Privacy policy

Dailyz writes, designs and publishes Instagram carousels for businesses. To do that it has to hold some information about you, your workspace, and the Instagram account you connect. This page says exactly what, why, for how long, and how to get it removed. It is written to be read, not skimmed.

What we store, and why

• Your account. Email address, display name, and a salted hash of your password. Used to sign you in. We never see your password itself.
• Your workspace. Its name, members and their roles, brand settings (name, handle, website, voice, banned words), posting schedule, and the keyword and message for the comment funnel. This is the configuration that makes your posts yours.
• Your posts. The copy, the rendered slide images, the stock photos chosen and their attribution, your approval or rejection, revision chat, and, once published, the Instagram media id and link.
• Your Instagram connection. When you click Connect Instagram, Instagram gives Dailyz your professional account's user id, username, account type, and an access token. We store these so we can publish on your behalf, read comments on posts we published, and send the private reply you configured. We store nothing else from your Instagram account: no followers, no messages other than the replies we send, no content we did not create.
• Comments we act on. For posts Dailyz published, we read comments and keep the ids of comments we have already replied to, so nobody is messaged twice. We do not keep comment text.
• Billing. If you subscribe, Stripe handles payment. We store your Stripe customer and subscription ids and the plan status. Card details never touch our servers.
• Waitlist registrations. If you registered on getdailyz.com before launch: your email, the role you picked, which form you used, the source you arrived from (for example the Instagram bio link), and a hashed IP for abuse detection. Mirrored to Airtable so the founders can see the list.
• Server logs. Standard request logs kept for a short period for reliability and abuse detection.

Who processes it with us

• Meta Platforms (Instagram Graph API) to publish posts, read comments and send private replies to your commenters, under your explicit permission grant.
• Google (Gemini API) to write copy. Your brand settings and the topic are sent; nothing about your Instagram account is.
• Pexels and Unsplash to source stock photography. The search query is sent; nothing about you is.
• Stripe for payments.
• Resend to send teammate invitations by email.
• Airtable as the mirror of the pre-launch waitlist.
• Microsoft Clarity on this website only (not inside the app) to see how visitors use the pages: clicks, scrolling and anonymised session replays. Form fields are masked, and Clarity sets its own cookies.
• Hetzner hosts the servers, in the United States.

We do not sell data, and we do not share it with anyone not listed above.

Instagram data, specifically

Dailyz uses Instagram's API with the permissions you approve on the consent screen: reading your professional account's basic profile, publishing content, managing comments, and managing messages. We use them only to publish the posts you approved, read comments on those posts, and send the reply you configured to people who comment your keyword. You can disconnect at any time from Dailyz (Instagram → Disconnect) or from Instagram (Settings → Apps and websites). Either one deletes the token from our servers immediately. Our use of Instagram data follows Meta's Platform Terms and Developer Policies.

How long we keep it

• Account and workspace data: while your account exists.
• Posts and rendered images: while your workspace exists, plus whatever you have not deleted yourself.
• Instagram tokens: until you disconnect, until Instagram revokes them, or until they expire. Expired tokens are removed.
• Waitlist registrations: until launch communications are done, or on request.
• Logs: 30 days.

Deleting your data

You can remove the Instagram connection from inside Dailyz at any time. To delete your account, workspace, posts and everything above, email support@getdailyz.com from the address on the account, or use the data deletion page. We confirm within 7 days and delete within 30. Instagram data-deletion requests sent by Meta on your behalf are handled automatically and given a confirmation code you can check.

Your rights

You can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, and object to how it is used. Email support@getdailyz.com. If you are in the EU, UK or California, the rights under GDPR, the UK GDPR and the CCPA apply and we honour them.

Security

Traffic is encrypted in transit. Passwords are hashed with scrypt. Instagram tokens are stored on the server only, never sent to the browser. Secrets live in files only the service can read.

Children

Dailyz is for businesses and is not directed at anyone under 18.

Changes

If this policy changes in a way that matters, the date at the top changes and account holders get an email.