Who is responsible for your data?
Dailyfy is published by SASU Click&Digital, 2 rue de la Croix Beaugeard, 35400 Saint-Malo, France, registered with the Saint-Malo Trade and Companies Register under number 880 139 498. This policy covers the Dailyfy website, its forms and free tools, and processing for account management and commercial relationships.
For any questions about your data or to exercise your rights, write to rgpd@dailyfy.co or send a letter to Click&Digital at the address above, marked “Data protection”.
Processing is governed by Regulation (EU) 2016/679 (GDPR), the amended French Data Protection Act and, for trackers, Article 82 of that Act. Visiting a page or accepting the terms of sale does not constitute consent to marketing or optional cookies.
Dailyfy and your organisation: distinct roles
Click&Digital acts as the data controller for managing its prospects and customers, billing, website security, contact requests and free public tools.
When your organisation uses Dailyfy to manage its community’s content, messages, comments or profiles, it determines the purposes of that processing. Dailyfy then acts as a data processor, on its instructions, under the applicable data processing agreement. This policy does not replace that agreement or the information your organisation must provide to its community.
If your request concerns data processed for a brand or public organisation using Dailyfy, contact that organisation first. You can also write to us so that we can direct your request to the relevant controller.
Which data, for which purposes?
Depending on the features used, data come from you, members of your organisation, networks and integrations you authorise, or public sources for benchmarking. Mandatory fields are identified; without this information, we cannot process the request or provide the relevant feature. Optional fields help clarify your request.
| Use | Data concerned | Legal basis |
|---|---|---|
| Contact, demonstrations and support | Identity, email, company, optional contact details, subject, message and correspondence. Appointments use TidyCal when you book through its calendar. | Pre-contractual steps at your request or performance of the contract; legitimate interest in responding to other requests. |
| Support through the internal chatbot | Messages and contextual information needed to respond to your request, sent to OpenAI when the chat’s AI support is used. | Performance of the requested support service or legitimate interest in responding to other requests. |
| Account and subscription | Professional identity, account information, organisation, access and permissions, plan and relationship history. | Performance of the contract; legitimate interest in managing access for members authorised by the organisation. |
| Billing and payment | Billing details, tax data, amount, currency, transaction status and references. | Performance of the contract and accounting and tax obligations. |
| Free benchmarking | Email, requested profiles, public account data, posts and available metrics, anti-abuse verification information. | Performance of the requested service for data submission and delivery of results; legitimate interest in comparing public professional presences and preventing abuse, subject to individuals’ rights. |
| Security and consent management | Technical connection data, incident logs, consent choices and cookie module events. | Legitimate interest in protecting the service and managing preferences; obligation to be able to demonstrate consents collected where consent is required. |
| Audience measurement, campaigns and marketing communications | Consent choices, browsing events and contact details used for the relevant communications. | Consent for optional trackers and communications that require it. Relevant professional marketing, or marketing for similar services already purchased, may rely on legitimate interest under the applicable legal conditions, with a simple, free opt-out. |
For social features used by your organisation, data may include content and media, profile identifiers, authorisation tokens, comments, messages, work notes, approvals and statistics available through authorised APIs. Processing follows the organisation’s instructions and the permissions granted.
Do not send card numbers, social network passwords or unnecessary sensitive data in a form or support request.
Creating an account or signing in with Google
If you choose Google to create your Dailyfy account or sign in, Dailyfy receives your Google account identifier, email address, name and, where available, avatar. This information is used to identify, create or find your account and secure your sign-in, on the basis of performance of the requested service. Dailyfy does not receive your Google password.
This sign-in alone does not authorise access to your Google Drive files, YouTube channel or Google Business Profile listings. These integrations require separate authorisations, with the permissions needed for the features you enable. You can review and revoke access in your Google account settings; prepare another way to access Dailyfy before revoking the method you use to sign in. Also see the Google privacy policy.
Free tools, public profiles and benchmarking
The Instagram or Facebook comparison tool sends your email, the main profile and, if you add any, up to two competitors to the Dailyfy API. Cloudflare Turnstile verifies the request to protect quotas. Your email does not automatically subscribe you to a newsletter.
Analyses use available public profile data: public account identity, followers, posts, frequency, formats and engagement. The industry may be inferred from the category and information available on the profile. An industry reference and score are displayed only when the data allow it. Data being public does not remove the data subject’s rights.
The 28-day period shown in the report describes the period analysed, not a general retention period. The score is a comparative indicator; it is not used to make a decision producing legal effects or similarly significant effects on an individual. To request access, rectification or consideration of an objection concerning an analysed public profile, contact rgpd@dailyfy.co with the relevant profile URL.
Stripe and Paddle payments
For customers in France or Europe paying in euros, payment is processed by Stripe. For other countries or currencies, payment is processed by Paddle. The checkout process identifies the provider used.
The provider receives the information needed for payment and fraud prevention, including billing details, payment method information, the amount and technical transaction data. Dailyfy receives the references and information needed to manage the subscription and invoice, not the card security code.
Depending on the transaction, Stripe or Paddle may process data for their own obligations, including regulatory or anti-fraud obligations, and not solely on Dailyfy’s instructions. See their information: Stripe privacy and Paddle privacy.
Who can access the data?
Access is restricted to authorised Click&Digital personnel and providers necessary for the relevant purpose: hosting and storage, web security and delivery, messaging and support, appointment booking, payment and billing. Your organisation’s members access their workspace data according to the permissions assigned.
- OVHcloud: hosting Dailyfy servers and databases in France.
- Cloudflare: storing DailySpace media on R2 under European Union jurisdiction, delivering media, protecting the service and anti-abuse verification through Turnstile.
- Google: identification when creating an account or signing in with Google, and separately authorised integrations.
- Stripe and Paddle: payment according to country and currency; Pennylane: accounting, with the necessary billing data and supporting documents.
- TidyCal: demonstration bookings.
- Mailjet: sending transactional emails and newsletters, with recipients’ contact details and the information needed to send them. Using Mailjet does not automatically subscribe anyone to a newsletter. See the Mailjet privacy policy.
- Mistral: providing the relevant AI features, with processing located in Europe, without a commitment to processing exclusively in France.
- OpenAI: providing the relevant AI features, according to the data needed for the request; the applicable location depends on the configuration and contractual safeguards of the service used.
- Dailyfy internal chat: support managed in our own tool, with OpenAI for AI chatbot answers. An internal chat tool therefore does not rule out transmitting necessary information to an AI provider.
The social networks and creation or storage services you connect receive the data needed for the actions you request. Messaging and support providers are involved only in the correspondence and requests that concern them. A service’s applicable regions and safeguards cannot be inferred from its provider’s nationality.
Providers acting as processors must process data according to the applicable instructions and contractual safeguards. Social networks and some providers also act for their own purposes, as described in their policies. Data may be disclosed to competent authorities where a legal obligation or procedure requires it. For details about your data’s recipients and the associated safeguards, contact our GDPR address.
Hosting and international transfers
Dailyfy servers and databases are hosted by OVHcloud in France. DailySpace media are stored with Cloudflare R2, in buckets configured under European Union jurisdiction. Media storage is therefore not presented as exclusively French.
R2 jurisdiction concerns object storage. On its own, it does not guarantee the location of all Cloudflare processing, including security, technical logs and CDN delivery. Delivery arrangements must be distinguished from storage, including where a European configuration is used.
Social networks, payment, security, Google sign-in, accounting and AI services, or integrations may process some data outside the European Economic Area. Hosting servers and databases in France and R2 storage in the European Union do not automatically extend to those processing activities.
Where a transfer subject to the GDPR is necessary, it must be covered by an adequacy decision applicable to the recipient or appropriate safeguards, including the European Commission’s standard contractual clauses, supplemented where necessary by additional measures. Having a European provider does not, on its own, guarantee the absence of a transfer.
You can request information about the countries concerned and a copy or description of the safeguards applicable to your data from rgpd@dailyfy.co, subject to protecting confidential information and third parties’ rights.
How long are data retained?
The period depends on the purpose, the contractual relationship, your organisation’s instructions and legal obligations. Active data, legally required supporting documents and information necessary for a dispute serve different needs.
- Contact and support: while the request is being handled, then as necessary to document follow-up, the commercial relationship or a dispute, with access restricted to information that remains useful.
- Your organisation’s account and content: while the service is provided and according to the applicable agreement, deletion settings and controller’s instructions. Closing an account does not delete supporting documents that must be retained by law.
- Invoices and accounting records: ten years from the end of the relevant financial year, in accordance with French accounting obligations.
- Public benchmarking: for the time necessary to collect data, produce and consult the result, and prevent abusive requests. The report access ticket is technically valid for 24 hours; expiry does not promise immediate deletion of every element of the request.
- Security logs and evidence of consent: according to the need to diagnose an incident, demonstrate a choice or handle a dispute, within the applicable limitation periods. Archiving needs do not justify reuse for advertising.
- Functional cookies on this website: 183 days for the consent choice, 180 days for the cookie module theme, and one hour for the benchmark tool session.
The criteria are the need to pursue the purpose, any retention obligation and applicable limitation periods. Additional retention concerns only data necessary for the identified reason. You can ask our GDPR contact about the period applicable to your situation.
Cookies and preferences
The consent module allows you to accept, refuse or separately choose audience measurement and marketing. Optional trackers requiring consent must not be activated before that choice. Refusal does not block access to pages; some third-party services may nevertheless require an interaction or a specific choice.
You can reopen settings at any time using the website’s “Manage my cookies” button, including after refusing. Withdrawing consent does not affect processing lawfully carried out beforehand. Cookies necessary for security, sessions and remembering preferences are not subject to the same rules as advertising trackers.
| Name | Purpose | Technical lifetime |
|---|---|---|
| dailyfy_cookie_consent | Records acceptance, refusal or choices by category. | 183 days |
| dfy_cmp_variant | Remembers the module’s light or dark theme; its value is not an individual identifier. | 180 days |
| benchmark-visitor | Signed session for security and limiting benchmark requests. | One hour, on the benchmark API path |
Interactions with the consent module are logged with the action type, theme, device type, page and a hashed session identifier. The logging endpoint does not store raw IP addresses in the database; this does not rule out technical logs from hosting or security services. Hashed data are not necessarily anonymous.
Loading a calendar, media or third-party tool may transmit technical data to the relevant provider. Its tracker and privacy information supplements this page. For more about French rules, see the CNIL’s explanations about cookies.
Social networks, integrations and AI
Connecting a network relies on the authorisations offered by that network. Accessible data and available actions depend on those permissions. Revoking an authorisation stops the corresponding future access, but does not automatically delete content already published on the platform.
For information received through Google APIs, use and transfer comply with the Google API Services User Data Policy, including the Limited Use requirements. You can review access granted to Dailyfy in your Google account’s security settings.
If you use an AI feature, content necessary for your request may be processed by Mistral or OpenAI, depending on the engine selected for your workspace: for example, text to rewrite, contextual information for a reply or metrics to summarise. For Mistral, Dailyfy’s selected processing location is Europe, not exclusively France. This location does not automatically extend to OpenAI processing, particularly the support chatbot. Choosing a sovereign mode and eligibility for it are separate from website hosting. A provider’s name does not, on its own, guarantee processing in France or the European Union. Avoid sending sensitive data or third-party data unnecessary for the task. Ask our GDPR contact for details about the engine, its processing region, recipients and safeguards applicable to your workspace.
The support chat is developed internally and uses OpenAI for its AI chatbot. Messages and contextual information necessary for the response may be sent to OpenAI. Do not share passwords, payment information or unnecessary sensitive data in the chat. This support chatbot is separate from the choice of AI engine for your DailySpace: enabling a sovereign mode in a workspace does not mean the chat uses the same engine.
Security and confidentiality
Cloudflare helps protect web access, filter malicious requests and prevent abuse, including through Turnstile for the relevant tools. These checks may process technical request information, such as IP addresses and browser characteristics; they are separate from media storage on R2.
Measures include authorisation management, securing communications, protecting access, anti-abuse controls and incident monitoring. No system can guarantee absolute security. Protect your credentials and report any suspicious activity.
Where a data breach requires it, Click&Digital makes regulatory notifications and informs the individuals concerned as required by the GDPR. For data processed for your organisation, Dailyfy assists it under its obligations as a processor.
Your rights and how to exercise them
Subject to the applicable conditions, you can request access, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interest and withdraw consent. You can also set instructions for your data after your death under French law. You may object to direct marketing at any time.
Write to rgpd@dailyfy.co, specifying your request and information that allows the data to be located. An identity document is not systematically required: additional information may be necessary where there is reasonable doubt about identity.
A response is normally provided within one month. This period may be extended by two months for a complex request or numerous requests; the reason and extension are then communicated within the first month. A legal obligation or third parties’ rights may limit some requests.
You can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or the competent supervisory authority in the European Union. Contacting us first may help resolve the request, but is not a condition for lodging a complaint.
Updates and related documents
This policy may evolve with features, providers and applicable rules. The update date identifies the version displayed. A new purpose requiring consent will not be covered by simply publishing a new version.
Also see the legal notice, terms of sale and terms of use. For your communities’ data, your organisation’s data processing agreement remains the contractual reference document.