Privacy policy
Last updated:
In short
- The site sets no cookies and stores nothing on the visitor’s device. There are no ads, and nothing is sold or shared.
- We count visits in a way that cannot identify anyone.
- We keep the email address of anyone who joins the waiting list, and use it for one thing: to say when a Dayling can be ordered. Then we delete the list.
Who we are
Daylings are made by Mesquita Gouveia, Lda., a Portuguese company with its registered address at Travessa do Salvador, 213, 4495-592 Terroso, Portugal and company tax number (NIPC) 516486870. We are the controller of the personal data described here. Write to us at hello@daylings.app.
What this policy covers
This policy covers the website www.daylings.app and its waiting list, and nothing else. The Daylings themselves and the parent app will have their own terms and privacy information when ordering opens. They will be shown before anyone uses either.
The site and the waiting list are for adults. Anyone under 18 should ask a parent to join the list for them.
Visiting the site
When someone opens a page, their browser asks our hosting and content delivery provider for it. To do that, the provider necessarily receives the visitor’s IP address and basic details of the request (the page, the browser type, the time). It uses them to deliver the page and to keep the service secure. We do not use them to build a profile of anyone.
We set no cookies and use no local storage. The site loads one small script of our own, the visit counter described below, and nothing from advertisers or anyone else.
Visit counts
We count visits with an analytics tool that sets no cookies. It works like this:
- It does not set cookies or store anything on the visitor’s device, so there is no consent banner.
- From the IP address and browser details it makes a scrambled code (a hash), mixed with a secret value that changes every day. The code only lets the tool tell that two page views on the same day came from the same visitor. The IP address is then discarded, and the code cannot be turned back into it.
- What we keep are totals: which pages were viewed, where visitors came from (the referring site), the country, and the type of device. None of it points to any one person.
We do this to learn which pages help families and which do not, and to keep the site fast and clear. Our legal basis is legitimate interest (Article 6(1)(f) of the GDPR). We think the effect on visitors is very small, because nothing is stored on their device and nothing identifies them. Anyone can object at any time (see “Rights”), or stop the count themselves.
How to stop the count. Either of these works, and the site works the same without the script:
- Turn off JavaScript for www.daylings.app in the browser’s site settings. The site does not need it.
- With a content blocker such as uBlock Origin, add a rule that blocks stats.daylings.app.
The waiting list
Daylings are not on sale yet. Anyone who wants to hear when they are can join the waiting list.
What we collect. The email address, the language of the page used (English or Portuguese), and which version of the form’s wording was agreed to. We also record when the entry was created, when we sent the confirmation email, and when it was confirmed. We do not store the IP address or browser details with the entry.
How it works.
- The person enters their address in the form. We send one email asking them to confirm. Sometimes that email follows a little later rather than straight away.
- They follow the link in that email. Only then are they on the list.
- If the entry is not confirmed within 7 days of that email, we delete the entry. If we have not been able to send it within 90 days, we delete the entry anyway.
- When ordering opens, we send one email to say Daylings are ready. Straight after, we delete the whole list.
Every email we send has a link to leave the list at once. Mail programs that offer an unsubscribe button can use it too.
What we use it for. Only this: the confirmation email and the one “Daylings are ready” email. There is no newsletter, and we will not use the address for anything else.
Legal basis. Consent (Article 6(1)(a) of the GDPR). It can be withdrawn at any time by using the link in any of our emails, or by writing to us. Withdrawing does not affect what we did before. Nobody has to join, and nothing changes for those who do not.
If someone enters an address that is not theirs, the owner of that address can ignore the confirmation email. The entry is deleted 7 days after that email.
Server logs
When the waiting list form is submitted, the service that receives it may keep the IP address in its technical logs for a short time. We use these logs only to keep the service secure and to find and fix faults. We keep them no longer than needed for those purposes. Requests are also limited per visitor to stop abuse, and that count is held in memory only and not written down.
Who handles data for us
We use two kinds of provider, who act on our instructions:
- A hosting and content delivery provider, which serves the website pages.
- An email delivery provider, which delivers the waiting list emails.
We do not sell personal data. We do not share it with anyone else, unless the law or an authority legitimately requires it.
Data outside the European Economic Area
Some of these providers may handle data outside the European Economic Area, for example in the United States. When they do, we make sure the transfer has a safeguard that the GDPR accepts: either the provider is covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework), or we have standard contractual clauses in place with it. To get a copy of the safeguards, write to hello@daylings.app.
How long we keep data
| What | How long |
|---|---|
| Waiting list entry, not confirmed | 7 days after the confirmation email, and never more than 90 days |
| Waiting list entry, confirmed | Until the person leaves, or until we send the “Daylings are ready” email, after which the whole list is deleted |
| Visit counts | Totals only, with nothing that identifies anyone. Kept as long as they are useful |
| Technical logs | Briefly, for security and fixing faults |
Rights
Under the GDPR, anyone whose data we hold can ask us to:
- tell them what we hold about them and give them a copy (Article 15);
- correct it (Article 16);
- delete it (Article 17);
- limit how we use it (Article 18);
- give them their data in a portable form (Article 20);
- stop using it, when we rely on legitimate interest (Article 21);
- stop using it, when we rely on consent (Article 7(3)).
Write to hello@daylings.app. We answer within one month. We may need to check that the request comes from the owner of the email address. Because the visit counts hold nothing that identifies anyone, we usually cannot look a person up in them.
Complaints
Anyone who thinks we have handled their data badly is asked to tell us first, so we can put it right. They also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt. Someone living in another EU country can complain to the authority there.
Changes to this policy
If we change what the site or the waiting list does with personal data, we update this policy and the date at the top, in both languages. If the change matters for the waiting list, we tell the people on it.