Privacy policy

Who we are and how to contact us

Daylane is operated by Mr Rabi Yonan Roil trading as BLU MINT DIGITAL (ABN 16 321 710 248). In this policy, we, us and our refer to that operator. We provide a job calendar for Australian sole traders and small businesses.

For privacy questions, access or correction requests, deletion assistance or complaints, contact hello@blumint.com.au. You can also use our contact form. Ask for the person responsible for Daylane privacy.

A Business using Daylane chooses which customer, worker and job information to enter and who on its team may use it. It is responsible for explaining its own collection and use to those people. We process workspace information to provide Daylane and handle account, support and security information for our own service operations. Both the Business and Daylane have responsibilities for their own handling of personal information.

Information we collect and where it comes from

• Account and Business details: email address, authentication information, Business name, timezone and contact settings supplied at signup and in settings.
• Team information: names, invited email addresses, roles, availability, quiet hours, on-call settings and Visit assignments supplied by the Business or the team member.
• Work records: customer names and contact details, service addresses and access notes, Jobs, Visits, checklists, notes, photos and scheduling history entered by authorised users or imported from CSV.
• Customer requests: contact and work details, time preferences and optional messages submitted through a Business’s booking or Visit link. The Business may already have supplied the customer’s details before the customer uses the link.
• Communications and support: recipient addresses, message type, sending and delivery events, and information you provide when contacting us. Email providers process message content to deliver it.
• Technical and security information: request times, IP addresses and browser/device information processed by hosting services, sign-in and access events, imports, exports, deletion requests and limited diagnostic records.

We do not request identity documents, payment-card details, health information or continuous worker location. Avoid putting these or other unnecessary sensitive details in notes, photos or requests. If information is supplied to us that we should not hold, we assess it and remove or de-identify it where appropriate and lawful.

You can browse public information without an account or identifying yourself to us, although normal technical requests still reach our hosting providers. You may contact us anonymously or under a pseudonym where practical. We need a working email and required account fields to create an account, and may need to verify identity before releasing or changing private records. Without required scheduling details, a Business may be unable to arrange or respond to a Visit request; contact that Business to discuss another way.

Why we use information

We use information to create and authenticate accounts; provide the Business workspace and schedule; assign and record work; send factual account and scheduling emails; deliver customer requests to the Business; answer support enquiries; investigate faults; prevent misuse; provide export and deletion; and comply with lawful obligations or resolve disputes.

We do not sell personal information or customer lists. We do not use your scheduling content for advertising, unrelated profiling or training our own AI models. Daylane does not currently provide AI processing of your Jobs or photos. Service providers may use their own tools to support and secure their services under their agreements; their current subprocessors are linked in our provider register.

Cookies and information on your device

Daylane uses essential authentication cookies and browser storage to keep you signed in and operate the app. It does not currently install advertising pixels or third-party marketing analytics. Your browser lets you clear or block cookies, but blocking authentication cookies prevents sign-in.

Where the app enables an offline assigned agenda, a limited read-only copy is saved in that browser on that device. It may be stale and is not a full offline workspace. Signing out clears the local agenda copy; you can also clear Daylane’s site data in your browser. Protect shared devices and sign out when finished. CSV downloads, screenshots, copied information and copies retained by an external calendar or email recipient are outside the app’s deletion controls.

Who can receive information

Authorised users in the relevant Business receive information according to their role and assignments. A person holding a live public link can access its limited Visit, booking, invitation or calendar function. Owners should share and revoke links carefully.

We use Vercel for hosting, Supabase for the database, accounts and private files, Resend for account, support and scheduling email, and Google Workspace for our support inbox. Their functions, information categories and locations are described in the provider register. Authorised operational support may access information where necessary to investigate a request or incident. We limit what we share to the purpose and use contractual and technical safeguards.

We may disclose relevant information where required or authorised by law, to protect people or investigate unlawful activity where legally permitted, or to professional advisers under confidentiality for a specific dispute or obligation. If the service changes ownership, any proposed transfer must preserve applicable privacy protections; we will notify affected users and seek consent where required. This is not permission for unrelated marketing.

Australia and overseas processing

The primary Daylane database and private file storage are in Sydney, Australia, and our hosting server region is Sydney. Some processing and support access occurs overseas: the United States through our hosting and email providers, Singapore through Supabase, and Japan through Resend’s Tokyo sending region. Provider infrastructure and support subcontractors can operate in additional countries, including those listed in the linked provider disclosures. Australian storage does not mean all processing stays in Australia.

We review active providers’ processing terms and access arrangements, limit the data they need, and take reasonable steps to protect information handled overseas. This disclosure does not ask you to waive any protection that Australian law provides.

If you choose Open in Maps, Google receives the selected location query. If you copy Job details into Free Invoice App, that service receives what you choose to paste. Where account connections are enabled, linking an account and confirming an invoice draft also transfers the reviewed Customer and work details to Free Invoice App. Daylane stores the invoice reference and reads its details and status so you can review and send it. If you subscribe to a calendar feed, your chosen calendar service receives the feed’s Visit information. Those services have their own privacy policies and storage locations. Google Calendar sync is coming soon and is currently available only to invited pilot members. Outlook (Microsoft Calendar) sync is available with Pro+. SMS, where a Business has a paid Pro+ subscription, is sent through Twilio; see the providers page for details.

If you connect Google Calendar or Microsoft Calendar, Daylane identifies your connected account and default calendar, and reads event times to check availability. Google calendar-list access identifies an owned calendar. It creates, updates and removes calendar events for assigned Visits, including a short title, time, Daylane link and optional location. Private notes, photos and checklist answers are not exported. Daylane stores the calendar account label, encrypted access credentials, event identifiers, busy intervals and sync records in Supabase; requests run through Vercel. Other events' titles and descriptions are not stored. External changes to Visit times require review in Daylane. You can disconnect in Settings → Calendars to remove stored access credentials and stop future sync. Events already copied to your calendar may remain there. You can also revoke access in your Google or Microsoft account.

Google Calendar data is used to provide the calendar features you choose, not for advertising, sale or training general-purpose AI models. Daylane's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google processes calendar data under its own terms and privacy policy, which may involve countries outside Australia. See the provider register for details.

How long we keep information

We keep information while reasonably needed for the stated purpose, subject to the controls below. The periods are Daylane’s operating rules, not a statement that every business must legally keep a schedule for that time.

• Active customer, location, open-job and team records remain while needed for the workspace. Businesses should review stale information and remove what they no longer need.
• Completed and cancelled Job records default to three years after the last Job activity. Owners can choose three to seven years in Business settings. Related Visit records, notes and checklists follow that Job retention rule.
• Visit photos default to deletion 12 months after the Job closes. Location access notes are cleared after that period when there is no open work at that Location.
• CSV preview rows expire after 24 hours. Hashed request-rate-limit records are kept for two days. Expired or revoked public-link and invitation records and provider webhook deduplication records are pruned after 90 days.
• Daylane’s transactional-email delivery metadata is kept for 12 months after the final event. Resend’s message-content retention is separate and currently 30 days on our plan.
• Identifiable export/deletion audit events and completed or failed deletion-request records are kept for 24 months, with workspace content excluded from those minimal records.
• Support correspondence is reviewed and removed when no longer needed to resolve and follow up the enquiry. A specific legal, security or dispute obligation can require limited information to be kept longer; we restrict it to that purpose and review the need.

Expiry makes records eligible for scheduled cleanup; processing time and recovery from a failed cleanup may delay physical removal. Contact us if you need help with an individual record or believe something has been retained unnecessarily.

Workspace deletion and backups

The Owner can export four core record types in Business settings → Data and request deletion in Business settings → Account. Public links are revoked immediately. A 72-hour recovery window allows cancellation before permanent cleanup becomes due. Cancelling does not restore old public links. Scheduled cleanup then removes the live Business records and private photo files. The four CSV exports do not contain every attachment or history entry; save material you need before deletion.

Deleting a Business is different from deleting a person’s sign-in identity, which may be associated with other workspaces. Contact us for help removing a remaining account identity. We verify the request and check whether other Business records need to remain.

Encrypted operator recovery backups are kept separately from the live service. We review them weekly and remove copies more than 30 days old, so normal expiry is within 37 days of backup creation. A justified legal or incident hold may require a limited copy to remain longer. Recovery copies are not used for normal access; if a backup is restored, deletions must be reapplied before the restored service is used. Provider-held operational records have separate retention under their agreements; contact us for assistance with a deletion request reaching a provider.

A Business may need its own records for tax, employment, safety or disputes. Copies it exports, or that customers and third-party services retain, remain subject to those holders’ responsibilities.

Security and incidents

We use encrypted network connections, role-based access, Business-scoped database rules, private photo storage, expiring and revocable links, rate limits and limited audit records. No online service or device can be guaranteed secure. Tell us promptly if you suspect a privacy or security problem, without sending passwords or unnecessary sensitive information.

We contain and assess suspected incidents, work with the affected Business and providers, and notify affected people and regulators when required by law. We keep the information needed to investigate and prevent a recurrence.

Access, correction and complaints

You can correct many account and workspace details in the app. If your information was entered by a service Business, contacting that Business is often the quickest way to correct the work record. You can also contact us directly; we will explain what we hold or process, verify your authority proportionately and help route a request where necessary.

We do not charge you to make a request. We aim to acknowledge requests and complaints within seven days and give a substantive response within 30 days. If more time is reasonably needed, we will explain why and provide an update. If we cannot give access or make a requested correction, we will explain the reason and available complaint options, subject to lawful restrictions. We do not disclose another person’s information to verify a request.

If you are dissatisfied, reply asking for a review by the person responsible for privacy. You may also contact the Office of the Australian Information Commissioner on 1300 363 992. The OAIC generally asks you to complain to the organisation first and allow 30 days for a response, and can explain whether your complaint is within its jurisdiction. This does not restrict any other rights or remedies you have.

Changes to this policy

We publish the current version and date here. We will notify affected Owners of material changes by email or a prominent account notice before they take effect where practicable, and obtain consent where legally required. A new policy does not itself authorise an unrelated use of information already collected.