Last updated: 18 September 2026
Definitions
For this notice, the following terms have these meanings.
Daybeat means the content-marketing service provided by Function 365 Limited. References to we, us and our mean that legal entity.
Owner means the person with the workspace role responsible for billing, membership and go-live. Member means a person with the invited staff role, who can review and approve content.
Authorised Agent means a third-party delegate acting under an API token minted by a signed-in human Owner, within its granted permissions, the workspace's oversight mode and applicable access limits. An agent creating a restricted account before a person claims it is not, merely by doing so, that person's Authorised Agent.
Approval means the customer's explicit decision permitting a piece to publish, made by an Owner, a Member or an Authorised Agent with the required permission. Go-live, the approval of the first topic's content, remains a human Owner action.
Customer Content means the workspace material described in clause 2.3. DPA means our Data Processing Agreement at /dpa.
UK GDPR means the UK General Data Protection Regulation. PECR means the Privacy and Electronic Communications Regulations 2003. ICO means the Information Commissioner's Office.
1. Who we are
1.1 Function 365 Limited, trading as Daybeat, is registered in England and Wales under company number 10069330. Our registered office is Third Floor, 95 The Promenade, Cheltenham, Gloucestershire, United Kingdom, GL50 1HH.
1.2 We are the controller for the uses of personal data described in clause 2.2. Our ICO registration number is ZA539196.
1.3 Contact dpo[at@]function365.co.uk for privacy questions, rights requests or complaints. General enquiries go to info@function365.co.uk.
1.4 Data Protection Officer: The Law Boutique provides the DPO arrangement for Function 365 Limited. Contact dpo[at@]function365.co.uk; Function 365 Limited monitors this mailbox and routes DPO requests onward.
2. What this notice covers
2.1 This notice explains our use of personal data under the UK GDPR and the Data Protection Act 2018. It covers people associated with business customers as well as visitors and people who have not become customers.
2.2 We act as controller for our relationship with Owners, Members, invited users, people associated with Authorised Agents and other API actors, billing contacts, support correspondents, referral participants and marketing-site visitors. This includes people whose details an agent supplies to create a restricted account before they have consented or claimed it.
2.3 We act as processor for Customer Content on the customer's instructions under the DPA: verbatim interview answers, business research findings and source references, supplied text, offerings, business profiles, topics, generated pieces and versions, images and brand assets, and publishing records. These may identify staff, customers or case-study subjects. Interviews are either automated in the portal or, if you chose the team onboarding option, run by a member of our team. Our staff can access interview answers through the recorded administrative paths described in clause 6.7. Original library uploads remain stored unaltered, including any embedded metadata, alongside the copies re-encoded for publication with metadata removed; brand logos use a separate public hosting path.
2.4 Audience contact lists remain in the customer's own Brevo account. We hold audience segment references and labels and the sender identity, and create campaign drafts for the customer to send in Brevo. A separately requested email-design test can send to a specified recipient through that connection; we do not import or hold the audience list.
2.5 If your data appears in Customer Content, the customer is the controller for that use. Contact them about it, or you can contact us and we will pass the request to the relevant customer and assist them as our agreement with them requires under the DPA. Our controller uses, such as security and activity records, remain covered by this notice.
2.6 We do not seek special category or criminal offence data about account holders. Customers must not put special category or criminal offence data into their workspace. If such data is received incidentally, we handle it under our applicable data protection duties and, for Customer Content, our processor duties under the DPA.
2.7 Daybeat uses AI image generation from the workspace's brand guidance, involving no personal data. Separately, we carry out automated classification and moderation of uploaded images, which may contain personal data.
3. Personal data we collect
3.1 Owners, Members and account holders. We hold user identifiers, name, email address, email-verification status, avatar URL where supplied, account timestamps, workspace membership, role and status. Account security records can include restrictions, reasons and expiry dates.
3.2 Sign-in and security. Where applicable, we hold a password hash, verification and password-reset records with expiry dates, multi-factor authentication settings, the time-based one-time password (TOTP) secret and backup codes, failed-verification counts and lockout times. If Google sign-in is configured and used, account records include Google sign-in tokens, permissions and expiry dates.
3.3 Sessions contain a token, expiry, IP address, user agent (browser and device information), active workspace identifier and any staff view-as marker. A trusted-device cookie records the user's choice to remember a device for multi-factor authentication. Section 13 covers cookies.
3.4 Invited users and restricted-account invitees. Invitation records contain the invitee's email, inviter identifier, status and expiry. For an agent-created restricted account we record the declared owner's email and supplied registration and setup details, together with the account's claim and review state. The person may not yet have agreed to use Daybeat.
3.5 Authorised Agents and API actors. We hold hashed API token material, display prefix, workspace reference, granted permissions, expiry, last-request information and rate-limit counters. We record the oversight mode and changes to it. Activity records distinguish a human action from an Authorised Agent's action and link the latter to its token and the human who minted it.
3.6 Activity records. Our audit trail records the actor identifier and kind, action, affected record, timestamp and before-and-after information or other event details. These snapshots may repeat personal data from a changed record. Records include Approval, publishing, permission changes and staff actions. Removing access or revoking a token does not remove the trail.
3.7 Billing contacts. We hold plan and subscription details, the selected onboarding option, payment status, billing periods, Stripe customer and subscription identifiers and a flag indicating whether a tax identifier is present. Billing name, email, address and tax identifier are held by Stripe and used for billing and tax treatment. Stripe collects card details directly; we do not see or store them.
3.8 Support correspondents and referral participants. We keep support emails, their sender details and contents, and the free-text notes you send us in the portal, such as an onboarding help request or a note explaining how you want content changed. Referral records associate referral tokens with the referring and referred workspace and reward attribution. We also hold transactional email recipient addresses, delivery-event details and provider event payloads, and suppression addresses used to prevent further delivery.
3.9 Marketing-site visitors. We use request and device information to serve the public marketing site and, with your consent, analytics and advertising conversion measurement. Where used, Google Tag Manager and Meta pixel operate only with your consent through the site's cookie controls. This measurement is confined to the marketing site and does not run in the signed-in portal or send Workspace Customer Content to advertising platforms. Google Fonts receives your IP address and user agent when your browser loads the site's fonts; that font request sets no cookie.
3.10 Application and worker logs record operational messages and errors, including timestamps and relevant route or task context, for diagnosis and service security. Hosting and reverse-proxy infrastructure, including Cloudflare in front of the app, may also process request information. Authorised operations staff use relevant logs to investigate faults and protect the service. We do not promise a fixed or short log retention period; retention is governed by section 8.
3.11 People using the website or service. Application error events, stack traces, breadcrumbs, request context and performance information are recorded to diagnose faults. These events may contain personal data; no application-side personal-data scrubbing is configured. No third-party error-monitoring service is currently enabled, in production or in staging; enabling one would be a subprocessor change notified under the DPA. Retention is governed by section 8.
3.12 Connections. We store the credentials you supply for your connected platforms and associated configuration, including an export delivery address where supplied, identifiers, expiry and health information. These enable the connector to act on the customer's instructions; they do not give us an audience contact list.
4. Where the data comes from
4.1 We receive data directly from you when you register, sign in, supply credentials, use Daybeat, participate in onboarding or contact support. Session and activity information arise from your use of the service.
4.2 Your Owner supplies your email when inviting you. An agent can supply a declared owner email and registration or setup information through the public onboarding endpoint before that person has consented; we create a restricted account and email an invitation to claim it. The endpoint does not require authentication. Email verification binds the person to the account, and payment is a separate step.
4.3 We receive billing identifiers, subscription information and payment outcomes from Stripe, and transactional email delivery and suppression information through our email provider.
4.4 For connections, you supply the platform credentials directly. The connected platform then returns operational information such as permission checks and publication results when the connector acts on the customer's instructions. This is not a sign-in or consent record obtained through a platform authorisation redirect.
4.5 Customer Content may also come from research of the customer's own website during onboarding. The crawler stays on the same registrable domain and respects robots.txt. It records findings, bounded excerpts and source references; social links yield a platform, URL and possible handle, without fetching social profile content. Extracted page text can be sent for AI screening even though full page text and raw HTML are not retained as research records.
4.6 Ordinary invitations include a link to this notice before registration and explain that the workspace Owner supplied your address. Restricted-account invitations also include this notice before registration and explain that an assistant using Daybeat supplied your address. The restricted-account invitation includes the link described in section 8 for people who do not recognise the registration.
5. Purposes and lawful bases
5.1 The table describes our controller uses. Contract applies only where processing is necessary for a contract with you personally, or steps you ask us to take before entering one. For employees and other representatives of a business customer who are not personally contracting with us, the stated service-administration legitimate interests apply instead.
| Purpose and data used | Lawful basis |
|---|---|
| Create and operate an account, manage membership and ordinary invitations, provide support and send necessary service messages, using identity, contact and workspace records | Contract where clause 5.1 applies; otherwise legitimate interests in providing the business customer with the service and managing its authorised users |
| Secure sign-in, control API access, investigate abuse and faults, using authentication, session, token, audit and error records | Legitimate interests in protecting users and the service and keeping it reliable |
| Record Approval, staff and agent actions, manage allowances and investigate disputes, using audit and usage records | Legitimate interests in accountability, administering the service and establishing or defending claims |
| Manage subscriptions, payment outcomes and invoices, using billing contact and subscription records | Contract where clause 5.1 applies; otherwise legitimate interests in administering the customer's subscription |
| Apply tax treatment and keep required accounting records | Legal obligation, to the extent required by applicable tax and accounting law |
| Attribute referrals and administer rewards, using referral tokens and related records | Legitimate interests in administering the referral programme; contract where clause 5.1 applies; the cookie question is separately addressed in clause 13.2 |
| Serve the marketing site and its fonts, using request information | Legitimate interests in delivering the website; infrastructure logging remains subject to clause 3.10 |
| Deliver necessary account, billing and security emails and manage delivery failures, using recipient and email-event records | Contract where clause 5.1 applies; otherwise legitimate interests in service communications and preventing unwanted or failed delivery |
| Send promotional updates to registered customers, using contact details and preferences | Legitimate interests in promoting Daybeat under the existing-customer exemption described in clause 5.4 |
| Create a restricted account, store its setup information and send its invitation using an agent's supplied details | Legitimate interests in enabling an intended business customer to review and claim a proposed account, with limited retention and an opt-out as described in section 8; we do not assume that the person requested a contract or authorised the agent |
| Measure marketing-site use and advertising conversions, using device, browser and event information | Consent through the site's cookie controls for optional analytics and advertising technologies |
5.2 Our legitimate interests are the specific purposes set out above. Required billing and accounting records are kept to comply with tax and accounting obligations; clause 8.3 describes the six-year policy for those records.
5.3 Necessary service, billing and security messages are part of operating the account. They are separate from marketing. If we send Daybeat marketing, we will provide an unsubscribe link and you can also opt out through info@function365.co.uk.
5.4 We send promotional updates to registered customers under the existing-customer exemption, without a separate marketing opt-in. Every promotional message includes an unsubscribe link. You can also opt out at info@function365.co.uk. Necessary service, billing and security messages are separate and are not stopped by a marketing unsubscribe.
5.5 The service needs identity and authentication details to operate an account, and billing details to administer a paid subscription. If necessary details are not provided, the relevant account or paid service cannot be provided. Marketing consent is not a condition of using Daybeat.
5.6 Approval and an Owner's delegation choices are instructions about operating Daybeat. They are not, by themselves, the consent of every person mentioned in content, and do not remove our own data protection obligations. The customer remains responsible for deciding whether its approved content is accurate and lawful and complies with its platforms' terms. Our Terms of Service are at /terms.
6. Who we share personal data with
6.1 We use the following providers for the stated functions. A provider acting for us as controller is our processor; for Customer Content it may be our subprocessor. Some recipients have independent responsibilities. See subprocessor list and the DPA for the live list and further details.
| Provider | Function and relevant data |
|---|---|
| Neon | Managed database holding application records, including accounts, sessions, Customer Content, audit and billing records |
| Cloudflare | Fronts the app and processes request information; R2 object storage for images, original uploads, content files and export bundles; separate public storage for brand logos |
| Hostinger | Servers running the application and background processing, including data handled in memory and infrastructure logs |
| Anthropic | AI text generation, interview, synthesis and assessment using business information, answers, topics and drafts |
| OpenRouter | Routes AI requests for text and text embeddings to the model providers below, using relevant workspace text |
| Resend | Transactional emails, including recipient names and addresses and message content |
| Stripe | Payments, subscriptions, tax and hosted billing, using identity, billing and payment details |
| Google Fonts | Public-site font delivery, receiving visitors' IP addresses and user agents directly from their browsers |
| Google Tag Manager and Meta pixel, where used with consent on the marketing site | Analytics and advertising conversion measurement using visitor, device and event information; no Workspace Customer Content |
6.2 OpenRouter routes text processing to these named model providers. The live list must reflect the providers actually used.
| Routed provider | Uses |
|---|---|
| Moonshot AI | Content drafting |
| DeepSeek | Content drafting |
| Z.ai | Content drafting |
| Content drafting and quality assessment | |
| Anthropic | Content drafting, screening, user assistance |
| OpenAI | Text embedding, content matching |
6.3 We also call Anthropic directly for text generation, synthesis, ranking and interviewing. We do not train on Customer Content. Every request we route through OpenRouter carries a data-policy setting that restricts routing to providers which do not collect user data, and text routing is restricted to a reviewed set of recipients for each model. We use providers offering zero data retention where that is available and compatible with the service, but we cannot guarantee that the provider honours this declaration. We cannot control or warrant how a provider retains Customer Content, or the terms on which it processes it, and those terms may change.
6.6 The customer's WordPress host, LinkedIn, Meta/Instagram, X and Brevo are customer-authorised destinations. They receive approved content or operational requests through the customer's connections under its direct relationship with them. They are independent controllers or the customer's own processors, not Daybeat subprocessors. Brevo receives campaign drafts and separately requested test emails as described in clause 2.4. A per-piece export may also be delivered to an address configured by the customer.
6.7 Workspace access follows membership and permissions; Authorised Agents receive the access the Owner permits. Our staff access data as needed for support and operations through recorded administrative paths. Staff view-as access is read-only; staff edits and other administrative actions are separately attributed. A staff view-as session lasts at most one hour and is recorded against the session. Our staff can also edit workspace content where the workspace's concierge-edits setting permits it. That setting is on by default and the Owner can switch it off. Some safety actions, such as an advisory correction or retiring an offering, are taken regardless and always generate a notification to the workspace with the change. Staff can also approve and re-push the email wrapper design outside this setting; that approval is attributed to staff and shown to the workspace. These permissions do not allow staff to approve a piece for publication.
6.8 We may also disclose relevant data to professional advisers, regulators or law enforcement where required, and to a buyer or successor if the business is sold or reorganised. We would tell you about a transfer to a buyer or successor. We do not sell personal data or provide Workspace Customer Content to advertisers or data aggregators. With your consent, marketing-site conversion measurement is shared with advertising platforms. We may make aggregated conversion-measurement reports available to business customers; these reports do not identify individual visitors. This does not permit advertising use of Workspace Customer Content.
7. International transfers
7.1 Neon hosts the production database in the United Kingdom, in its London region. Hostinger's application datacentre is in London, UK. Cloudflare R2 uses EU jurisdiction storage, including the separate brand-logo bucket, and Cloudflare also fronts the app. UK/EEA hosting does not by itself establish the location of all access or onward processing.
7.2 UK/EEA storage does not mean all processing stays there. Anthropic, OpenRouter, Resend, Stripe and Google involve US providers or processing; Resend stores transactional email data in the US. Cloudflare and Neon may also involve access outside the hosting region. Consented marketing-site measurement may involve Google and Meta outside the UK or EEA.
7.3 OpenRouter also makes onward disclosures to the providers in clause 6.2. Moonshot AI and DeepSeek are headquartered in China, outside adequacy-covered jurisdictions; Google, Anthropic and OpenAI involve US providers. Headquarters are not a guarantee of the processing location. The routing position in clause 6.3 does not replace the need for a valid transfer mechanism.
7.5 You can request details and copies of the applicable safeguards through dpo[at@]function365.co.uk.
8. How long we keep personal data
8.1 We will keep personal data only for as long as needed for its stated purpose, legal obligations and properly justified claims or security needs. The current system does not automatically apply a general deletion schedule. The table explains what expiry and cancellation actually do; it does not present indefinite storage as a lawful retention policy.
| Records | Current behaviour and retention policy |
|---|---|
| Accounts and membership | Removing a Member ends workspace access but leaves the user account record. Account deletion is handled on request as a manual process, not through an account-deletion button. |
| Customer Content, research and transcripts | Cancellation and the 90-day reactivation expiry change workspace status without deleting records or stored files. Transcripts and research records have no automatic purge. Workspace hard deletion must be handled through the request process in clause 8.2. |
| Library images and brand assets | Retiring a library image retains its record and original and derivative files. Stored image files are not deleted automatically: there is no purge process and no storage lifecycle rule. Deletion is handled on request under clause 8.2. Public logos use a separate bucket. |
| Audit and usage records | Audit records are append-only and neither audit nor usage records have a pruning job. Records remain after access ends; revoking an API token does not remove its audit history. |
| Sessions and ordinary invitations | Customer sessions expire after 30 days, renewed at most once per 24 hours; invitations expire after 7 days. Expiry ends validity, not necessarily storage. Expired session rows, including IP address and user agent, have no cleanup job. |
| Unclaimed restricted accounts | Unverified agent-created accounts lapse at day 30: their credentials are revoked and they remain reclaimable until day 60. At day 60 they expire and cannot be reactivated. The declared email and every agent-supplied field capable of holding personal data are replaced in place with an irreversible placeholder and cannot be recovered. The business name, non-personal setup and inert account, binding and audit records remain. On a successful claim, the declared email in the binding record is replaced in the same way. The invitation's “I do not recognise this, delete my registration.” link expires the account immediately, applies the same treatment and suppresses further agent-declared invitations to that address. It does not prevent your own sign-up. |
| Transactional email events, suppressions and referrals | Recipient addresses, event payloads, suppression addresses and referral records remain after workspace access ends. Email events and suppressions are deliberately decoupled from workspace deletion. No general pruning schedule is implemented. |
| Billing and tax records | We retain required billing and accounting records for six years for tax and accounting duties. Stripe holds invoices under its default retention schedule; we do not store invoice copies or claim that Stripe's own schedule is six years. |
| Support, infrastructure and error records | We retain these for the support, fault investigation and security purposes for which they are needed, subject to justified legal retention and the review criteria in clause 8.3. |
8.2 Daybeat operations handles account and workspace erasure, transcript deletion and data delivery requests manually under the DPA and section 10. We agree case-specific timing and explain obstacles without undue delay; statutory deadlines continue to apply. There is no automated general erasure workflow or self-service workspace archive export, and workspace hard deletion is structurally blocked. The 90-day window after effective cancellation is for reactivation and is not a fixed deletion deadline. Our audit retention policy is workspace life plus 12 months after its Service ends; no automated audit pruning currently implements that policy.
8.3 Surviving records must be assessed by purpose and role. Customer Content, including copies in audit snapshots, remains subject to the DPA. We retain the minimum suppression information necessary to prevent unwanted messages. Required billing and accounting records are retained for six years; an erasure request does not override the financial-record duty for those records. Other records may remain only while needed for their stated purpose or justified legal or security needs. Expiry of access does not itself justify continued storage.
8.4 Daybeat does not keep a separate diagnostic log of model prompt and response text. This does not mean the underlying content is absent: transcripts, business profiles, generated pieces and image-generation prompts attached to asset records remain stored as Customer Content. Usage metering records provider, model, counts and attribution rather than prompt and response text.
8.5 Backup history may retain data beyond its removal from active records. Our database provider manages backups with point-in-time restore; the restore window is currently one day. Backup copies are protected and kept beyond ordinary use pending expiry; deletion instructions are reapplied if data is restored. The configured backup window is not stated as a fixed retention or recovery guarantee.
9. Security
9.1 We use TLS for data in transit, password hashing, available multi-factor authentication, session controls, rate limiting, workspace-scoped data access and recorded staff access. Connector credentials are encrypted at rest with a key held outside the database. TOTP secrets and backup codes are application-encrypted. Staff view-as sessions are read-only, and staff sign-in sessions last at most 12 hours. No security certification is claimed. Where a breach triggers legal notification duties, we will notify the ICO and affected people as required; for Customer Content, notification to the customer is governed by the DPA.
10. Your rights and complaints
10.1 You have rights to information about processing, access to your personal data and correction of inaccurate or incomplete data. In the circumstances provided by law, you may also request erasure or restriction and object to processing based on legitimate interests.
10.2 Data portability applies to personal data you provided where processing is automated and based on consent or a contract. It is distinct from a customer's request for a full workspace archive. Rights are subject to applicable conditions and exemptions. The ICO explains these rights.
10.3 You may object to direct marketing at any time. Where we rely on consent, you may withdraw it through dpo[at@]function365.co.uk; withdrawal does not affect the lawfulness of earlier processing.
10.4 Send rights requests to dpo[at@]function365.co.uk. We will respond without undue delay and normally within one calendar month. Daybeat operations handles requests with case-specific timing, subject to statutory deadlines and lawful exceptions. If a lawful extension is needed, we will explain the reason and timing within the applicable initial period. An operational obstacle does not extend a statutory deadline.
10.5 We may request information reasonably needed to verify identity or authority. Requests are normally free. We will explain any lawful refusal or retained information and the complaint route. Access and erasure are handled by our staff, including manual data delivery and deletion; the portal's per-piece export connector is not a data-subject export tool.
10.6 For Customer Content, you can contact us and we will forward the request to the relevant customer without undue delay and within two business days of receipt, without making identity checks a precondition to forwarding. We assist them under the DPA and separately address any part for which we are controller. A workspace Owner can request a workspace export under that agreement, subject to protecting other people's data.
10.7 Complain to us at dpo[at@]function365.co.uk. You also have the right to complain to the ICO through its complaints route. Where EU GDPR applies, you may complain to the relevant EU/EEA supervisory authority.
11. Automated decision-making
11.1 We do not use personal data to make solely automated decisions producing legal or similarly significant effects on individuals: Daybeat generates content for Approval, with human approval or approval delegated by a human Owner to an Authorised Agent, and does not independently decide to publish it. The only automated gate affecting a person's account access in this context is a two-factor security lockout after repeated failed verification, which protects the account rather than profiling the person.
12. Children
12.1 Daybeat is offered to businesses and is not directed at children. We do not knowingly seek children's personal data for accounts, and we do not operate an age gate. If you believe a child's data has reached us, contact dpo[at@]function365.co.uk so we can address it, including with the relevant customer where the data is Customer Content.
13. Cookies and browser storage
13.1 The app uses authentication/session cookies, two-factor trusted-device cookies and the referral-attribution cookie daybeat_ref. Optional analytics and advertising technologies, where used, are confined to the marketing site and require your consent through the site's cookie controls. See /cookies.
13.2 Authentication sessions and trusted-device choices support sign-in and security. Trusted-device cookies have a 30-day Max-Age. Staff trust is limited by a seven-day server-side record, so the effective staff trust window is seven days. Following a referral link sets daybeat_ref for 30 days to carry attribution to checkout, unless checkout resolves it sooner. The referral cookie is not needed to stay signed in.
13.3 Strictly necessary cookies are set without consent. Where used, marketing-site analytics and advertising cookies, including technologies managed through Google Tag Manager and Meta pixel, are set only with your consent through the site's cookie controls. The signed-in portal uses local storage for in-progress piece edits and dismissed billing banners, and does not use those advertising technologies. Stripe may set its own cookies on its hosted checkout domain. Google Fonts requests are described in sections 3 and 7 even though they set no cookie.
14. Changes and contact
14.1 We may update this notice at /privacy. The date at the top identifies the version. We will give at least 30 calendar days' notice of a material change by evidenced email to the Owner, received on the next business day unless delivery fails; in-app notice is supplementary. If a change is required sooner by law or a provider change, we will tell you as soon as we can. This does not limit any legal requirement to inform people before processing changes.
14.2 Privacy questions, rights and complaints: dpo[at@]function365.co.uk. General enquiries: info@function365.co.uk. Postal contact: Function 365 Limited, Third Floor, 95 The Promenade, Cheltenham, Gloucestershire, United Kingdom, GL50 1HH.