing spam and fraud, and keeping sign-in records | Our legitimate interest in protecting you, us and our systems |
| Improving lessons using your feedback | Our legitimate interest in making the training better |
| Introducing you to a brand or partner when you ask us to | Performing our contract with you |
Where we rely on legitimate interests, you can object (section 10). We do not send marketing emails. If that ever changes, we will ask first, and every email will have a working unsubscribe link.
6. How we use AI, and who decides
We use AI models to help write channel reports and application reports, to research topics and draft posts in the Social Studio, to check drafts, to make images and short video clips, and sometimes to give a first answer to a support ticket.
- A person decides about you. An AI-written application report helps our team, but a person decides whether to accept an application. No decision with a legal or similarly significant effect on you is made by AI alone.
- A person approves every post before it goes out.
- If a support ticket gets an AI answer first, you can always ask for a person.
- To make images and clips, we send a written description to our image and video provider. We do not send your photos, your videos or your contact details.
7. Who we share it with
We use a small number of service providers, who handle personal information for us and on our instructions:
| Provider | What they do for us | Where |
|---|---|---|
| DigitalOcean | Hosts our platform, database and files | Servers in London, UK. DigitalOcean is a US company. |
| Cloudways | Serves the pages of our public website, graftersglobalagency.com. Like any web host, it sees your IP address in its server logs. | Cloudways is part of DigitalOcean, a US company. |
| Anthropic | AI models (section 6): reports, Studio writing and research, support answers | United States |
| fal.ai | Makes images and short video clips from written descriptions | United States |
| Stripe | Takes card payments and manages subscriptions | UK, Ireland and United States |
| Resend | Sends our service emails | United States |
| Cloudflare | Sits in front of our member platform, academy.graftersglobalagency.com, to block attacks and automated abuse. It sees your IP address on every request to the platform and sets one short-lived security cookie (see our Cookie Policy). | United States |
| Google Fonts | Supplies the typefaces on our websites. Your browser fetches them from Google, so Google receives your IP address. | United States |
We also share information:
- with the social platforms, when we post to an account you have connected. Once it is published, the platform's own terms and privacy policy apply to it;
- with a brand or partner, but only when you ask us to introduce you, and only what the introduction needs;
- with a business client, if you work for that business. Its portal shows the content, approvals and reports for its own accounts;
- with professional advisers, HMRC, or other authorities, where the law requires it or to deal with a legal claim.
We do not sell personal information, and we do not share it for anyone else's marketing.
8. Sending information outside the UK
Several of the providers in section 7 are in the United States, or can access data from there. Where personal information leaves the UK, we rely on a safeguard recognised under UK data protection law. That is either the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it, or the UK International Data Transfer Agreement or Addendum in the provider's data processing terms. Ask us (section 1) for details of the safeguard for a particular provider.
9. How long we keep it
We keep two different kinds of information, and we treat them differently.
Your training records: no timer
We keep your training records for as long as you have an account with us, and after it ends. That includes your messages to us, your lesson feedback, your support tickets, your channel reports, and the notes your manager keeps about your progress.
We do this on purpose. Being able to look back over how an account has gone (what was tried, what worked, what was asked and answered) is how we give you a straight answer later, and how a new manager picks up where the last one left off. We do not delete these automatically after any period of time.
If you leave us, your records stay unless you ask us to remove them. If you ask, we delete your account and the records on it, and we tell you what stayed and why. Payment and tax records always stay for the period the law requires.
Losing access is not the same as being deleted. When an account closes, access ends straight away, but the records are still there until you ask us to delete them.
Everything else: a set period
| Information | How long |
|---|---|
| Figures read from YouTube, Facebook, Instagram, Threads, TikTok, LinkedIn or Pinterest | No longer than 30 days |
| Figures read from Twitch or Kick | No longer than 24 hours |
| All LinkedIn data, after you disconnect LinkedIn or leave | Deleted within 10 days |
| Screenshots of public profile pages | Not kept. Deleted after the one check they are taken for |
| Access tokens for connected accounts | Destroyed within 24 hours of disconnection or your membership ending |
| Social Studio: the working copy of your uploaded video | Removed once the content made from it has been approved |
| Social Studio: drafts that were sent back and never approved | Removed once 30 days have passed since they were sent back. |
| Social Studio: finished, published content and the record of what was posted | For as long as your account is with us |
| Payment, invoice and tax records, including evidence of your country | At least six years after the end of the financial year they relate to, as UK tax law requires. Kept even if you ask us to delete your data. |
| Applications that were not accepted, and enquiries from our website | Kept with no timer, so we can answer if you contact us again. Ask us and we will remove them. |
| Sign-in sessions | Removed when they expire |
10. Your rights
You have the right to:
- access the personal information we hold about you. This includes notes and tasks our team keeps about you, because they are your data too. If a copy would reveal someone else's personal information, we check it first;
- correct anything that is wrong or incomplete;
- have it deleted, in many circumstances. See our Deleting your data page;
- restrict how we use it, in some circumstances;
- object to how we use it where we rely on legitimate interests;
- take it with you in a reusable format, where that applies;
- withdraw permission you have given us, including by disconnecting a social account, at any time. This does not affect anything we did before you withdrew it.
To use any of these rights, email admin@graftersglobalagency.com from the email address on your account. We may ask you to confirm who you are. We reply within one month. If a request is complex, we may need up to two more months, and if so we will tell you why within the first month.
Sometimes we cannot delete something straight away, for example payment and tax records, or information we need for a legal claim. If that applies, we will tell you what we kept and why.
11. Cookies
We use only the cookies our websites need to work: one to keep you signed in, one that protects forms against forgery, if you tick "Remember me", one that keeps you signed in on that device, and one short-lived security cookie set by Cloudflare, which protects our member platform from automated abuse. We do not use analytics cookies or advertising cookies, and we do not use tracking pixels. Our pages load fonts from Google Fonts, so your browser connects to Google, which receives your IP address (section 7). Full details are in our Cookie Policy.
12. Age
Grafters Global Agency is for people aged 18 or over. We do not knowingly accept applications from anyone younger. If you think someone under 18 has given us their information, tell us and we will delete it.
13. Keeping it safe
Your data is stored in the UK. Each member's and each client's information is kept separate from everyone else's, and our staff see only the accounts they work on. Access tokens for connected accounts are encrypted, and they are never shown on any screen to anyone. We test our access controls by deliberately attacking them before each release that lets a new kind of user sign in.
14. Complaints
If you are unhappy with how we have handled your information, tell us first at admin@graftersglobalagency.com. We will acknowledge your complaint within 30 days and tell you what we have done about it.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
15. Changes to this policy
When we connect a new platform, add a new provider or change how long we keep something, we update this page and the date at the top. If a change affects how we use information you have already given us, we will tell you by email before it takes effect.
Grafters Global Agency is a trading name of Grafters Creator Network Ltd, registered in England and Wales, company number 16561478. Registered office: 8 Oxcliff, Scarborough, United Kingdom, YO12 6HA.