Privacy

Who we are

Daylight is a service for health and wellness practitioners and their practices, at dylt.ai. In this policy "we" and "us" mean Daylight.

Daylight is operated by a company incorporated in Delaware, USA, which decides how the information described here is used.

If you want to reach a person about anything here, write to hello@dylt.ai.

What we never collect

We do not collect, process or store any information about your clients or patients. Everything we read is your practice's public business presence. We are not a HIPAA business associate, we do not sign business associate agreements, and you must not send us protected health information, or any client's health information under any law, through this service, the editor, the support form or any other route.

The websites we build send nothing to us. Their contact buttons open the visitor's own email, or the contact form your practice already uses, so what a visitor writes goes straight to you.

If you believe you have sent us client information by mistake, tell us and we will delete it and confirm when it is gone.

What you give us

Only what the service needs to work:

• Your email address, so you can sign in and we can send you a verification code, and so we can follow up: at most two emails about your report, and one reminder if you leave the payment page, each with a one-click unsubscribe.
• Your name, your practice name and how you are connected to it, if you choose to tell us.
• What you tell us about your practice — fees, insurers or rebates, booking and contact links, team members and their biographies — and anything you type into the editor. This becomes the words on the website we build for you.
• Photographs you upload, which are published on that website.
• Messages you send us through the support form, which arrive in our email inbox.
• If you cancel, the reason you choose and anything you write about it.
• Whether you are a subscriber, when that started, what currency you pay in and when it next renews.
• If you subscribe, your card details go straight to Stripe. We never see or store your card number.

What we read from public sources

To tell you what somebody looking for a practice finds today, we read what is already public: the practice's website (and, if it can't be reached, copies kept by the Internet Archive), its Google Business Profile listing, including its public reviews and the names reviewers chose to show, its profiles on directories such as Psychology Today, Google's search results and what AI assistants say about it. We read these the way any visitor would; we do not read anything behind a login.

To build your site we reuse the words and photographs your practice has already published there, linking to them where they are or, for archived pages, keeping a copy. We keep a record of what we found, so we can show you what changed when we look again.

If someone else checks your practice

Anyone can run a free check on any practice's public presence, so a report about your practice may exist even if you have never used the service. It contains only what is already public about the practice, it is kept out of search engines, and it can be seen by somebody who has its link. To have it deleted, write to hello@dylt.ai.

Access to your Google listing

If you add us as a Manager of your Google Business Profile, we use that access only to make the changes you approved in your dashboard. A Manager cannot delete your listing or remove you, and you can remove us at any time in Google's own settings.

Where we offer it, you can instead connect your Google account. That is optional and you are asked each time; Google then tells us which listings your account manages, and we only act on the one you point us at. Disconnecting from your dashboard destroys the token we hold and withdraws the permission at Google.

What we record automatically

The IP address of each request that starts a check or a build, so we can stop the service being abused. We keep it for thirty days.

The cookies described below, and the ordinary records a web server keeps of the requests it answers.

What you do on our own site and in your dashboard — the pages you open, and steps such as running a check, confirming your email, signing up, editing your site or connecting a domain — so we can see where people get stuck and fix it. Our server records these and sends them to PostHog, our product analytics service; no analytics script runs in your browser. With them we record the kind of device and browser you use, and the country you are in, which PostHog works out from your IP address and then discards without storing it. Once you have given us your email address, they are recorded against it.

How we use it

To run the service you asked for; to send you the emails described here; to keep the service secure and stop it being misused; to measure which of our own ads work; to improve the product; and to meet our legal obligations. Where the law asks for a legal basis, these are performing our agreement with you, our legitimate interest in running and improving the service, and your consent where we ask for it.

Scores and recommendations are produced automatically. They are about a practice's public presence, not about a person, and they have no legal effect on anyone.

Who else sees it

We use a small number of companies to run the service. They act on our instructions and may only use what we send them to do the job we send it for:

• OpenAI — reads public pages, screenshots and photographs to understand a practice, writes the words for your site, makes some of its images, and checks what an AI assistant says about your practice.
• Google — the listing, the page speed check and the typefaces sites use; email sent to our inbox is delivered through Google.
• DataForSEO — Google search results and how often people search for what you do, in your area.
• Stripe — takes your payments and manages your subscription.
• Resend — sends your verification code and any email we send you.
• Name.com — registers a domain if you buy one through us.
• Fly.io — runs the service and stores its data.
• Cloudflare — runs our domain and delivers email sent to us.
• Calendly — if you book a call with us, it takes the booking.
• Google Ads — tells us which of our own ads led someone to check their practice or subscribe.
• PostHog — product analytics: which pages and steps of our own service people use, and where they stop.

When a page on a site we built changes, we tell search engines its address through IndexNow, so they look again. That is the address of a public page, and nothing else.

We do not sell your information, and we do not share it for anybody else's advertising. We may disclose it if the law requires us to, to protect our rights or users, or to a company that takes over the service, which would be bound by this policy.

Where it is kept

Our data is stored in the United Kingdom, and the companies above process it in the United States and elsewhere. Wherever you are, it may be processed outside your country, and where the law requires safeguards for that transfer, we rely on the ones those companies provide, such as standard contractual clauses.

How long we keep it

Your account, the site we built for you and your editing history are kept while your account is open. Ask us to delete your account and we will delete it, and the site with it, within thirty days, apart from what we must keep by law, such as payment records.

A check of a practice that never signed up is kept so that coming back does not mean starting again. We delete it when the practice, or the person who ran it, asks us to.

IP addresses are kept for thirty days. Backups are overwritten in the normal course.

Cookies

Our own:

• One keeps you signed in, for up to 90 days.
• One remembers that you confirmed your email for a report, so you are not asked again; it holds that email address, signed so it can't be altered, for up to 30 days.
• If you arrive from one of our ads, one keeps a note of that ad click for up to 90 days.
• One remembers how you first found us — the site that sent you, the page you landed on and any campaign tags in the link — for up to 90 days, so we know which of our efforts work.
• One holds a random visitor number, for up to a year, so the steps you take before giving us your email can be joined to your account afterwards. It carries nothing about you.
• One numbers your visit, so the pages you open in one sitting are seen together. It ends after half an hour without a page.

Your browser also keeps a small note so that the same visit is not counted twice for our ads.

We advertise on Google. So that we know which ads are worth paying for, this site uses Google's advertising tag, which sets Google's own cookies. It tells Google when someone who clicked an ad checks their practice, views their report or preview, or subscribes, and when you subscribe it may include your email address in a scrambled (hashed) form so the subscription can be matched to the ad. It measures our advertising only.

In the European Economic Area, the UK and Switzerland, Google's tag stores no advertising cookies. There, and wherever we cannot tell where you are, we keep no note of the ad click, of how you found us or of a visitor or visit number, and we send Google no email address.

The websites we build

Your site carries no tag, tracker or script of ours, and nothing a visitor does on it is reported to us. Like most websites, a visitor's browser fetches the site's typefaces from Google Fonts, and may fetch photographs from where your practice first published them, so those companies see the visitor's IP address as they would for any site.

Security

Everything travels over encrypted connections, card details never reach us, and access to our systems is limited to the people who run the service. No system is perfectly secure; if something happens that puts your information at risk, we will tell you as the law requires.

Children

The service is for adults acting for a practice. We do not knowingly collect information from anyone under 18.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to hello@dylt.ai and we will answer within thirty days. Every follow-up email we send has a link to stop them.

Depending on where you live you may have further rights, and the right to complain to a regulator: in Australia, the Office of the Australian Information Commissioner; in Canada, the Office of the Privacy Commissioner; in the UK, the Information Commissioner's Office; in the European Economic Area, your national data protection authority. Some US states give residents similar rights, and we honour them on the same terms.

Changes

If we change this policy we will change the date at the top. If the change matters to you, we will email you about it rather than hope you notice.