Privacy policy

Two kinds of data, two roles

Account data is data about you, the business using Daykeeper: your name, email, workspace and billing details. For account data, we decide how it's used, so we're the controller.

Customer Content is what your own customers send through Daykeeper: support chats, emails, their names and email addresses, and anything they include in a message. We only process Customer Content to run Daykeeper for you, so for Customer Content you're the controller and we're your processor. If you're one of our customers' customers, please contact the business you talked to about your data.

What we collect

• Account details: name, email address, sign-in details, workspace name and settings.
• Billing details: plan, invoices and payment status. Stripe handles card details; we never see or store full card numbers.
• Customer Content: messages, contact details and anything else that comes in through your support chat widget, support email or our API.
• Credentials you create: API keys and agent credentials, stored so your tools can connect.
• Usage and device data: pages and features used, IP address, browser and device type, and logs we need to keep the service running and secure.
• Emails you send us, for example to support@mydaykeeper.com.

How we use it

• To run Daykeeper: deliver messages, send replies, keep your inbox and settings working.
• To bill you and keep records the law requires.
• To keep the service secure, stop abuse and fix problems.
• To improve Daykeeper using usage data, mostly in aggregate.
• To send you service emails, and product news you can opt out of at any time.

Legal bases (EU and UK)

Under GDPR and UK GDPR, our legal bases are: performing our contract with you, our legitimate interest in running and improving a secure service, complying with the law, and your consent where we ask for it (for example, for some analytics).

AI features

When you use a feature that relies on AI, the content it needs (for example, a conversation you want help replying to) is sent to the AI provider listed below to generate the result. We don't use Customer Content to train AI models, and our AI providers don't use it to train their models under their business terms. AI output can be wrong, so check it before you send it.

SaaS Health Check

If you use the SaaS Health Check, it can process vendor names, plan details, billing periods, prices, usage figures and revenue or cost figures you provide or make available from authorized billing pages. It uses them to review AI SaaS spending, compare current plans and estimate an AI feature's margin. Use billing pages and invoice messages as evidence where possible; figures you supply and memory clues may only be estimates. The Health Check is not financial advice, and its estimates are not a guarantee of savings or profitability.

The Health Check sends the minimum financial figures needed for a calculation to Daykeeper's service. The Vercel-hosted endpoint processes each request in memory to return its result. Daykeeper does not store request or result payloads, write them to application logs, or send them to the private Daykeeper Redis counter service. That service stores an HMAC-SHA256 digest derived from the client's IP address for abuse rate limits; these digests expire within two days. It also stores anonymous daily counts of successful and failed tool calls and generic endpoint failures, grouped by tool, date and outcome, for 90 days. These counters contain no financial figures or request and result payloads. Do not submit credentials, unrelated account exports or customer personal messages. Optional PostHog usage analytics or Stripe aggregate figures are used only when you have an authorized connection and the relevant data is available.

Revenue Leak Finder

Revenue Leak Finder calculates pricing, failed-payment and annual-plan scenarios from figures you enter, and can analyze Stripe CSV exports in your browser. CSV files and customer-level rows stay in that browser view. Daykeeper does not receive raw CSV files or customer rows. When you press Share summary, only aggregate CSV results are sent to ChatGPT. Calculators send the figures needed for calculation to Daykeeper's Vercel-hosted MCP endpoint, which processes request and result payloads in memory and does not store them or write them to application logs. Its separate Redis request-protection namespace stores rate-limit digests and anonymous success and failure counts; operational counters are retained for 90 days and do not contain financial inputs, invoice records or report payloads.

The connected Stripe health check uses Stripe's existing connection through the ChatGPT host. Stripe data follows that connector's data flow; Daykeeper does not receive your Stripe credentials. The health check sends Daykeeper only minimized invoice evidence and sourced setting values needed for the calculation, such as a temporary invoice reference, dates, currency, balance, status and evidence of failed collection. It excludes names, emails, addresses, card details and unrelated account fields. Invoice references are used transiently for deduplication and are not stored. Reports remain in the current session unless you download a local copy; saved history is not provided.

Who we share data with

We don't sell personal data, and we don't share it for advertising. We share it only with the companies below and any feature-specific providers named in this policy. They process data for us under contracts that limit what they can do with it. We may also disclose data when the law requires it (for example, a valid court order).

• DigitalOcean: Cloud hosting and databases for the Daykeeper app
• Resend: Sending emails, including support replies and account emails
• Stripe: Payments and billing
• Anthropic (Claude): AI models that process content when you use AI features
• OpenAI (ChatGPT): AI models that process content when you use AI features
• PostHog: Product and website analytics
• Vercel: Hosting this website and cookieless website analytics

Where data is stored

Daykeeper data is hosted in the US, with EU hosting if you need it. When personal data from the EU, UK or Switzerland is processed in the US, we rely on safeguards the law recognizes, such as the European Commission's Standard Contractual Clauses.

How long we keep it

We keep account data and Customer Content while your workspace is open. When you close your workspace, we delete or anonymize your data within 90 days, except records we must keep for longer by law, such as invoices and tax records. Backups roll off on their normal cycle.

Cookies and analytics

The Daykeeper app uses cookies that are needed to keep you signed in. This website uses PostHog for analytics and Vercel Web Analytics, which doesn't use cookies. If your browser sends a Do Not Track signal, we don't load analytics on this website.

Security

We use encryption in transit, access controls, scoped permissions for API keys and agents, and an audit trail for changes an agent makes. No system is perfectly secure, so if we ever learn of a breach that affects your data, we'll tell you without undue delay.

Your rights

Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. In the EU and UK you can also complain to your local data protection authority. Email support@mydaykeeper.com and we'll answer within one month. We won't treat you differently for using these rights.

If you're one of our customers' customers, send your request to the business you contacted. We'll help them answer it.

Children

Daykeeper is a business tool and isn't meant for anyone under 16. We don't knowingly collect data from children.

Data processing agreement

If your business needs a data processing agreement for Customer Content, email support@mydaykeeper.com.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change matters, we'll also email workspace owners before it takes effect.