Privacy Policy

This Privacy Policy explains how Creative Brackets AB (Org. Nr. 559002-9624), a company registered in Sweden ("we", "us", or "our"), collects, uses, and protects personal data when you use Dayboard.

We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Data Controller

Creative Brackets AB is the data controller responsible for the processing of personal data described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

Account Information

Email address, name, login credentials (passwords are securely hashed)

Profile & Preferences

Display name, dashboard preferences, theme settings, feature configurations

Payment Information

Billing details and payment status processed via Stripe
(We do not store full credit card numbers)

User Content

Content you create or store in Dayboard, including dashboards, widgets, notes, tasks, links, calendar entries, habits, goals, and similar data

Communication Data

Messages sent via email or support channels

2.2 Information Collected Automatically

Usage Data

Features used, pages visited, interactions, session duration

Device & Technical Data

Browser type, operating system, device type, IP address

Log Data

Access timestamps, error logs, performance and diagnostic data

Cookies & Tracking Technologies

See our Cookie Policy for details

Campaign Data

If you arrive from an ad or a tagged link, we record the campaign tags in the address (UTM parameters, Meta campaign, ad set, ad and placement IDs, click IDs), the page you landed on and the referring site. We keep the first visit we saw and the visit that led to your sign-up, and store both with your account when you create one.

2.3 Information from Third Parties

Authentication Providers

If you sign in via third-party authentication, we receive basic profile data

Payment Processor (Stripe)

Payment status, subscription state, transaction identifiers

Analytics Providers

Usage statistics from Google Analytics, Microsoft Clarity and SessionRewind. With your analytics consent, Google Analytics events are linked to your account ID, a random identifier rather than your name or email, so we can see how people who sign up go on to use the product.

3. How We Use Your Information

We process personal data only when necessary and for legitimate purposes.

3.1 Service Provision

• Create and manage user accounts
• Provide access to Dayboard features
• Store and synchronize dashboard data
• Process payments and subscriptions
• Provide customer support

3.2 Service Improvement

• Analyze platform usage
• Improve usability and performance
• Develop new features
• Identify and fix technical issues

3.3 Communication

• Send service-related notifications
• Respond to inquiries and support requests
• Send billing and subscription notices
• Send marketing communications (only with consent)

3.4 Security & Legal Compliance

• Prevent fraud, abuse, and misuse
• Maintain platform security
• Enforce Terms of Service
• Comply with legal obligations and regulatory requirements

4. Legal Basis for Processing (GDPR)

We process personal data under the following legal bases:

• Contract Performance
  Processing required to provide the Dayboard service
• Legitimate Interests
  Platform improvement, security, fraud prevention
• Consent
  Marketing communications and optional cookies
• Legal Obligation
  Accounting, tax, and regulatory compliance

5. Data Sharing and Disclosure

We do not sell your personal data.

We only share data in the following cases:

5.1 Service Providers (Data Processors)

• Supabase – authentication and database hosting
• Stripe – payment processing
• Google Analytics / Tag Manager – usage analytics
• Microsoft Clarity – session recordings and heatmaps
• SessionRewind – session replay
• Meta (Meta Pixel and Conversions API) – ad measurement, only with your marketing consent

All providers operate under data processing agreements and GDPR-compliant safeguards.

5.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. Users will be notified where legally required.

5.3 Legal Requirements

We may disclose data if required by law, court order, or government authority, or to protect our legal rights.

5.4 With Your Consent

We may share data with third parties when you explicitly consent.

6. Data Security

We implement appropriate technical and organizational measures, including:

• Encrypted data transmission (HTTPS/TLS)
• Encryption of sensitive data at rest
• Access controls and authentication
• Secure password hashing
• Regular security updates and backups

Despite these measures, no system is completely secure. We cannot guarantee absolute security.

7. Data Retention

We retain personal data only as long as necessary:

• Account Data – while your account is active
• User Content – while active, and up to 30 days after account deletion
• Payment Records – up to 7 years (legal obligation)
• Log Data – up to 90 days
• Analytics Data – aggregated and anonymized; retained indefinitely
• Campaign Data – stored with your account while it is active, deleted with it

8. Your Rights Under GDPR

If you are located in the EEA, you have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Request deletion ("right to be forgotten")
• Restrict processing
• Receive your data in a portable format
• Object to processing based on legitimate interests
• Withdraw consent at any time
• Lodge a complaint with a data protection authority

To exercise these rights, contact:

📧 support@dayboard.me

We respond within 30 days.

9. International Data Transfers

Some service providers may process data outside the EEA. When this occurs, we ensure appropriate safeguards, including:

• EU Standard Contractual Clauses
• GDPR-compliant data processing agreements
• Adequate technical and organizational protections

10. Children's Privacy

Dayboard is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If such data is discovered, it will be deleted promptly.

11. Cookies and Tracking

We use cookies and similar technologies for functionality, analytics, and performance. Details are provided in our Cookie Policy.

12. Marketing Communications

You may receive marketing communications only if you have opted in.

You can opt out at any time by:

• Clicking "unsubscribe" in emails
• Updating account preferences
• Contacting us directly

Transactional emails (e.g. billing, security, account notices) cannot be disabled.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Significant changes will be communicated via email or within the platform. Continued use of Dayboard constitutes acceptance of the updated policy.

14. Contact Information