Daidala Privacy Policy
Last updated: 15 October 2026
1. Controller and contact
The controller described in this policy is Daidala AI Konrad Makowski, Snopków 20, 21-002 Jastków, Poland, Polish tax identification number NIP 713-274-23-92, operating Daidala at https://daidala.tech.
Privacy contact: support@daidala.tech. No Data Protection Officer has been appointed.
2. Two roles
This policy applies to data for which Daidala AI Konrad Makowski determines the purposes and means of processing. It covers visitors, account holders, purchasers, the owners of the companies that buy from us and people who contact us.
For personal data placed by a customer in that customer's Daidala instance, the customer is the controller and Daidala AI Konrad Makowski is the processor. That processing is governed by the data processing agreement in section 10 of the Daidala Terms of Service. A person whose data is held in a customer instance should contact that customer. A request received by us will be forwarded to the customer.
3. Data, purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser and device data, requested pages and timestamps | operation, security and abuse detection | Article 6(1)(f) GDPR - legitimate interest in security and stability |
| necessary cookies and similar information | session, sign-in, security, remembering the analytics choice and the language choice | Article 6(1)(b) or (f) GDPR; storing and reading information on the device without consent, as this is strictly necessary for the service (Article 399(3) of the Polish Electronic Communications Law (PKE) and corresponding laws of other countries, see section 9) |
| data sent to Google Analytics 4 after you allow analytics in the “Analytics” card: IP address, the page you are on, the referring page, browser and device data, and Google cookies that recognise a returning visit | website measurement | Article 6(1)(a) GDPR and consent to storing and reading information on the device (Article 399(1) PKE and corresponding laws of other countries, see section 9) |
| name, email, password hash, business name, address, VAT number and account data | account creation, management and contract performance | Article 6(1)(b) GDPR |
| order, subscription, payment and refund data | entering into and performing the contract | Article 6(1)(b) GDPR |
| invoice, settlement, country and tax-status data | accounting and tax duties | Article 6(1)(c) GDPR |
| the company name and the full name of the company owner, and the country of the address and the country of the tax number - given when buying, or asked for during the contract where we do not already hold them; where the owner is somebody other than the buyer, we receive that name from the buyer | checking the buyer against the European Union consolidated sanctions list and the list kept under the Polish act of 13 April 2022, and repeating that check for as long as a customer's contract lasts; where the company name or the owner's name matches an entry we refuse the sale, and for a customer we stop providing the service and notify the competent authority | Article 6(1)(c) GDPR - the prohibition on making funds and economic resources available to listed persons and entities under Regulations (EU) No 269/2014, (EU) No 833/2014 and (EC) No 765/2006 and under the act of 13 April 2022 |
| service messages about payment, activation, suspension, termination, retrieval and deletion | contract performance and legal duties | Article 6(1)(b) and (c) GDPR |
| support correspondence | handling the request and legal claims | Article 6(1)(b) and (f) GDPR |
| first and last name, email address, and the time and time zone you pick in the consultation booking form | arranging and holding a call about the service, including the booking confirmation and the link to the meeting | Article 6(1)(b) GDPR - steps taken at your request before a contract; Article 6(1)(f) GDPR - legitimate interest in answering a contact, where the call does not lead to a contract |
| contract and billing data after termination | establishing, pursuing or defending claims | Article 6(1)(f) GDPR |
Required account and purchase data are provided voluntarily, but the contract cannot be concluded or performed without them. Booking a call is voluntary as well: without a name, an email address and a time we cannot arrange it. The company name and the owner's name are needed for the sanctions check the law requires: without them we cannot sell.
4. Recipients
Data may be received by:
- Google Ireland Limited for Google Analytics 4, only after you allow analytics;
- Google Ireland Limited for the calendar and the form used to book a consultation;
- Stripe Payments Europe, Limited and Stripe entities involved in a payment; card data are sent directly to Stripe;
- cloud infrastructure providers whose servers run customer instances, in data centres in the European Union, for data processed on customer instructions;
- the AI provider whose access a customer has connected to their instance, for the content of that instance that the work of the AI agents there needs: issues, notes, wiki pages and whatever else an agent reads or writes while doing it;
- an accounting or invoicing provider, if used for a particular settlement;
- public authorities where required by law.
The storefront, transactional email, promotional files and post-termination data packages use the controller's own infrastructure in Poland. Cloudflare, Inc. operates DNS for the daidala.tech domain, Śląsk Data Center operates DNS for the snopkow.eu domain used for transactional email, and Let's Encrypt issues TLS certificates. The DNS providers do not carry traffic to the website and do not receive account or order data.
Daidala sends content from a customer's instance to the AI provider to carry out that customer's instructions: the customer chooses the provider and the account, and connecting that access is the instruction to run the work of their agents on it (Article 28(3)(a) GDPR, section 10 of the Terms of Service). That provider is the customer's own, it handles what Daidala sends under the customer's own agreement with it, and it is not one of the companies that process data for the controller.
The recipient list will be updated before a new provider is enabled.
5. Transfers outside the EEA
The storefront and its database operate in Poland. Customer instances and their data are hosted in the European Union.
The content of a customer's instance that the work of the AI agents there needs leaves the instance and goes to the AI provider whose access that customer has connected, including outside the European Economic Area, if that is where the provider works. It goes there on that customer's instruction. The customer is the controller of the data on their instance (section 2) and decides whether the data may be sent there.
Google and Stripe may also process data outside the EEA. Where this occurs, they use a transfer basis required by Chapter V GDPR, including an adequacy decision or Standard Contractual Clauses. Information about the applicable safeguard is available from support@daidala.tech.
6. Retention
| Data | Period |
|---|---|
| nginx access logs containing IP addresses | 90 days |
| application logs | no fixed period; removed when the pod is replaced during deployment |
| account data | contract term and the retrieval period that follows it - at least 30 days after the contract ends, and where a data package is provided, until the last download day shown with it in the account, or, if you tell us the package is not complete or ask us to hand your data over, until we settle that; we erase the data within the 9 days that follow the last download day, and if your matter is still open by then, after we settle it; afterwards only where needed for legal duties or claims |
| post-termination data package | until the last download day shown with the package in the account - at least 30 days from the day the package appears there, which is the day the contract ended unless preparing the data took longer; if you tell us the package is not complete or ask us to hand your data over, we keep it until we settle that and the account then shows no last download day for it; we erase the files within the 9 days that follow the last download day, and if your matter is still open by then, after we settle it |
| data package you ask for during the contract | until the last download day shown with the package in the account; we erase the files within two days of that day, and if you ask for another package, it replaces this one and we erase these files at that point |
| storefront database backups | 14 days |
| customer instance data | the hosting provider keeps seven daily copies of the server; each copy stays until a newer one replaces it, and all of them are erased together with the server when the contract ends |
| invoices and tax records | for the period required by tax and accounting law |
| claims data | until the applicable limitation period expires |
| support correspondence | 12 months after closure, longer only where needed for claims |
| calendar entry and messages about a booked call | 12 months from the day of the call; where the contact leads to a contract, as long as the account data above |
| analytics choice | 12 months |
| sanctions screening records | for as long as we must be able to show the check was made - where the check concerns a sale or one of our customers, as long as the accounting records of that sale or of that customer's contract; where a purchase was stopped before an order arose, 5 years from the check |
| Google Analytics | Google keeps the analytics data sent from this website for 2 months from collection (the retention period set in our Google Analytics account) and then deletes it automatically. Aggregated report data that can no longer be linked to an individual visitor may be kept longer. |
7. Rights
Subject to GDPR conditions, a person may request access, correction, deletion, restriction and portability. A person may object to processing based on legitimate interests. Consent may be withdrawn at any time without affecting earlier lawful processing.
Requests should be sent to support@daidala.tech. We normally respond within one month. A complaint may be lodged with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, which is the supervisory authority competent for the controller. It may also be lodged with the supervisory authority of the EU or EEA country where the person lives or works, or where the alleged infringement took place (Article 77 GDPR). The European Data Protection Board publishes the list of supervisory authorities.
8. Automated decisions
When you buy, three checks can refuse your order automatically, with nobody looking at it first:
- the country of your address or the country of your tax number is under a European Union embargo;
- the country is not one we sell to;
- the company name or the owner's name you gave matches an entry on the sanctions lists named in section 3.
We compare the names you gave with our own copies of the two lists. We first reduce both sides to a common form - no accents, no punctuation, no company-form suffix such as Ltd or GmbH - and then treat as a match a name that is identical or made of the same words in a different order. A refusal means that no order is created, nothing is charged and no instance is set up. It does not mean we are saying you are on a sanctions list: we compare names, not identities.
A name that is only close to an entry, and a copy of a list too old to check against, do not refuse the purchase automatically - they stop it for a person to look at.
We may decide this way because European Union and Polish sanctions law requires the check (Article 22(2)(b) GDPR), and the same rules set out how to be removed from a list. If you think a refusal is wrong, write to support@daidala.tech: a person will look at your case, you can give your side of it and you can contest the decision. The one refusal we cannot lift is the one for a country under an embargo - the prohibition leaves us no room.
9. Cookies and analytics
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
_storefront_session | Daidala | maintain the session | session | necessary |
analytics_consent | Daidala | remember analytics choice | 12 months | necessary |
storefront_language | Daidala | remember the chosen site language | 12 months | necessary |
_ga | distinguish users in GA4 | up to 12 months | analytics | |
_ga_P0DEB3C6XG | maintain GA4 session state | up to 12 months | analytics |
gtag.js only loads once you allow analytics in the “Analytics” card. Before you answer, and after you decline, the page does not connect to Google: nothing is sent to Google and no Google cookie or identifier is created. Once you allow it, Google receives your IP address, the page you are on, the referring page, and browser and device data, and the Google cookies in the table above are stored in your browser. Withdrawing consent deletes those cookies and stops the measurement. Consent can be refused without losing access and changed through the “Analytics” footer link. Closing the choice window without selecting an option is not consent.
Storing and reading information on your device is governed by the law of the country where you use the website: in Poland Article 399 of the Electronic Communications Law (PKE), in France Article 82 of Law No. 78-17 (Informatique et Libertés), in Germany Section 25 TDDDG, in Spain Article 22(2) of Law 34/2002 (LSSI), and in other EU countries the laws implementing Article 5(3) of Directive 2002/58/EC.
10. Security and changes
We use technical and organisational measures appropriate to risk. This policy may change when services, providers or law change. The current version and date are published on the website. Active customers will be informed by email of a material change where required by law or the nature of the change.