Privacy notice

Daisy is run by [legal entity name], registration number [registration number], [registered address]. Write to us at hello@daisy.clfo.io about anything in this notice.

For this website, the demo form and business accounts, we decide how personal data is used: we are the controller. In the chat on a business's website, that business is the controller and we process the data on its behalf.

The website sets no cookies and shows no advertising. Our hosting provider, Vercel, handles each request to serve the page.

With your consent, and only then, we measure how the website is used with PostHog: the pages you open, the site and the campaign tags of the link that brought you, the buttons you press, the parts of the page you reach, whether the demo form was sent (never what you typed in it), and a replay of the screen in which every word and everything typed is hidden. The chat in the corner is never recorded. A random identifier in your browser's local storage links your visits to each other; it does not tell us who you are. Until you choose, none of this loads. If you refuse, it never does.

We keep your choice in your browser for twelve months, then ask again. You can change it at any time under Cookie settings at the foot of every page; withdrawing stops the measurement at once and deletes the identifier. The legal basis is your consent (GDPR article 6(1)(a)).

If you sign in, the app sets cookies that keep you signed in and remember your language and your last workspace. They are needed for signing in and are used for nothing else.

The chat in the corner of this website is Daisy herself. It works as described under "The chat on our customers' websites", except that here we are the controller: we decide how its conversations and contact details are used, and we use them to answer you and follow up on what you ask.

When you book a demo, we keep your first and last name, your email, your phone number, your website, the language of the page, the version of this notice the form linked to, whether you asked for product news, and when you sent it. We use them to arrange the demo, to set Daisy up for you and to reply to you.

If you tick the box for product news, we may email you about Daisy at most once a month. You can withdraw that consent at any time by writing to hello@daisy.clfo.io.

We email your request to the people on our team who set businesses up. That email stays in their mailboxes until they delete it.

To stop abuse, we count requests from each network address for an hour. We store a scrambled form of the address (a keyed hash), never the address itself, and delete it after about a week.

The legal basis is taking the steps you asked for before a possible contract (GDPR article 6(1)(b)) and, for product news, your consent (article 6(1)(a)).

Daisy answers visitors on the websites of businesses that use it. Before a chat starts, the visitor is told it is an AI and asked to agree. If they do not agree, nothing is saved.

Once they agree, we store for that business:

• when they agreed and the version of the text they agreed to;
• the messages in the conversation and the page it started on;
• the city, country and kind of device, worked out from the request, and never the IP address;
• the name, email or phone number, if the visitor fills in the contact form, and a short summary of what they asked;
• whether a reply helped, if the visitor rates it, and when the chat was opened or a phone number was shown or called.

The visitor's browser keeps a random identifier and the state of the chat, so a returning visitor can pick up where they left off.

The business decides how it uses this data and answers for it. To exercise your rights, ask the business; we help it do so.

For people who sign in to Daisy we keep their name, email, a protected form of their password, the workspaces they belong to and their email preferences. We send them the emails they chose (new leads, requests to talk to a person, a weekly summary) and invitations, and we keep a log of each email sent for 90 days.

When you use the dashboard or the admin console, we record how you use Daisy: the pages you open, what you click, the errors you run into, and a replay of the screen in which every word is masked. Names, phone numbers, emails and the text of conversations stay in your browser. We link these records to your account by an internal id, with your role and your language, never your name or email, and we store nothing on your device for them. PostHog keeps them for us in the EU. We use them to see how businesses set Daisy up, what they use and what breaks. Nothing about the visitors to our customers' websites or their leads goes to PostHog.

The legal basis for these records is our legitimate interest in running and improving the service (GDPR article 6(1)(f)). You can object to it by writing to hello@daisy.clfo.io.

• Supabase: the database, sign-in and file storage, in Ireland (EU).
• Vercel: hosting. The app runs in Dublin (EU).
• OpenAI: writes each chat answer from the conversation text, reads the business's content to find answers, writes the short summary of each lead from the conversation (never its contact details), and writes the insights a business sees about its knowledge and its visitors' questions. OpenAI may process this data outside the EU. It does not store the text after answering, but may keep it for up to 30 days in logs it uses to detect abuse, and for up to 24 hours in an encrypted cache that makes repeated requests faster.
• Langfuse: records how each answer, summary and insight was produced, including the conversation text but not the contact form, so we can check quality. In the EU.
• Resend: delivers our emails. It may process the address and the content of an email outside the EU.
• PostHog: records how signed-in people use the dashboard and the admin console, and, only with their consent, how visitors use this website, including screen replays with every word masked and reports of errors. Never anything about the visitors to our customers' websites or their leads. PostHog works out an approximate location, the country and city, from the IP address, and does not store the IP address itself. In the EU.

• Demo requests: 180 days, then deleted automatically. The email each one sends our team stays in their mailboxes until someone deletes it by hand, and Resend keeps its log of sent emails for as long as its own retention allows.
• Records that limit requests: about a week.
• The log of emails sent: 90 days.
• Chat conversations and their ratings: 12 months after the last message, then deleted automatically. They are also deleted when the business's account is deleted, or earlier if the business deletes them.
• The name and contact details a visitor leaves in the chat, with the short summary of what they asked: 24 months after the last activity on the lead (a status change, a call, a note or a follow-up date), then deleted automatically. They are also deleted when the business's account is deleted, or earlier if the business deletes them.
• Records of what happens in the chat on a business's website, such as when it opens or a visitor taps the phone number, with a random visitor identifier and the page: 13 months.
• Diagnostic traces in Langfuse: they hold up to 4,000 characters of each message in a conversation, without the contact form. Traces recorded since September 5, 2026 are deleted after 90 days, and when the business's account is deleted. Older traces have no automatic expiry yet, and deleting an account does not delete them. Deleting a conversation also deletes the traces of its answers.
• Records of how the dashboard, the admin console and, with consent, this website are used, in PostHog: for as long as PostHog keeps them under our plan. We have not set a shorter limit yet.
• Logs of errors on our servers and of background jobs, in PostHog, with emails, phone numbers and quoted text such as visitors' words removed: 14 days.
• Your choice about measuring this website: twelve months, in your browser.
• Business accounts: until the account is deleted.

You can ask to see the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to hello@daisy.clfo.io. For a chat on a business's website, write to that business first.

You can also complain to a data protection authority. In Romania that is the ANSPDCP (dataprotection.ro).

When this notice changes, we publish the new version here with a new date. The demo form records which version you saw.