Privacy Policy

1. What We Collect

Daylytix collects only the data necessary to provide and improve the service. We collect information in the following categories:

• Account data: Name, email address, and hashed password when you register. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google.
• Billing data: Subscription plan and billing status. Payment details (card numbers, etc.) are handled exclusively by Stripe and are never stored on our servers.
• Audit data: URLs, crawl results, audit scores, and SEO metrics for sites you choose to audit. This data belongs to you and is stored to power your dashboard, history, and reports.
• Usage data: A record of the actions you take in your account, such as running an audit, opening a tool, connecting Google or downloading a report, with the time and the domain of the audited site. It never includes what you write in AI Chat or the Content Writer, your API keys or passwords, or your IP address. We use it, on the basis of our legitimate interest, to improve the product and to see where people get stuck so we can help them. It is kept while your account exists and deleted with it.
• Newsletter data: If you subscribe to our newsletter on daylytix.com, we store your email address, the page you subscribed from, when you subscribed and confirmed, and the codes used in your confirmation and unsubscribe links.
• Contact form data: If you write to us through the contact form on daylytix.com, we receive your name, email address, company or website if you give one, the topic you choose and your message.
• Configuration data: Agency name, website, tagline, report footer, and integration keys (GSC service account JSON, GA4 property ID) that you provide to configure the platform.

2. How We Use Your Data

We use the data we collect solely to operate and improve Daylytix. Specifically:

• To authenticate your account and maintain your session.
• To run site audits, crawl URLs you provide, and generate reports on your behalf.
• To process subscription billing and manage your plan via Stripe.
• To send transactional emails - including audit completion notifications, scheduled report deliveries, and performance budget alerts - to the email address you registered with.
• To improve platform reliability, fix bugs, and prioritise new features based on how the platform is used.
• To send our newsletter (SEO tips and product updates), only if you subscribed and then confirmed through the link we email you. We rely on your consent for this, and every newsletter contains a one-click unsubscribe link. Unconfirmed addresses receive nothing except the confirmation email. When you unsubscribe we stop sending and keep only a record that you unsubscribed; you can ask us to delete it at any time.
• To answer the messages you send us through the contact form. Each message is delivered to our mailbox, and we keep a copy on our server for up to 12 months so that no message is lost, then delete it. You can ask us to delete it sooner at any time.

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your data to train AI models.

3. Third-Party Services

Daylytix integrates with the following third-party services to deliver its functionality:

• Stripe: Handles all payment processing. Card details are never transmitted to or stored on Daylytix servers. Stripe's privacy policy applies to billing data.
• AI provider: If you configure an AI provider API key for AI features, requests are sent directly to the AI provider API. Daylytix does not proxy or store the contents of AI generation requests beyond what is shown in your session.
• Resend: Sends our emails, including account and report emails, the newsletter and the messages you send through our contact form. Resend receives the recipient's email address and the content of the message in order to deliver it.
• Google Fonts: Used to load the Inter typeface for the web interface. Google's standard font service terms apply.
• Bing Webmaster Tools API: Accessed on your behalf using credentials you provide. Data is used only within your audit session and reports.

4. Data Storage & Security

Audit results and account data are stored on servers located within the European Union. We apply industry-standard security practices including:

• Passwords stored using bcrypt hashing - plain-text passwords are never stored.
• All data transmitted over HTTPS using TLS 1.2 or higher.
• Service account credentials and API keys stored in encrypted configuration files with restricted file system access.
• Regular security reviews and dependency updates.

Your audits stay in your account, to support score history and comparisons, until you delete them; you can delete individual audits at any time. When a free trial ends without a paid plan, we keep its audits, reports and settings for 30 days, so you can pick up where you left off, and then delete them; we email you 7 days before. To delete your whole account and its data, email us: we close the account straight away and delete its data within 7 days. Copies in our backups are overwritten within 30 days.

5. Your Rights

Depending on your location, you may have the following rights under applicable data protection law (including GDPR for EU residents):

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your account and all associated data. We will process erasure requests within 30 days.
• Portability: Request your audit data in a machine-readable format (Excel and CSV exports are available in the platform; ask us for anything else).
• Objection: Object to processing of your personal data where we rely on legitimate interests as the legal basis.
• Withdraw consent: Unsubscribe from the newsletter at any time with the link in any newsletter email, or by writing to us. Revoke Google OAuth access at any time via your Google account permissions page. This will disable GSC and GA4 integrations.

To exercise any of these rights, contact us at hello@daylytix.com.

6. Cookies

Daylytix uses a minimal set of cookies necessary to operate the service:

• Session cookie: A secure, HTTP-only cookie that maintains your authenticated session. It stays valid for up to 31 days or until you log out.
• CSRF token: A security cookie that protects against cross-site request forgery attacks.

Analytics on the public website: Our website at daylytix.com uses Google Analytics 4 to count page views and see which pages people find useful. It is operated by Google and sets its own cookies (_ga and _ga_*). We do not load it unless you agree: on your first visit a notice asks, nothing analytics-related runs until you choose Accept, Decline is offered just as prominently, and the site works fully either way. You can change your mind at any time through the Cookies link in the footer, and declining also deletes any analytics cookies already stored on your device.

The Daylytix application itself, at app.daylytix.com, carries no analytics and no tracking of any kind.

We do not use advertising cookies or tracking pixels, and we do not participate in cross-site tracking networks.

7. Contact

If you have any questions about this Privacy Policy, or wish to exercise your data rights, please contact us:

• Email: hello@daylytix.com
• Response time: We aim to respond to all privacy-related enquiries within 5 business days.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the service after changes are published constitutes your acceptance of the revised policy.