Privacy Policy

1. Introduction

DayAI ("we", "our", or "us") is operated from Nelson Bay, NSW, Australia. We operate the DayAI platform at dayai.ai and its associated subdomains (including app.dayai.ai and pos.dayai.ai), and the related mobile apps. DayAI provides business management tools for small businesses, including:

• DayAI for massage and spa businesses (app.dayai.ai and the DayAI mobile app): booking management, customer relationship management, team management, and payment processing
• Mali AI for restaurants (pos.dayai.ai and the Mali AI mobile app): point-of-sale, table and kitchen order management, menu management, online ordering, and an in-app AI assistant called "Mali"

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. By using DayAI, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Name, email address, and phone number when creating an account or making a booking
• Business information: Business name, address, ABN, services offered, operating hours, and team member details (for shop owners)
• Booking data: Appointment details, service preferences, and booking history
• Payment information: Processed securely through Stripe. We do not store credit card numbers or full payment card details on our servers
• Communications: Messages sent through our platform, LINE Bot, or customer support channels
• Restaurant order data: Items ordered, order notes, table, pickup time, and the name and phone number a customer enters when ordering online from a restaurant
• Menu content: Dish names, descriptions, prices, and photos uploaded by restaurants
• AI assistant conversations: Questions typed into the in-app assistant (Mali) and the answers it gives, including answers a user reports as incorrect

2.2 Mobile App Permissions

• Camera and photos: Used only when you choose to take or select a photo, for example a dish photo for your menu
• Notifications: If you allow notifications, we may send alerts about orders or assistant replies. You can turn them off in your device settings at any time

2.3 Information Collected Automatically

• Device information (browser type, operating system)
• Usage data (pages visited, features used)
• IP address and approximate location
• Authentication tokens and session data

2.4 Information from Third Parties

• Authentication data from LINE Login or Google Sign-In
• Google Business Profile data (for connected business accounts)

3. How We Use Your Information

• To provide and maintain our platform services (bookings, customer management, team management, payroll)
• To process bookings and payments
• To receive restaurant orders and show them to the restaurant's staff and kitchen
• To send booking confirmations, reminders, and service updates via SMS or email
• To enable business owners to manage their operations and communicate with customers
• To provide AI-powered features such as chat assistance, analytics, and business recommendations
• To improve, personalise, and develop new features for our services
• To detect and prevent fraud or unauthorised use
• To comply with legal obligations

4. Third-Party Services

We use the following third-party services to operate our platform. Each has its own privacy policy governing their use of data:

• Firebase / Google Cloud: Cloud infrastructure, database (Firestore), authentication, file storage, and app notifications (Firebase Cloud Messaging). Database records are stored in the australia-southeast1 (Sydney) region; uploaded photos and files are stored in the us-central1 (United States) region (see Section 5). See Firebase Privacy Policy.
• Stripe: Payment processing. Stripe is PCI DSS Level 1 compliant. We do not store card details. See Stripe Privacy Policy.
• Twilio: SMS notifications for booking confirmations and reminders. See Twilio Privacy Policy.
• Resend: Transactional email delivery for booking confirmations and notifications. See Resend Privacy Policy.
• LINE: Messaging platform used for business owner communication via LINE Bot. See LINE Privacy Policy.
• Anthropic (Claude AI): AI-powered features for business assistance and analytics, and a backup model for the Mali assistant. See Anthropic Privacy Policy.
• OpenRouter and OpenAI: The Mali in-app assistant sends the question you type, recent messages in that conversation, and our help-guide text to an OpenAI model through OpenRouter to generate an answer. We do not send payment details. See OpenRouter Privacy Policy and OpenAI Privacy Policy.
• Cloudflare: Hosting and content delivery for pos.dayai.ai and restaurant ordering pages. See Cloudflare Privacy Policy.
• Google Reserve with Google: When a business opts in to Reserve with Google, their business name, address, services, availability, and pricing are shared with Google to enable direct booking from Google Search and Maps. Customer booking data (name, phone, email) may be exchanged between DayAI and Google to facilitate reservations. See Google Privacy Policy.

5. Data Storage and Security

Account, business, booking, and order records are stored on Firebase / Google Cloud servers in the australia-southeast1 (Sydney, Australia) region. Photos and files uploaded to the platform (for example menu photos) are stored in Google Cloud Storage in the us-central1 (United States) region. We implement industry-standard security measures including:

• Encryption in transit (HTTPS/TLS) for all data transfers
• Encryption at rest for stored data
• Secure authentication via Firebase Auth
• Role-based access controls
• Regular security reviews

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Sharing

We do not sell your personal information. We may share data in the following circumstances:

• With service providers: As described in Section 4, to operate our platform
• Between businesses and customers: When you book a service, your booking details (name, phone, email, appointment time) are shared with the relevant business. When you order from a restaurant, your order details (items, name, phone, pickup time) are shared with that restaurant
• With Google (Reserve with Google): For businesses that enable Reserve with Google, business information (name, address, services, availability) and customer booking details are shared with Google to enable bookings from Google Search and Maps
• Legal requirements: When required by law, court order, or to protect the rights, safety, or property of DayAI, our users, or the public
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. Business data (bookings, customer records, team records) is retained as long as the business account remains active. After account deletion, we may retain certain data for up to 90 days for backup and recovery purposes, and as required by law for record-keeping obligations.

8. Your Rights

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Data portability: Request your data in a structured, machine-readable format
• Opt out: Unsubscribe from marketing communications at any time
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time
• Complaint: Lodge a complaint with a relevant data protection authority

To exercise any of these rights, please contact us at manager@dayai.ai. We will respond to your request within 30 days.

How to delete your account

Business owners and staff of the DayAI and Mali AI apps can request deletion of their account and associated personal data by emailing manager@dayai.aifrom the email address used to sign in, with the subject "Delete my account". Restaurant owners can request removal of a staff member's account the same way. We will confirm the deletion within 30 days. Some records may be kept as described in Section 7.

9. Cookies

We use minimal cookies, primarily for authentication and session management. These are essential cookies required for the platform to function. We do not use third-party advertising or tracking cookies. You can control cookie settings through your browser, but disabling essential cookies may prevent you from using certain features of the platform.

10. Australian Privacy Act

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). If you are an Australian resident, you have rights under this legislation including the right to access and correct your personal information. If you believe we have breached the APPs, you may lodge a complaint with us first, and if unsatisfied, with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. GDPR Compliance

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR). These include the right to access, rectification, erasure, restriction of processing, data portability, and the right to object. Our legal bases for processing your data include: performance of a contract (providing our services), legitimate interests (improving our platform), and consent (where applicable).

For GDPR-related enquiries, please contact us at manager@dayai.ai.

12. Children's Privacy

DayAI is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date above. Your continued use of DayAI after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us: