Legal
Privacy Policy
Last updated: 13 September 2026
PRIVACY POLICY
Daiass — Your Daily Assistant
Effective Date: 8 September 2026 Last Updated: 13 September 2026
1. WHO WE ARE
Data Controller:
Denergi OÜ (trading as "Daiass")
- Registered Address: Kooli Tee 6, Tarbja, Estonia
- Email: info@daiass.eu
- Website: daiass.eu
Data Protection Officer (DPO):
Daiass has determined that a formal Data Protection Officer is not required under Article 37 of the GDPR, as we do not meet the thresholds for public authorities, large-scale systematic monitoring, or large-scale processing of special category data. Privacy enquiries should be directed to info@daiass.eu.
Supervisory Authority:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI)
- Address: Tatari 39, 10134 Tallinn, Estonia
- Website: www.aki.ee
- Phone: +372 627 4135
2. PERSONAL DATA WE COLLECT
We collect and process the following categories of personal data:
2.1 Account Data
- Full name
- Business email address
- Password (stored as bcrypt hash — never in plain text)
- Business name, industry, company size, country, timezone, preferred language
- Role within the organisation (owner, admin, member)
- Profile avatar URL (if provided)
- Terms acceptance timestamp and version
2.2 Email Content (via Gmail OAuth)
- Full email body content (incoming and outgoing)
- Email subject lines, sender and recipient names and email addresses
- Email timestamps, thread IDs, message IDs, labels, and read status
- Email snippets and previews
2.3 Calendar Data (via Google Calendar OAuth)
- Event titles and descriptions, start and end times
- Attendee names and email addresses, event locations
- Calendar event IDs, recurring event patterns
2.4 Call Data (via Twilio + Retell AI)
- Inbound caller phone numbers, business's provisioned Twilio phone number
- Call duration in seconds, full call transcripts (text)
- AI-generated call summaries, call timestamps
- Call outcome classification (resolved, message taken, appointment booked)
- Caller sentiment classification
2.5 Client Data (entered by you about your own clients)
- Client full name, company name, email address, phone number, WhatsApp number
- Lead source, client status (lead, active, inactive, churned), tags, manual notes
- Custom fields defined by your business
- Monthly revenue estimate (entered by you), client health score (AI-calculated)
- Preferred communication tone (AI-learned), best contact time (AI-learned)
- Last interaction date
2.6 Payment and Billing Data
- Billing email address, Stripe customer ID (reference only)
- Stripe subscription ID, subscription status and tier
- Monthly usage quantities per metric, invoice history references
Important: Daiass does not store payment card details. All payment processing is handled entirely by Stripe.
2.7 Usage and Technical Data
- IP address, browser type and version, operating system, device type
- Pages visited within the platform, feature usage patterns
- Session identifiers (stored in Redis, not linked to personal profile)
- API request timestamps, error logs (anonymised where possible)
2.8 AI Memory Data
- Writing style samples (email text provided during onboarding)
- Writing rules derived from the style sample
- Business context entries (services, pricing, target clients)
- Knowledge base Q&A pairs, client-specific communication preferences
- Any memory entries manually added by you
2.9 Support and Communication Data
- Support enquiry content, email correspondence with Daiass
- Feedback submitted through the platform
2.10 Team Member Data
- Invited team member names and email addresses
- Assigned roles and permissions, invitation tokens (time-limited)
- Account creation timestamps
3. HOW WE COLLECT YOUR DATA
| Source | Examples |
|---|---|
| Directly from you during registration | Name, email, business name, password |
| Directly from you during onboarding | Business description, industry, services, writing style sample |
| Directly from you in settings | Knowledge base entries, AI preferences, team invitations |
| Automatically via Gmail OAuth | All emails in your connected Gmail inbox |
| Automatically via Google Calendar OAuth | All events in your connected Google Calendar |
| Automatically via Twilio inbound call webhooks | Caller phone number, call metadata |
| Automatically via Retell AI webhooks | Call transcript, call duration, call summary |
| Generated by Daiass AI systems | Email summaries, reply drafts, call summaries, client health scores, AI next-action recommendations, weekly insights, relationship summaries |
| From your own clients indirectly | Client data you enter about your clients, inbound emails and calls from those clients |
| From Stripe | Payment confirmation, subscription status, invoice data |
| Automatically from platform usage | IP address, browser data, feature usage patterns, session data |
4. LEGAL BASIS FOR PROCESSING
We process your personal data on the following legal bases:
| Processing Activity | Legal Basis | Justification |
|---|---|---|
| Account creation and management | Contract necessity (Art. 6(1)(b)) | Required to provide the service |
| Email processing and AI reply drafting | Contract necessity (Art. 6(1)(b)) | Core service feature you contracted for |
| Calendar integration and appointment booking | Contract necessity (Art. 6(1)(b)) | Core service feature |
| Voice call answering and transcription | Contract necessity (Art. 6(1)(b)) | Core service feature |
| Client database management | Contract necessity (Art. 6(1)(b)) | Core service feature |
| Usage tracking for billing | Contract necessity (Art. 6(1)(b)) | Required for usage-based billing |
| Stripe payment processing | Contract necessity (Art. 6(1)(b)) | Required to process subscription payments |
| Security monitoring and rate limiting | Legitimate interests (Art. 6(1)(f)) | Protecting platform integrity and all users |
| Fraud prevention and IP banning | Legitimate interests (Art. 6(1)(f)) | Protecting platform integrity |
| Audit logging of security events | Legitimate interests (Art. 6(1)(f)) | Security and legal defence |
| Platform analytics and performance monitoring | Legitimate interests (Art. 6(1)(f)) | Improving service quality — anonymised |
| Tax and accounting records | Legal obligation (Art. 6(1)(c)) | Estonian tax law requires 6-year retention |
| Sending daily AI briefing emails | Contract necessity (Art. 6(1)(b)) | Core service feature explicitly configured by you |
| Marketing communications to existing customers | Legitimate interests (Art. 6(1)(f)) | Existing customer relationship — with opt-out |
| Marketing communications to non-customers | Consent (Art. 6(1)(a)) | Must be freely given with clear opt-out |
Important B2B Distinction: When Daiass processes data belonging to your own clients (emails from your clients, call recordings of your clients' calls), Daiass acts as a data processor on your behalf, and you are the data controller. You are responsible for ensuring you have a lawful basis to process your clients' data through the Daiass platform.
5. PURPOSES OF PROCESSING
We process your personal data for the following purposes:
- Core service delivery: Providing AI email management, voice call answering, calendar booking, and client relationship management.
- AI processing: Generating email summaries, reply drafts, call summaries, client health scores, relationship summaries, next-action recommendations, weekly insights, and daily briefings.
- Background automation: Running scheduled email follow-up checks, daily briefing generation, calendar reminders, and client health score updates while the platform is not actively in use.
- Client data management: Maintaining your client database, interaction history, and AI-learned client preferences.
- Usage-based billing: Tracking usage of AI features (emails processed, call minutes, bookings, agent messages, follow-ups) for plan limits. Included usage is covered by the monthly subscription fee. Only extra usage past the included amount (overage) is reported to Stripe as metered events for invoicing.
- Platform security: Rate limiting, IP ban enforcement, session management, audit logging, and fraud prevention.
- Authentication: Verifying user identity, managing sessions, and providing Google OAuth login.
- Team management: Managing role-based access for team members within the same business account.
- Customer support: Responding to support enquiries and troubleshooting technical issues.
- Legal compliance: Maintaining records required by Estonian tax law and GDPR obligations.
- Service improvement: Analysing aggregated, anonymised usage patterns to improve platform performance and features.
6. SUB-PROCESSORS
We engage the following sub-processors to deliver our services:
| Sub-Processor | Role | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Supabase Inc. | Primary database and authentication infrastructure | All platform data including account data, client data, emails, transcripts, AI memory | EU West (Ireland) | EU-based; adequacy decision applies |
| OpenAI LLC | AI processing for email summaries, reply drafts, call summaries, agent responses, insights | Email content, call transcripts, client interaction history, business context, agent conversation messages | United States | Standard Contractual Clauses (SCCs) |
| Retell AI Inc. | AI voice conversation engine for inbound calls | Call audio during conversation, call transcripts | United States | Standard Contractual Clauses (SCCs) |
| Twilio Inc. | Phone number provisioning and call routing | Caller phone numbers, call metadata, call duration | United States | Standard Contractual Clauses (SCCs) |
| Stripe Inc. | Payment processing and subscription management | Billing email, payment method details, subscription data, invoice history | United States | Standard Contractual Clauses (SCCs) |
| Vercel Inc. | Web hosting, content delivery, and scheduled background jobs | Web traffic, IP addresses, HTTP request data | Global edge network | Standard Contractual Clauses (SCCs) |
| Upstash Inc. | Redis caching, rate limiting, and session management | Session identifiers, IP addresses, cached API responses | EU region | Standard Contractual Clauses (SCCs) |
| Google LLC | OAuth authentication provider for Gmail and Calendar access | Authentication tokens, Gmail email content, Google Calendar data | United States | Standard Contractual Clauses (SCCs) |
| Resend Inc. | Transactional email delivery for platform notifications | Recipient email address, email content of platform notifications (not client emails) | United States | Standard Contractual Clauses (SCCs) |
Law enforcement: Daiass may disclose data to competent authorities when legally compelled to do so under applicable law. Daiass will notify affected users where legally permitted.
We maintain an up-to-date list of sub-processors and will notify you of any material changes at least 30 days in advance via email.
7. INTERNATIONAL DATA TRANSFERS
Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States, where several of our sub-processors are located.
Transfer Mechanism: All transfers to US-based sub-processors are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission under Article 46(2)(c) of the GDPR, following the invalidation of Privacy Shield in Schrems II (Case C-311/18).
Supplementary Measures Applied:
- Encryption of all data in transit using TLS 1.3
- Encryption of sensitive tokens (OAuth credentials) at rest using AES-256-GCM
- Pseudonymisation where technically feasible
- Minimum data transfer principle — only data necessary for the specific service is shared
- OpenAI API calls are made under OpenAI's API terms, which specify that API input/output data is not used for training OpenAI models by default
User Acknowledgment: By using Daiass, you acknowledge that your data and your clients' data processed through the platform may be transferred to and processed in countries outside the EEA, specifically the United States, under the mechanisms described above.
8. DATA RETENTION PERIODS
| Data Category | Retention Period | Rationale |
|---|---|---|
| Active account data (profile, settings, preferences) | Duration of active subscription | Contract performance |
| Email content and AI summaries | Duration of subscription + 30 days after account deletion | Service provision, then deletion |
| Call transcripts and recordings | Duration of subscription + 30 days after account deletion | Service provision, then deletion |
| Client database records | Duration of subscription + 30 days after account deletion | Service provision, then deletion |
| Interaction history | Duration of subscription + 30 days after account deletion | Service provision, then deletion |
| AI memory entries | Duration of subscription + 30 days after account deletion | Service provision; you may delete earlier |
| Billing records and invoices | 6 years from transaction date | Estonian tax law |
| Stripe payment references | 6 years from transaction date | Estonian tax law |
| Security audit logs | 12 months | Security monitoring and legal defence |
| IP ban records | 12 months from ban expiry | Security monitoring |
| Session data (Redis) | 30 days from last activity | Authentication |
| Deleted account backups | 30 days from deletion request | Technical disaster recovery, then purged |
| Terms acceptance records | Duration of relationship + 6 years | Legal compliance |
| Team invitation tokens | 7 days or until accepted, whichever comes first | Technical necessity |
| Marketing consent records | Until consent withdrawn + 3 years | Legal defence |
Account Deletion Grace Period: When an account deletion is requested, data is scheduled for permanent deletion 30 days later. During this 30-day period, the account is suspended but not deleted, allowing recovery if the deletion was accidental. After 30 days, all data is permanently and irreversibly deleted except billing records required by tax law.
9. YOUR DATA SUBJECT RIGHTS
Under the GDPR, you have the following rights:
9.1 Right of Access (Art. 15)
You can request a complete export of all data Daiass holds about you by clicking "Export my data" in Settings → Security, or by emailing info@daiass.eu. The export is provided as a downloadable JSON file within 30 days.
9.2 Right to Rectification (Art. 16)
You can correct inaccurate personal data directly within your account settings. For data that cannot be self-corrected, contact info@daiass.eu.
9.3 Right to Erasure (Art. 17)
You can request account deletion in Settings → Security → Delete Account. Data is permanently deleted within 30 days of the request. Billing records required by tax law are retained for the legally required period.
9.4 Right to Restrict Processing (Art. 18)
You may request restriction of processing by contacting info@daiass.eu. We will acknowledge the request within 5 business days and confirm the restriction within 30 days.
9.5 Right to Data Portability (Art. 20)
All data is exportable in machine-readable JSON format via Settings → Security → Export my data. This applies to data provided directly by you and data generated based on your use of the service.
9.6 Right to Object (Art. 21)
You may object to processing based on legitimate interests by contacting info@daiass.eu. We will assess the objection and respond within 30 days.
9.7 Right to Object to Automated Decision-Making (Art. 22)
Daiass uses AI to generate suggestions (email replies, next actions, health scores), but all decisions with significant effects require explicit human approval. No automated decision with legal or significant effect is made without human review. Users in Approval Mode or Hybrid Mode must actively approve all AI-drafted actions before they are executed.
9.8 Right to Withdraw Consent (Art. 7(3))
Where processing is based on consent (marketing communications), you may withdraw consent at any time by clicking unsubscribe in any marketing email or contacting info@daiass.eu. Withdrawal does not affect the lawfulness of processing before withdrawal.
How to Submit Requests
- Self-service: Settings → Security panel within the platform
- Email: info@daiass.eu
- Response timeframe: 30 days from receipt of verified request, extendable to 3 months for complex requests with notification
Identity Verification: Requests submitted from within an authenticated account are automatically verified. Requests submitted by email require verification by responding from the registered account email address.
10. SECURITY MEASURES
Technical Measures
- All data in transit encrypted with TLS 1.3
- Sensitive data at rest encrypted with AES-256-GCM (OAuth tokens, backup codes)
- OAuth tokens encrypted before database storage and decrypted only server-side
- Supabase Row Level Security enforces data isolation at database level — no application code can override this
- Multi-tenant architecture — each business's data is logically and technically isolated from all others
- Rate limiting on all authentication endpoints and AI API routes (Upstash Redis)
- IP-based abuse detection and blocking
- Two-factor authentication available via TOTP authenticator app
- Session management with device tracking and remote logout capability
- Role-based access control with granular permissions per action type
Organisational Measures
- All API keys and credentials stored exclusively as environment variables, never in source code
- No sensitive credentials appear in application logs
- Circuit breakers prevent cascading failures when external services are unavailable
- Comprehensive audit log of all security events, authentication events, and data access events
- Append-only audit log — entries cannot be modified or deleted after creation
- Automated dependency vulnerability scanning in CI/CD pipeline
- Production source maps disabled to prevent code exposure
11. DATA BREACH NOTIFICATION
Detection: Security events are monitored via Sentry error monitoring and audit logs. Unusual access patterns are flagged automatically.
Internal Response: Daiass will investigate and contain any confirmed breach within 24 hours of detection.
Notification to AKI: Within 72 hours of becoming aware of a breach that is likely to result in risk to the rights and freedoms of natural persons. Notification to: www.aki.ee
Notification to Affected Users: Without undue delay when the breach is likely to result in high risk. Communication via email to the registered account email address and in-app notification.
Information Provided in Breach Notification:
- Nature of the breach and categories of data affected
- Approximate number of individuals affected
- Name and contact details of the data protection contact
- Likely consequences of the breach
- Measures taken or proposed to address the breach
12. COOKIES
Cookies Used by Daiass
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
supabase-auth-token | Essential | Authentication session management | 30 days or session |
sb-refresh-token | Essential | OAuth token refresh | 30 days |
sidebar-collapsed | Functional | Remember sidebar state preference | Persistent (localStorage) |
theme-preference | Functional | Remember dark/light mode preference | Persistent (localStorage) |
cookie-consent | Functional | Record cookie consent decision | 365 days |
Daiass does not use: Advertising cookies, third-party tracking cookies, social media tracking pixels, or any cookies for cross-site tracking purposes.
Third-party cookies: Stripe may set cookies when the billing portal is accessed. These are governed by Stripe's own cookie policy.
Consent Mechanism: A cookie banner is displayed on first visit to public pages. Essential cookies do not require consent. Functional cookies require consent.
Withdrawing Consent: You may delete browser cookies or adjust browser cookie settings at any time.
13. CHILDREN'S DATA
Daiass is a business-to-business platform intended exclusively for use by business owners and their employees. The platform is not directed at, designed for, or intended to be used by individuals under the age of 18. Daiass does not knowingly collect personal data from anyone under 18. If Daiass becomes aware that personal data has been collected from a person under 18, that data will be deleted promptly. You confirm during registration that you are at least 18 years of age.
14. AI-SPECIFIC DISCLOSURES
AI Involvement in Service Delivery
Daiass uses artificial intelligence (specifically OpenAI's GPT-4o and GPT-4o-mini models) as a core part of its service. AI is used to: read and summarise emails, draft reply suggestions, conduct phone conversations on behalf of your business, transcribe calls, generate client relationship summaries, recommend next actions, produce weekly business insights, and operate the Daiass conversational agent.
Data Used for AI Processing
Email content, call transcripts, client data, business context, and AI memory entries are sent to OpenAI's API for processing. This is the core mechanism by which the service operates.
AI Model Training
Daiass uses OpenAI's API under terms that specify API input and output data is not used to train OpenAI's models by default. Daiass does not use customer data to train any proprietary AI models. Your data is used only to provide the service to you specifically.
Automated Decision-Making
Daiass AI generates suggestions, drafts, summaries, and recommendations. However, Daiass is designed with human oversight at its core:
- In Approval Mode: Every AI-drafted action (email reply, appointment booking, follow-up) requires explicit human approval before execution.
- In Hybrid Mode: Low-stakes automated actions (reminders, logging) execute automatically; high-stakes actions (sending emails, booking appointments) require approval.
- In Full Auto Mode: AI acts autonomously but all actions are logged and visible, and the mode can be changed at any time.
Client health scores and AI next-action recommendations are informational only and have no automated legal or significant effects. They are suggestions that you act upon at your own discretion.
Human Intervention
You can request human review of any AI-generated content or decision by contacting info@daiass.eu or by editing AI drafts before approving them. The platform is designed to always present AI output as a suggestion, not a final decision.
Right to Opt Out of AI Processing
Users who do not wish their emails or calls to be processed by AI may not be able to use the core features of the platform, as AI processing is fundamental to the service. Users who prefer not to have AI process their data should not subscribe to Daiass. You can disable specific AI features (email AI, call AI) individually from the Settings → Integrations panel.
15. CHANGES TO THIS PRIVACY POLICY
How Changes Are Communicated
- Material changes: Email notification to your registered account email at least 14 days before the change takes effect.
- All changes: In-app notification on next login.
- Minor clarifications: Updated policy with a change log at the bottom of this page.
Effective Date
Clearly stated at the top of this privacy policy document.
Material Changes
Where a material change affects the legal basis for processing or introduces new processing purposes, you will be asked to review and re-acknowledge the policy. Continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.
16. COMPLAINTS AND SUPERVISORY AUTHORITY
Right to Lodge a Complaint
Any user who believes their data has been processed unlawfully or that Daiass has failed to comply with the GDPR has the right to lodge a complaint with the competent supervisory authority.
Estonian Supervisory Authority
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
- Tatari 39, 10134 Tallinn, Estonia
- Website: www.aki.ee
- Phone: +372 627 4135
Users in Other EU Countries
You may lodge a complaint with your local Data Protection Authority. A list of all EU DPAs is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en
Preferred First Contact
Daiass encourages you to contact info@daiass.eu in the first instance, as many concerns can be resolved directly and quickly without requiring regulatory involvement.
17. B2B-SPECIFIC: PROCESSOR / CONTROLLER DISTINCTION
Daiass as Data Controller
Daiass acts as a data controller with respect to personal data of its registered users (business owners and their team members) — account data, usage data, billing data, and session data.
Daiass as Data Processor
When you connect your Gmail, Google Calendar, and phone number and the platform processes communications from your clients (emails, calls), Daiass acts as a data processor on your behalf, and you are the data controller of your clients' personal data.
Your Obligations as a Data Controller
As a Daiass user who processes your clients' personal data through the platform, you must:
- Have a lawful basis under GDPR for processing your clients' data.
- Inform your own clients that their communications may be processed by AI tools (including Daiass).
- Ensure your use of Daiass complies with all applicable data protection laws in your jurisdiction.
- Not use Daiass to process data in ways that would be unlawful under GDPR or other applicable law.
Data Processing Agreement (DPA)
A Data Processing Agreement between Daiass (as processor) and each subscribing business (as controller) is incorporated into the Terms of Service. The DPA covers: subject matter and duration of processing, nature and purpose of processing, types of personal data processed, categories of data subjects, and the obligations and rights of the data controller. A standalone DPA document is available upon request by emailing info@daiass.eu.
18. JURISDICTION AND GOVERNING LAW
Governing Law
This Privacy Policy and all data processing activities are governed by the laws of Estonia and the European Union, including the General Data Protection Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act (Isikuandmete kaitse seadus, IKS) of Estonia, and any other applicable implementing legislation.
Jurisdiction
Any disputes arising from this privacy policy that cannot be resolved through the complaint mechanism described above shall be subject to the exclusive jurisdiction of the courts of Paide, Estonia.
Dispute Resolution
Daiass commits to resolving privacy concerns directly and promptly. You are encouraged to contact info@daiass.eu before initiating formal proceedings.
19. CONTACT US
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Email: info@daiass.eu
Postal Address: Denergi OÜ Kooli Tee 6 Tarbja, Estonia
This Privacy Policy is effective as of 8 September 2026 and will be updated as necessary to reflect changes in our practices or legal requirements.