Privacy Policy

Ark Innovative Technologies & Services Limited, trading as Ark HQ, operates Giraft. We hold personal data in two different capacities, and which one applies changes who is responsible for what.

We are the controller

for the data we need to run our business: your account, billing, support correspondence, marketing contacts, and the analytics that tell us how the site and product are used. This policy explains that processing.

We are the processor

for the data inside a school's account: staff and board member details, consultation reviewers, acknowledgement records, and the contents of policy documents. The school is the controller and decides how that data is used. We act on its instructions under our Data Processing Agreement.

Three things worth knowing if your data sits inside a school's account. If you are the principal or chairperson, your name — and your signature image only where your school has captured one — appears on the adoption record of each published policy, by your school's decision; a school can keep any policy internal-only or use a names-only record. If you take part in a consultation, your name and email address are self-declared and your comments are kept as part of the consultation record, but they never appear on the public portal. And acknowledgement and vote records are kept as the school's governance record — the evidence that a policy was consulted on, approved and read.

When we are acting as controller, the personal data we hold falls into these categories:

Account data

Name, work email address, role and the school you belong to. Collected when you sign up, accept an invitation, or are set up by our team.

Billing data

Billing contact name and email, invoice records and payment status. Card details are entered directly with our payment processor and are never seen or stored by us.

Support and correspondence

Emails and messages you send us, and our replies.

Usage and technical data

Pages and features used, actions taken in the product, device and browser information, IP address, and error diagnostics when something goes wrong — including a masked session replay for a sample of sessions, described in section 4.

Abuse-prevention data

For the free public preview we store a one-way fingerprint derived from IP address and browser type, the IP address itself, and a record of attempts, for 30 days. This stops the preview being used to run up cost and lets us investigate confirmed abuse.

Marketing data

Contact details of people who ask to hear from us or enquire about the service, and — only with consent — website analytics and advertising measurement data.

To provide the service — contract

Creating and running accounts, authenticating users, sending the emails the product depends on, and providing support. Processing is necessary to perform our contract with your school, or to take steps at your request before entering one.

To take payment — contract and legal obligation

Invoicing, collecting payment, and keeping the accounting and tax records we are required by law to keep.

To keep the service secure and working — legitimate interests

Diagnosing faults, preventing abuse and fraud, protecting the service and its users. Our legitimate interest is running a secure and reliable service; we have considered the impact on you and use the least intrusive means available.

To improve the product — legitimate interests

Understanding which features are used and where people get stuck, using pseudonymous product analytics. Our legitimate interest is building a service that works for schools.

Marketing and advertising measurement — consent

Website analytics and advertising cookies load only after you opt in through the cookie banner, and you can withdraw consent at any time through Cookie settings.

To meet legal obligations — legal obligation

Responding to lawful requests and complying with our own regulatory duties.

We do not carry out automated decision-making that produces legal or similarly significant effects about you. We do not sell personal data.

We use a small number of strictly necessary cookies to keep you signed in, remember your cookie choices and protect the service. These are required for the site to work and are set without consent, as the law permits.

Beyond that, website analytics (Google Analytics) and advertising measurement (LinkedIn Insight Tag) run on our public marketing pages only, and only after you opt in. The banner offers accept, reject and settings; your choice is stored in your browser's local storage. Until you make a choice, nothing in those categories is loaded and no request is made to those providers.

Inside the product we use a privacy-focused, EU-hosted product analytics tool to understand feature usage. It records actions taken in the product against a pseudonymous identifier, not the body text of a policy.

To diagnose faults we use an EU-hosted error monitoring service. For 10% of sessions, and for every session in which an error occurs, it records a replay of the page layout and clicks. All text and form inputs are masked and images and media are blocked before anything leaves your browser, so a replay shows where someone clicked, not what they typed or read.

You can change or withdraw your consent at any time using the "Cookie settings" link in the footer of any public page.

We use a small number of service providers to run Giraft. Each processes personal data only on our instructions, under a written contract, and only as needed for the purpose shown. This is the complete list:

We may also share data with our professional advisers, and with authorities where the law requires it. If our business is sold or reorganised, data may transfer to the acquiring entity, which would remain bound by this policy.

The application and its database are hosted in Ireland. Error monitoring, product analytics and search indexing run within the European Union. Some other providers listed above process data in the United States — principally our language model provider, our PDF conversion service and our email delivery provider — as shown in the table.

Where data leaves the EEA we rely on an adequacy decision where one covers the transfer, and otherwise on the European Commission's Standard Contractual Clauses together with additional technical and organisational safeguards. You can ask us for details of the safeguards applying to a particular transfer.

Account data

For as long as the account is active, and for twelve months afterwards so an account can be restored if a school returns.

Billing and accounting records

For six years after the end of the relevant financial year, as required by Irish tax and company law.

Support correspondence

For two years after the matter is closed.

Usage and product analytics

For up to twelve months.

Error diagnostics

For 90 days.

Abuse-prevention records

For 30 days.

Unsaved preview drafts

A policy drafted through the free public preview and not saved to an account is deleted after 7 days.

Marketing contacts

Until you unsubscribe or ask us to stop, and then on a suppression list so we do not contact you again.

School data held under the Data Processing Agreement is retained and deleted according to that agreement and the school's instructions, not this section. Backups are overwritten on a rolling cycle and deleted data disappears from them within 30 days.

Where we are the controller, you have the right to:

• •Ask for a copy of the personal data we hold about you.
• •Have inaccurate data corrected.
• •Ask us to delete data, where there is no overriding reason for us to keep it.
• •Ask us to restrict how we use your data while a concern is resolved.
• •Receive data you gave us in a portable format, or have it sent to another provider.
• •Object to processing we carry out on the basis of legitimate interests, including any direct marketing — where you object to direct marketing we will always stop.
• •Withdraw consent at any time, where we rely on consent. Withdrawing does not affect processing already carried out.

To exercise a right, email privacy@giraft.ai. We will respond within one month. We may need to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If your data sits inside a school's account, we will pass your request to that school and help it respond, because the school is the controller for that data.

Giraft is a tool for school staff and boards of management. It is not intended for use by children and we do not knowingly collect personal data from them.

The Service has no fields for student data and holds no student records. School policies do not normally contain student data, and schools are asked not to upload student records, child protection records or other special category data where the policy work does not require it. Where such data nonetheless appears in a document a school uploads, we process it as processor on that school's instructions under the Data Processing Agreement, and it is subject to the same protections as all other school data.

A school may choose to invite parent or student representatives to comment on a policy through a consultation link. That invitation is the school's decision and its own consultation practice applies. Any such reviewer is recorded only as a consultation reviewer — a self-declared name and email address and the comments they make — and that record never appears on the public portal.

• •Data is encrypted in transit and at rest.
• •Each school's data is isolated: row-level security keyed to school membership protects direct database access, and our server checks school ownership on every request that touches school data.
• •Access to production data is restricted to the people who need it. Where a member of our team enters a school account to help with onboarding or support, that access is shown on screen while in use and removed on exit.
• •Documents are held in private storage and served through signed links rather than public URLs.
• •Acknowledgement and invitation links are single-use and stored only as an irreversible hash, so a copy of our database does not yield a working link.
• •A policy ratified through the board-vote workflow is sealed with a cryptographic hash and a frozen copy of the approved text, which a school can verify from the exported record without relying on us.
• •We monitor for errors and unusual activity, run automated checks on every change, and keep our dependencies patched.

No system is perfectly secure, but if we ever suffer a breach affecting your personal data we will act promptly, notify the Data Protection Commission where required, and tell you where the law requires it. To report a suspected vulnerability, email security@giraft.ai.

If you are unhappy with how we have handled your personal data, please tell us first at privacy@giraft.ai so we can put it right.

You also have the right to complain to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — dataprotection.ie. If you live or work in another EU member state you may complain to your local supervisory authority instead.

We update this policy when our practices or the law change. Each version is dated, and the current version is always at giraft.ai/legal/privacy. Where a change materially affects you we will give notice by email before it takes effect.

Ark Innovative Technologies & Services Limited, company number 600940, registered office Cube Building, Monahan Road, Cork, Ireland. Data protection enquiries: privacy@giraft.ai. General enquiries: hello@giraft.ai.