Privacy policy. What we hold, and why.

Who we are

Dayrun is operated by the company named in our legal notice. This policy covers dayrun.ai, Talk to Dayrun, and the Dayrun product.

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the CPRA, and the privacy laws of the other places our customers operate.

Two roles

When a business uses Dayrun to answer its customers, that business decides how its customers' information is used. We handle it on the business's behalf and on its instructions, as its processor under GDPR and its service provider under the CCPA. Questions about that information are best sent to the business first, and we will help them answer.

For people who visit our site, talk to Dayrun about Dayrun, or hold an account, we decide how the information is used and this policy applies to us directly.

What we collect

From account holders and their team: name, work email, phone number, role, billing details and what they do in the product. Card payments are handled by our payment provider, and we never see full card numbers.

From conversations Dayrun handles for a business: the audio of the call or message, a transcript, the phone number or handle it came from, and whatever the person chose to share, such as a name, a booking time or a reason for visiting.

From the systems a business connects, only the fields the work needs, such as availability, services and the customer record a booking attaches to.

From Talk to Dayrun: the number you give us, then your name, email, business details and what you are looking for, plus the recording, transcript and summary of the conversation.

From our site: pages visited, device and browser type, approximate location from your IP address, and a bot check. We do not use advertising trackers.

We do not ask for sensitive information such as health details. If someone shares it in a conversation, for example when booking at a clinic, it is handled with extra care and only for that booking.

How we use it

To provide the service: answering calls and messages, making bookings, filling rosters and showing the business what happened.

To keep it safe and working: preventing abuse and fraud, securing accounts, fixing faults and supporting you.

To run our business: billing, keeping records the law requires, and getting back to people who asked Dayrun to contact them.

To improve Dayrun, using service measurements such as call volumes and response times, never the content of conversations.

AI and your data

We never use your data, your customers' data or any conversation to train AI models, ours or anyone else's.

The AI providers that read a transcript or produce a voice process it only to give Dayrun an answer. They are bound by terms that do not allow them to train on it, and where a provider offers a training opt out, such as our speech recognition provider, we turn it on.

Dayrun's staff say they are AI. They do not make decisions that have legal or similarly significant effects on a person, and anyone can ask to speak to a person instead.

Our legal bases

Under GDPR and UK GDPR we rely on: performing our contract with a business; our legitimate interests in securing, supporting and improving the service, understanding how our site is used and replying to enquiries, balanced against your rights; your consent, for being contacted through Talk to Dayrun; and legal obligations such as tax records.

You can withdraw consent at any time, and it does not affect anything done before you withdrew it.

Who we share it with

Only providers that make Dayrun work, each bound by contract to use it only to provide their service to us and to protect it: hosting and databases (Neon, Railway, Cloudflare, Upstash), calls and messages (Twilio, Meta for WhatsApp, Vapi), speech and voice (Deepgram, ElevenLabs), AI models (OpenAI through Vercel AI Gateway), sign in (Clerk), payments (Stripe), site analytics (Google Analytics) and team notifications (Slack). The current list is available at [email protected].

We do not sell personal information, we do not share it for cross context behavioural advertising, and we have not done either in the past twelve months.

We disclose information when the law requires it, to protect people from harm, or as part of a sale or merger of our business, where the buyer must keep this policy's promises.

Where it is stored

The Dayrun product's databases are in Sydney, Australia. Some of the providers above process information in other countries, including the United States and the European Union, to provide their service.

Before information leaves Australia, we take reasonable steps under Australian Privacy Principle 8 to make sure it is protected to the same standard. For information from the EU, EEA or UK, we rely on adequacy decisions or the Standard Contractual Clauses and UK Addendum.

How long we keep it

Call recordings and transcripts: twelve months by default, and a business can set it shorter. Bookings and customer records: while the business's account is open, then deleted within thirty days of closing unless exported.

Talk to Dayrun enquiries: up to twenty four months after our last contact, unless you become a customer. Account and billing records: seven years after the account closes, because tax law requires it.

Backups roll off on a regular schedule, and deleted information leaves them as they expire.

How we protect it

Encryption in transit and at rest, access limited to the people and services that need it, an audit trail of access to customer data, and bot protection on the public parts of our site.

No system is perfectly secure, so we also plan for things going wrong, as set out below.

Your rights, wherever you are

You can ask what we hold about you, ask for a copy, ask us to correct it or delete it, and object to how we use it. Send requests to [email protected]. We reply within thirty days, and we will ask you to confirm who you are before handing anything over.

If we hold your information for a business, we pass your request to that business or act on its instructions, and let you know.

Using your rights is free, and you will not be treated differently for using them.

If you are in Australia

You have the rights set out in the Australian Privacy Principles, including accessing and correcting your information. You can browse our site without identifying yourself.

If you are unhappy with how we handled a privacy concern, contact us first. If we do not resolve it within thirty days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If you are in the EU, EEA or UK

You have the right to access, correct, erase, restrict and move your information, to object to processing based on legitimate interests, to withdraw consent, and not to be subject to decisions made solely by automated means that significantly affect you.

You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

If you are in California or another US state

In the past twelve months we have collected identifiers such as name, email and phone number; commercial information such as bookings and billing; internet activity on our site; approximate location; audio recordings and transcripts; and professional details such as your business and role. We collect them from you, from the businesses that use Dayrun, and from the systems they connect, for the purposes described in this policy.

You have the right to know what we collect and why, to delete it, to correct it, and not to be discriminated against for asking. We do not sell or share personal information, and we do not use sensitive personal information to infer anything about you. We honour Global Privacy Control signals. An authorised agent can make a request for you with your written permission.

Residents of other states with privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas and Oregon, have similar rights, which you can use the same way. If we decline a request, you can appeal by replying to our answer.

Other places

We also apply the protections of the New Zealand Privacy Act 2020 and Canada's Personal Information Protection and Electronic Documents Act to people in those countries, and the same rights described above apply.

When Dayrun contacts you

Through Talk to Dayrun we only call, text or message a number whose owner asked us to, and we say we are AI at the start.

You can reply STOP to any text to stop messages, or ask us at [email protected]. We follow the Spam Act 2003, the Do Not Call Register Act 2006 and the Telephone Consumer Protection Act.

Cookies and analytics

We use Google Analytics to understand which pages are useful, and Cloudflare Turnstile to check that a request to Talk to Dayrun comes from a person. Neither is used for advertising.

You can block or delete cookies in your browser settings, or install Google's Analytics opt out browser add on to stop Google Analytics collecting your visits.

Children

Dayrun is for businesses and is not directed at children. We do not knowingly collect information from anyone under sixteen. If you think we have, tell us and we will delete it.

If something goes wrong

If a data breach is likely to cause serious harm, we notify affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Where GDPR applies, we notify the relevant authority within seventy two hours of becoming aware, where required. We tell businesses without undue delay when a breach affects their customers, and meet the breach notice laws of US states and other places.

Changes to this policy

When we change this policy, we update the date at the top. If a change matters, we tell account holders before it takes effect.

Contact us

Privacy questions and requests: [email protected]. A person reads every one. Our company details and registered address are in our legal notice.