Privacy Policy

1. Controller

The data controller is the company that operates dayto.ai, incorporated in Dubai, United Arab Emirates — [email protected].

2. What we collect

• Account data — email, business name, trade, metro/ZIP, website URL and, if given, a phone number. Used to run your dashboard and audits.
• Audit data — what public AI engines and your public website return for your queries. This is data about your public web presence, not about individuals.
• Technical data — IP-based rate-limit counters; the IP address of a free check, kept with the check to allow one free check per network per month; a record of each device that opens a dashboard (the network part of its IP address, its browser string and a salted one-way hash of its full IP address and browser), used to notice a sign-in link opened on many devices; standard server logs (IP address, the address requested, browser), kept for abuse prevention and debugging; and page statistics from Cloudflare Web Analytics, which sets no cookies.
• Your website — to run a check, our server fetches your public pages, robots.txt and sitemap.
• The dayto beacon, if you install it — each page view on your site calls our server, and we record a visit only when it arrives from an AI answer or comes from an AI crawler: the page address, the referring address, the visitor’s IP address and browser (user agent), and a random session identifier that we store only as a hash. The beacon sets no cookies. We use these records to count visits that arrive from AI answers and to verify AI crawlers against the IP ranges their vendors publish. Tell your own visitors about it in your site’s privacy notice.
• Payment data — we hold no card details. USDT payments are recorded as blockchain transactions with an invoice reference; we keep the amount, the transaction hash and the paying wallet address, which are public on the blockchain.

3. What we do NOT do

• No sale of personal data, no third-party advertising trackers on the dashboard.
• No automated emails: dayto sends no email to customers today. If you write to [email protected], a person replies.
• Your WordPress application password is stored encrypted, never displayed back, and is deleted on disconnect.

4. Processors

Our server and database are in the United States. We use these providers; each receives only what is needed to perform its function:

• Hosting — a virtual server from HostVDS (network operator Cloud Software FZCO) in a data centre in Kansas City, Missouri, USA.
• Cloudflare — the network in front of our server for all traffic, and cookieless Web Analytics.
• Database — Supabase (Supabase Inc.), on AWS in Virginia, USA.
• AI models — Google (Gemini API), OpenAI (API with web search) and Perplexity answer the questions of the AI-visibility check; Google also runs content work, the AI helper and the site builder, OpenAI the premium audit, and Anthropic (Claude) parts of the paid report. They receive the questions, your business name, trade, city and website, and for content work what you give it (for example the text of a review, which may include its author’s name).
• DataForSEO — Google AI Overview results and question research; it receives the search phrase for your trade and city.
• Resend and Telegram — notifications to the dayto team about inquiries (email, business name, message) and payments (invoice reference, transaction hash). Notifications to our team about a visitor who arrived from an AI answer include that visitor's IP address. dayto sends no email to customers today.
• TronGrid and Etherscan — we check payments to our own receiving address; no customer data is sent to them.
• Google Fonts and unpkg.com — your browser loads fonts and scripts from them, so they see your IP address and browser.

5. Retention

Account and audit history are kept while the account is active. Some records are deleted automatically: check jobs after 90 days (the IP address on a job record after 30 days) and recorded AI answers after 365 days. IP addresses are deleted after 90 days. A daily cleanup removes them from audits 90 days after the check and from beacon visit records 90 days after the visit, deletes a free-check counter 90 days after the last check made from that address, and deletes a dashboard device record 90 days after that device last opened the dashboard, so an address is kept for at most 91 days after its last use; database backups that may still hold it are overwritten within the 8 days below. Visit records sent by a site snippet installed before 24 September 2026 with a key that was later replaced may keep the address; we delete them on request. Web server logs, which contain IP addresses, are deleted after 14 days; the remaining log lines written before this rule took effect are deleted by 29 October 2026. Payment records (amount, transaction hash, paying wallet address) are kept for accounting. You can request deletion of your account and its data at any time via [email protected]; we delete within 30 days, except records we must keep by law. Deleted data can remain in daily database backups for up to 8 days.

6. Your rights

Depending on your jurisdiction you may have rights of access, correction, deletion and portability. Write to [email protected] from the account email. If you are in the European Economic Area or the United Kingdom, these rights come from the GDPR, and you may also complain to your data protection authority. If you are a California resident, you have the rights the CCPA gives you; we do not sell personal information or share it for advertising.