Privacy Policy
Last updated: 15 August 2026
This is a working draft written to accurately describe what GraftLync actually collects and does — it hasn't been reviewed by a solicitor. Given the app tracks employee location, get it checked before relying on it for Play Store submission or UK GDPR/workplace-monitoring compliance.
GraftLync is a field time, expenses, and vehicle-check tool used by Kirby Group and its engineers ("we", "us"). This policy explains what information the GraftLync app and web dashboard collect, why, and how it's handled.
Who this applies to
GraftLync is an internal business tool. It's provided to engineers and office staff by their employer as part of their employment — it isn't available to the general public, and isn't intended for anyone outside an organisation using it.
What we collect
| Data | Why |
|---|---|
| Name, email address, mobile number | Account creation and sign-in, so office can identify who logged what |
| Precise location (GPS) | Automatically records site arrivals/departures and travel time while the app is tracking a work day, to fill in timesheets and mileage |
| Timesheet entries | Job sites, clock-in/out times, notes — the core record of hours worked |
| Photos — receipts, vehicle defects, profile photo, training materials | Proof of purchase for expense claims, evidence for vehicle defects, and team content |
| Vehicle details | Registration, make/model, mileage, for the daily vehicle walkaround check |
| Chat messages | Private team group chat between engineers — office cannot access this |
Location data specifically
The app tracks location in the background while an engineer's work day is active, so that site visits and travel time are logged automatically instead of by hand. This tracking:
- Is part of the employee's normal working-day use of the app, not a general-purpose location feature
- Is visible to the engineer themselves and to office/management, since that's the record a timesheet system exists to keep
- Can be stopped at any time via the app's "End Day" control
- Is never sold, and never shared with anyone outside the employing organisation
Where data is stored
GraftLync is built on Google Firebase (Firebase Authentication and Cloud Firestore). Data is stored on Google's infrastructure and is only accessible to authenticated GraftLync accounts within the organisation, based on their role (engineer, office, or owner). We don't run separate analytics or advertising services — there's no ad tracking, and no data is sold to third parties.
Who can see what
Access is role-based:
- Engineers can see their own timesheets, expenses, location history, and vehicle checks
- Office can see all engineers' timesheets, expenses, and vehicle checks, to review and approve them
- Owner has full access, including team management
- Private chat is visible only to the engineers in that conversation — office and owner have no access to it, by design
How long we keep it
Timesheet, expense, and vehicle check records are kept as an ongoing employment record for as long as the account is active, and for a reasonable period afterwards as required for payroll and business records. An engineer's account can be deactivated by an owner, which removes their ability to sign in; historical records tied to their account are retained for the organisation's own record-keeping.
Your rights
If you're an engineer or office user based in the UK, you have rights under UK GDPR, including the right to access the personal data held about you and to ask questions about how it's used. Since GraftLync is provided through your employer, the first point of contact for any of this is your employer (Kirby Group), not a third-party GraftLync support team.
Children
GraftLync is a workplace tool for employed engineers and office staff. It isn't directed at, or intended for use by, children.
Changes to this policy
If this policy changes, the update will be posted here with a new "last updated" date.
Contact
Questions about this policy or your data can be sent to t.wilkie@thekirbygroup.co.uk.