FOR HAIR TRANSPLANT CLINICS ONLY ● NO ACCOUNT MANAGERS ● ONLY SPECIALISTSFOR HAIR TRANSPLANT CLINICS ONLY ● NO ACCOUNT MANAGERS ● ONLY SPECIALISTSFOR HAIR TRANSPLANT CLINICS ONLY ● NO ACCOUNT MANAGERS ● ONLY SPECIALISTSFOR HAIR TRANSPLANT CLINICS ONLY ● NO ACCOUNT MANAGERS ● ONLY SPECIALISTSFOR HAIR TRANSPLANT CLINICS ONLY ● NO ACCOUNT MANAGERS ● ONLY SPECIALISTSFOR HAIR TRANSPLANT CLINICS ONLY ● NO ACCOUNT MANAGERS ● ONLY SPECIALISTS

Privacy Policy

How we collect, use, store, and protect your personal information.

Last Updated: May 13, 2026

1. Introduction

GRAFTS.IO is operated by Mostro Group Ltd (“we,” “us,” or “our”), a hair restoration marketing agency specialising in services for hair transplant clinics, based in Edinburgh, United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit grafts.io, contact us, or engage our services.

By using our website or services, you consent to the practices described in this policy.

2. Information We Collect

Information you provide to us:

Name, email address, phone number, and company details when you fill out contact forms, request a consultation, or subscribe to our newsletter
Business information including clinic name, location, website, and marketing requirements
Communications you send to us via email, phone, or messaging platforms
Payment and billing information when you engage our services

Information collected automatically:

IP address, browser type, device information, and operating system
Pages visited, time spent on pages, referring URLs, and clickstream data
Cookies and similar tracking technologies (see Section 6)

3. How We Use Your Information

We use your information to:

Respond to enquiries and provide requested information about our services
Deliver the marketing services you’ve engaged us for (SEO, paid ads, content, lead generation)
Send service updates, invoices, and relevant business communications
Send marketing communications (where you’ve opted in, with the ability to unsubscribe at any time)
Improve our website, services, and customer experience
Comply with legal obligations and enforce our terms of service

4. Legal Basis for Processing (UK/EU Visitors)

Under UK GDPR and EU GDPR, we process personal data on the following lawful bases:

Consent: for marketing communications and non-essential cookies
Contract: to deliver services you’ve engaged us for
Legitimate interests: to operate our business, respond to enquiries, and improve our services
Legal obligation: for tax, accounting, and regulatory compliance

5. Sharing Your Information

We do not sell your personal information. We may share data with:

Service providers who help us operate our business (hosting, analytics, email, CRM, payment processing)
Professional advisors including accountants, lawyers, and auditors
Legal authorities where required by law or to protect our rights

All third parties are required to safeguard your data in line with applicable laws.

6. Cookies and Tracking

Our website uses cookies and similar technologies for analytics (e.g. Google Analytics), advertising (e.g. Google Ads, Meta Pixel), and functionality. You can manage cookie preferences through your browser settings or our cookie banner where available.

7. Data Retention

We retain personal information only as long as necessary to fulfil the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Enquiry data is typically retained for up to 24 months; client records are retained for at least 6 years for tax and accounting purposes.

8. Your Rights

Under UK GDPR, you have the right to:

Access the personal information we hold about you
Request correction of inaccurate data
Request deletion of your data (“right to be forgotten”)
Object to or restrict processing
Withdraw consent at any time
Request data portability
Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at hi@grafts.io.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is completely secure.

10. International Transfers

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or transfers to jurisdictions with adequacy decisions.

11. Children’s Privacy

Our services are directed to businesses and adults. We do not knowingly collect personal information from anyone under 18.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top reflects the most recent revision. Significant changes will be communicated where appropriate.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

Mostro Group Ltd
Email: hi@grafts.io
Edinburgh, United Kingdom