Privacy Policy
Effective September 24, 2026 · Version 2026-09-24
Daily Log LLC · support@dailylog.com
This Privacy Policy explains what Daily Log LLC (“DailyLog,” “we,” “us”) collects through the DailyLog platform, text-message workflows, APIs, and website (the “Services”), why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it.
If your employer gave you DailyLog, read this first.
Your employer controls the workspace, decides what goes in it, and can see your posts, photos, voice memos, and time entries. We process that information on their instructions. For questions about what your employer collects or how long they keep it, ask them first — but you can always contact us directly at support@dailylog.com and we will help or route you.
1. Our role
For information a company puts into its workspace, that company is the controller (or “business”) and we are the processor (or “service provider”) — we act on their instructions, under our Data Processing Addendum. For our own website visitors, prospects, and account administrators, we are the controller and this policy describes what we do on our own behalf.
2. What we collect
2.1 Information you give us
- Account details: first and last name, email address, mobile phone number, password (stored only as a salted hash — we never see it), company name, time zone, profile picture
- Billing details: plan, subscription status, and billing history. Card numbers go directly to our payment processor; we never receive or store them
- Support correspondence: what you write to us, and our replies
2.2 Content you and your crew upload
- Project, jobsite, client, and schedule records
- Daily log posts, notes, and comments
- Photos and video, including any people visible in them
- Voice memos and video audio, including anyone audible in the recording
- Transcripts and AI captions we generate from that media — this is new information about you that we create, and we treat it as personal information
- Time entries, hours worked, and schedule assignments
- Files and documents you attach
We read the capture timestamp embedded in photos so your gallery and reports can order them by when the picture was actually taken. We do not use GPS coordinates embedded in photos to track people or jobsite locations, and we do not build location profiles.
2.3 Information we collect automatically
- IP address, which we record at sign-up and use to limit automated abuse
- Browser and device type, and pages or features used
- Timestamps of activity within the app, which also form the audit trail on your records
- Text-message delivery and engagement metadata from our messaging provider (delivered, failed, opted out) — we retain these as the record of consent and opt-out
- Strictly necessary cookies for signing in and keeping your session. We do not use advertising or cross-site tracking cookies
2.4 What we ask you not to send
Please do not put Social Security or other government ID numbers, financial account numbers, health or medical records, or biometric identifiers into the Services. We do not want this data, the Services are not designed to hold it, and we are not a HIPAA business associate. We do not perform facial recognition, face matching, or any other biometric identification on photos or video, and we do not extract biometric identifiers from them.
3. Why we use it
| Purpose | What it covers |
|---|---|
| Providing the Services | Hosting your workspace, showing posts and media, generating reports and PDF exports, tracking time and schedules |
| Messaging | Sending update requests, upload links, and schedule notices to crews, and honouring STOP requests |
| AI features | Captioning photos, transcribing voice memos and video, and summarizing project activity — see Section 4 |
| Billing | Taking payment, managing subscriptions, and keeping tax records |
| Support | Answering questions and diagnosing problems you report |
| Security and abuse prevention | Detecting fraudulent sign-ups, rate-limiting, investigating misuse, keeping audit logs |
| Improving the product | Understanding which features are used, in aggregate. We do not use identifiable customer content to train AI models |
| Legal compliance | Meeting our obligations and establishing or defending legal claims |
4. Artificial intelligence — exactly what happens
We want to be specific here, because a general statement would not tell you what you need to know.
- Your content leaves our infrastructure. When you upload a photo, video, or voice memo, we send that content to OpenAI, our AI subprocessor, to generate a caption, transcript, or summary. This is not anonymized and not aggregated — it is the actual photo or recording, which may show or contain the voice of an identifiable person.
- What OpenAI may do with it. We use OpenAI's API under terms that prohibit using our submissions to train their models. OpenAI retains API content only briefly for abuse monitoring and then deletes it.
- What we do with the output. Captions, transcripts, and summaries are stored in your workspace alongside the original media, are searchable, and appear in reports and exports.
- We do not train models on your content. Not our own, not anyone else's. We do not sell or license your content for AI training.
- No automated decisions about people. Our AI describes site conditions. It does not evaluate, score, rank, or make decisions about workers, and nothing it produces has a legal or similarly significant effect on anyone.
- It can be wrong. AI output may be inaccurate or incomplete. Verify before relying on it, and see Section 6 of the Terms of Service.
5. Who we share it with
We share personal information only as described here. Our current subprocessors — the vendors that process data to run the Services — are listed and kept current on our Subprocessors page. Each is bound by contract to protect the data and use it only to provide services to us.
- Within your workspace. Your posts, photos, recordings, transcripts, and time entries are visible to other authorized users of your employer's workspace according to their roles. This is the point of the product, but it is worth stating plainly.
- Subprocessors. Cloud hosting and storage, database, text messaging, payment processing, AI processing, and bot protection. See the Subprocessors page for the current list.
- Professional advisers such as accountants and lawyers, under confidentiality.
- Legal requests. We may disclose information if required by valid legal process, or to protect our rights, safety, or property, or that of others. We review requests for validity and scope, object to overbroad ones, and will notify the affected customer unless legally prohibited.
- Business transfer. If we are acquired or merge, information may transfer as part of the transaction. We will give notice, and the acquirer remains bound by this policy until it is changed with notice to you.
We do not sell your personal information.
We have not sold personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California and other state privacy laws. We do not serve targeted ads and we do not run advertising trackers on the Services.
6. How long we keep it
| Category | Retention |
|---|---|
| Account and profile | Life of the account, then 90 days |
| Customer content (posts, photos, video, voice memos, transcripts, files) | Life of the account, then 90 days — unless your employer deletes it sooner |
| Time entries and schedule records | Life of the account, then 90 days. Wage-and-hour law may require your employer to keep its own copies longer |
| Text-message consent and opt-out records | 4 years from the last message, as the record of consent. Opt-out records are kept indefinitely so an opt-out is never accidentally reversed |
| Billing and tax records | 7 years, as required by tax law |
| Security and audit logs | 12 months |
| Backups | Rolling 35 days, after which deleted data ages out automatically |
We may keep information longer where needed to resolve a dispute, enforce our agreements, or comply with law. Deleting something removes it from the live Services immediately; copies in backups age out on the schedule above.
7. Security
Measures we use include:
- Encryption in transit (TLS) and encryption at rest for our database and file storage
- Passwords stored only as salted hashes — we cannot read or recover them
- Role-based permissions within the application, scoped per company workspace
- Least-privilege administrative access, with separate database roles for the application and administration
- Bot protection on sign-up, and rate limiting on abuse-prone endpoints
- Automated backups and monitoring
No system is perfectly secure and we do not claim otherwise. We are a small company and we improve these controls continuously. Protect your own credentials, remove users who leave your company, and report anything suspicious to support@dailylog.com.
If a breach affects your information, we will notify affected customers and, where required, regulators, without undue delay after confirming it — and in any event within the timeframes required by applicable law. Our notice will describe what happened, what data was involved, what we are doing, and what you should do.
8. Your rights and choices
Depending on where you live, you may have the right to:
- Know and access what personal information we hold about you and how we use it
- Correct inaccurate information
- Delete your personal information, subject to the exceptions below
- Obtain a portable copy in a usable format
- Opt out of sale, sharing, or targeted advertising — we do none of these, so there is nothing to opt out of
- Limit use of sensitive information — we ask you not to send it and do not use it for inferring characteristics
- Not be discriminated against for exercising any of these rights. We will not degrade your service or change your price
- Appeal a decision, if we deny your request
8.1 How to exercise them
Email support@dailylog.com with the subject line Privacy Request and tell us what you want. We will acknowledge quickly and respond within 30 days, or tell you if we need an extension the law allows. There is no charge unless a request is excessive or repetitive.
To protect you, we verify requests against information already in your account. We may ask you to confirm from your account email address. An authorized agent may make a request on your behalf with written proof of authority, and we may still ask you to confirm directly.
8.2 If your employer owns the workspace
Where we process information on a company's behalf, we must forward the request to that company and act on its instructions — we cannot delete an employer's project records at an employee's request. We will tell you when we have routed a request and to whom, and we will help you reach them.
8.3 When we may say no
We may decline all or part of a deletion request where we must keep the information to complete a transaction, comply with law (tax and consent records, for example), detect security incidents, or establish or defend a legal claim. We will tell you which exception applies and why.
8.4 Appeals
If we deny your request, you may appeal by replying with the subject line Privacy Appeal. A different person reviews the appeal and we respond within 45 days with a written explanation. If we deny the appeal, you may complain to your state Attorney General.
8.5 Messaging choices
Reply STOP to any text to stop work messages, or HELP for help. You can also ask your employer or us to update your preferences. We will still send essential account and security notices, which are not marketing.
9. State privacy disclosures
California. In the last 12 months we collected the categories of personal information described in Section 2 — identifiers, customer records, commercial information, internet activity, audio and visual information, employment-related information, and geolocation limited to IP address — for the purposes in Section 3, from the sources in Section 2, and disclosed them for business purposes to the categories of recipients in Section 5. We did not sell or share personal information, and we do not have actual knowledge of selling the personal information of anyone under 16. California residents may exercise the rights in Section 8, including through an authorized agent.
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws: residents have the access, correction, deletion, portability, and opt-out rights in Section 8, and the appeal right in Section 8.4. We do not conduct targeted advertising, sell personal data, or engage in profiling that produces legal or similarly significant effects.
Nevada. We do not sell personal information as defined by Nevada law.
10. Children
The Services are workplace tools for adults. They are not directed to anyone under 18, we do not knowingly collect information from minors, and we ask customers not to add minors as users. If we learn that we hold information about someone under 18, we delete it. Contact us at support@dailylog.com if you believe this has happened.
11. Where information is processed
We operate in the United States and store information there. Some subprocessors may process information in other countries. If you use the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws differ from those in your country.
12. Changes to this policy
We may update this policy. The version and effective date appear at the top of this page. For material changes we will give at least 30 days' notice by email or in-app before they take effect, and we keep a record of which version you accepted. Continued use after the effective date means you accept the updated policy.
13. Contact
Daily Log LLC
For a privacy request, use the subject line Privacy Request so it reaches the right queue.