Privacy policy

Who we are

GraftAtlas (graftatlas.com) is an independent guide to hair transplant clinics. It is an independently run project, and GraftAtlas is the data controller for this site. Write to us for the controller details required by law.

For anything in this policy, write to hello@graftatlas.com.

What we collect

Analytics, on every visit. We use Google Analytics 4 to see which pages and cities people look at, which links they click, and roughly where they are (country and city level, derived from your IP address by Google). It starts when the page loads and sets cookies in your browser; we never receive your name, your email or your exact location this way. You can stop it by blocking cookies or scripts for this site in your browser, or with any content blocker.

What you type into a form. When you use the cost calculator and leave your address, we store it together with the country and city you would fly from, the destination city, the hair loss stage you picked, the estimate we calculated and the language of the page.

Emails you send us. If you write to us, we keep your message and address so we can reply.

Server logs. The site is hosted on GitHub Pages, which processes your IP address and browser details to deliver the pages and to protect against abuse. We do not have access to those logs.

Why we are allowed to do this

For analytics, the legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing how the site is used. For sending you anything by email, the legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time, as easily as you gave it.

For replying to your emails and keeping the site running safely, the legal basis is our legitimate interest (Article 6(1)(f) GDPR) in answering the people who contact us.

What we do with it

We write to you once, when we publish verified prices for the city you were looking at. That is the only email you get, and it has an unsubscribe link.

We use the aggregate numbers to decide which cities and clinics to research next.

We do not use your data for advertising, and we do not build profiles of you.

Who else sees it

Google LLC, for Google Analytics, and for Google Sheets and Gmail, where the form data is stored and the emails are sent from.

GitHub, Inc., which hosts the site, and Squarespace Domains with Mailgun, which forward mail sent to our address.

These providers may process the data in the United States. They do this under the European Commission's standard contractual clauses and their certification under the EU-US Data Privacy Framework.

How long we keep it

Form data and emails: until you ask us to delete them, or 24 months after your last contact with us, whichever comes first.

Analytics: 14 months, after which Google deletes the user-level data automatically.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format. You can withdraw your consent at any time. We answer within one month and it costs you nothing.

Write to hello@graftatlas.com. If you are unhappy with our answer, you can complain to the data protection authority of the country you live in.

Cookies

Google Analytics sets its cookies when you open a page, and the notice at the bottom tells you so; closing the notice only hides it. The fact that you closed it is the only thing we keep in your browser ourselves.

We use no advertising cookies and no tracking pixels. To refuse the analytics cookies, block cookies or scripts for this site in your browser, or use a content blocker; the site works the same without them.

Children

The site is meant for adults considering surgery. We do not knowingly collect data from anyone under 18.

Changes to this policy

If we change what we collect, we update this page and the date at the top of it. If the change is significant and we have your email, we will tell you by email.