Privacy Policy

The data controller for Daylings (the website daylings.com, the web app, the Mac app and the mobile apps) is:

[Company legal name]
[Registered address]
VAT number: [VAT number]
Email: hello@daylings.com

For anything about your personal data, write to hello@daylings.com. [If a Data Protection Officer is appointed: “You can also contact our DPO at …”; otherwise delete this sentence]

We do

• Use your data only to run Daylings for you: your account, your tasks, reminders, sharing, the assistant and billing.
• Keep your password only as a one-way hash (bcrypt). Nobody at Daylings can read it.
• Let you delete your account and all your tasks at any time, yourself, from Account settings.
• Work only with service providers that need the data to deliver a feature, under data processing terms.
• Use only the cookies and browser storage needed to sign you in and remember your preferences.

We don't

• Sell or rent your personal data, or share it for advertising.
• Show ads, or use advertising, analytics or tracking cookies, pixels or third-party trackers.
• See or store your card details: payments happen on Stripe's checkout page.
• Read your tasks, except when you ask us for support or when the law requires it.
• Use your tasks, messages or voice notes to train AI models.
• Make decisions about you based solely on automated processing.

We collect only what you give us and what the service needs to work:

• Account data: your email address, a display name, your password (stored as a hash), whether your email is verified, and your preferences (language, time zone, 12/24-hour clock, avatar colour, carry-over and reminder settings).
• Google sign-in: if you continue with Google, we receive your name, email address, profile picture link and Google account identifier. We don't get access to your Gmail, Drive, Calendar or contacts.
• Your content: tasks, subtasks, dates, priorities, comments, reminders, and the people you share tasks with (including the email address of someone you invite who doesn't have an account yet).
• Assistant: the messages you type or dictate to the AI assistant, and voice notes, which are converted to text. In the web and mobile apps the conversation is kept only on your device for the current session; via Telegram we keep the last 20 messages so the assistant can follow the conversation.
• Telegram (only if you connect it): your Telegram chat ID, username, display name and language, and the messages and voice notes you send to the Daylings bot.
• Billing (only if you join the Daylings Club): your Stripe customer and subscription identifiers, plan, billing interval, status and renewal date. Stripe processes your payment details and billing address; we never receive full card numbers.
• Consent records: when you accepted the Terms and this Policy (and which version), and when you asked for immediate access to the Daylings Club and acknowledged the loss of the right of withdrawal.
• Newsletter (only if you subscribe): your email address and language.
• Technical data: like any website, our server receives your IP address, browser type and the pages requested. We use it to deliver the pages, to keep the service secure and to limit abuse (for example rate limits on public forms).

We don't ask for, and ask you not to put in your tasks, special categories of data (health, religion, etc.).

We use the following providers (“processors”) to run Daylings. Each one receives only the data it needs for its task and processes it on our behalf.

Telegram. If you connect Telegram, your messages to the Daylings bot and our replies and reminders travel through Telegram's servers. Telegram is an independent service with its own privacy policy; you can disconnect it at any time from Account settings or by sending /stop to the bot.

People you work with. When you share a task, the people you share it with see the task, its subtasks and comments, and your name and email address. If they don't have an account, we send them one invitation email.

Authorities and legal requests. We disclose data to public authorities only when the law requires it. If Daylingsis ever sold or merged, your data would pass to the new owner under this Policy, and we would tell you first.

We don't sell your data and we don't share it with advertisers or data brokers.

Some providers above are based in, or access data from, countries outside the European Economic Area, mainly the United States. When that happens, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework, for certified companies) or by the European Commission's Standard Contractual Clauses, together with additional measures where needed. You can ask us for a copy of the relevant safeguards at hello@daylings.com.

Under the GDPR you have the right to:

• Access your data and get a copy of it (Art. 15).
• Rectify inaccurate data (Art. 16). You can change your name, email, password and preferences in Account settings.
• Erasure (Art. 17). You can delete your account yourself in Account settings → Delete account (cancel an active Daylings Club membership first).
• Restrict processing (Art. 18) and object to processing based on legitimate interest (Art. 21).
• Data portability (Art. 20): receive the data you gave us in a structured, machine-readable format.
• Withdraw consent at any time, for processing based on consent (e.g. the newsletter), without affecting what was done before.
• Lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali, or the authority of the EU country where you live or work.

To exercise any right, email hello@daylings.com from the address of your account. We reply within one month (extendable by two months for complex requests, in which case we tell you why). It's free, unless requests are manifestly unfounded or excessive.

We use only strictly necessary cookies and browser storage, so we don't need to ask for consent and don't show a cookie banner. We don't use analytics, advertising or social-media cookies, and no third-party trackers run on our pages.

On the secure (https) site, cookie names may carry a __Secure- or __Host- prefix. When you pay, Stripe's checkout page, on Stripe's own domain, sets cookies needed for payments and fraud prevention, described in Stripe's cookie policy.

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt, link codes are stored hashed, and the database is not reachable from the internet. Access to production systems is limited to the few people who need it to run the service. No system is perfectly secure: if a breach affects your data, we will notify the supervisory authority and, where required, you, as the GDPR requires.

The assistant uses a language model to understand your requests and turn them into actions on your tasks (create, move, complete, remind…). It acts only on what you ask and only on your own account. Voice notes are converted to text by a speech-to-text model; we don't keep the audio after it has been transcribed.

We don't use your content to train AI models. Daylings does not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects (Art. 22 GDPR).

Daylings is not meant for children. You must be at least 16 years old to create an account. If we learn that we hold data of someone younger, we delete it. If you think a child has given us data, write to hello@daylings.com.

We may update this Policy when the service or the law changes. The date at the top shows the latest version. For important changes we will tell you by email or in the app before they take effect. The Terms of Service explain the rules for using Daylings.

Questions, requests or complaints about privacy: hello@daylings.com, or by post to [Company legal name], [Registered address].