Last Updated: 5 October 2026

This Privacy Policy describes how Daysync PTY LTD ("Daysync", "Company", "We", "Us", or "Our"), a company registered in Western Australia, Australia (ABN: 16 677 972 333), with its registered office at Level 4, 172 St Georges Terrace, Perth 6000, WA, Australia, collects, uses, discloses, and protects Your personal information when You use our website at https://www.daysync.com, our web application at https://app.daysync.com, our help centre at https://help.daysync.com, our feedback and roadmap portal at https://feedback.daysync.com, our mobile applications (iOS and Android), our desktop application, and all related services (collectively, the "Service").

By using the Service, You acknowledge that You have read and understood this Privacy Policy. If You do not agree with Our practices, please do not use the Service.

We use cookies, web beacons, pixels, and similar technologies to collect information about Your use of the Service. Please refer to Our Cookie Policy for detailed information.

When You use the Tour Chat feature, We collect and process:

We process Your Personal Data for the following purposes and on the following legal bases:

Daysync does not use chat content, attachments, or any other User Content to train artificial intelligence or machine-learning models, whether internally or via any third party.

This commitment applies to Our own processing and to processors acting on Our behalf. It does not extend to a third-party application or AI client that You choose to connect under section 4.5. Where You authorise such a connection, data within the scopes You grant is transmitted to that provider at Your direction, and whether that provider retains that data or uses it to train its models is governed by that provider's own terms, not by this Policy.

We do not sell Your Personal Data to third parties.

We may share Your Personal Data with the following categories of recipients:

We engage trusted third-party service providers who process data on Our behalf, including:

All service providers are contractually bound to process data only as instructed by Us and to maintain appropriate security measures.

If You are part of a team or organisation on Daysync, certain data (such as schedule details, event information, and Your name) may be visible to other authorised members of Your team.

Tour Chat visibility. In Tour Chat: messages in the tour-wide chat and in public channels are visible to all members of that tour; messages in private channels, user-created group chats, and direct messages are visible only to the participants of that conversation. Org administrators of a tour can read content in the tour-wide chat, public channels, and any channel they manage, and can delete messages in channels they manage. Org administrators cannot read direct messages or private channels they are not a member of. Daysync employees may access chat content for the limited purposes described in section 7.4 (Chat Encryption and Access).

Reports. If You submit a report about a message in Tour Chat, the report (including Your identity as the reporter, the reported message and any attachments, and surrounding context) is shared with both Daysync's moderation team and the org administrators of the tour in which the message was sent. Reports are not anonymous to org administrators.

Profile visibility. Other participants in Tour Chat can see Your name, role, and profile picture as displayed on Your account.

We may disclose Your data if required to do so by law, regulation, legal process, or governmental request, or if We believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect Our rights or property; (c) prevent fraud or security threats; or (d) protect the safety of Users or the public. Where We are required to report child sexual abuse material under applicable law (including, without limitation, 18 U.S.C. §2258A in the United States and the Online Safety Act 2021 (Cth) in Australia), We will do so and will preserve and provide the relevant material to the competent authority.

In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of assets, Your Personal Data may be transferred as part of that transaction. We will notify You of any such change and any choices You may have regarding Your data.

4.5.1. Nothing is transmitted unless You connect it. We do not transmit Your data, or data belonging to Your organisation, to any third-party application, integration, AI assistant, AI agent, or other client unless and until You — or an administrator of Your organisation — actively connect that application and complete the authorisation step. No integration is enabled by default, and We do not transmit data to any such application on Our own initiative.

4.5.2. What You authorise. When You connect an application, You are shown the categories of data it is requesting ("scopes") and You choose which of them to grant. We transmit only data falling within the scopes You grant, and only data that Your own Daysync account is already permitted to access. Connecting an application never widens Your own access.

4.5.3. What may be transmitted. Depending on the scopes You grant, this may include: tour and day records; schedule items; venue, accommodation and room records and their associated contacts; guest list entries, including the names and details of guests; bulletins; tags and custom fields; organisation and tour member information; files and attachments; and message history from the tour-wide chat, public and private channels, and group chats. Direct (1:1) messages are never transmitted to a connected application.

4.5.4. Your authority, permission, and consents. By connecting an application, You represent and warrant to Us that:

You must not connect an application if You cannot give each of these warranties, and You must disconnect it promptly if any of them ceases to be true. You are solely responsible for Your decision to connect an application and for the consequences of the resulting disclosure.

4.5.5. The provider is independent of Us. A provider You connect receives data as an independent recipient and, where applicable law uses that concept, as a separate data controller in its own right — not as Our processor or service provider. Its handling of that data is governed by its own terms and privacy policy, not by this Policy. We do not control, and are not responsible for, how a connected provider uses, stores, retains, discloses, or further transmits that data, including whether it uses that data to train artificial intelligence or machine-learning models. You should read a provider's terms and privacy policy before connecting it.

4.5.6. Disconnection. You may disconnect a connected application at any time through Your account settings, through the provider's own controls, or by contacting Us at [email protected]. We may also suspend or revoke any connection at any time. Disconnection stops further transmission but does not recall, delete, or otherwise affect data already transmitted. Any request to delete data already held by a provider must be made to that provider.

4.5.7. Records We keep. We record connection events, the identity of the connecting application, the scopes granted and withdrawn, and the calls made through a connection, for security, abuse prevention, troubleshooting, and audit purposes. We retain these records in accordance with section 6.

4.5.8. Organisation administrators. Where an administrator connects an application on behalf of an organisation, the administrator does so for and on behalf of that organisation, the warranties in 4.5.4 are given by both the administrator and the organisation, and the organisation is responsible for the resulting disclosure.

4.5.9. Our role. To the extent a disclosure under this section 4.5 is made on Your instruction and for purposes You determine, You (or Your organisation) determine the purpose and means of that disclosure. The description of Daysync as Data Controller in section 1 does not extend to a connected provider's subsequent processing of data transmitted at Your direction.

5.1. Daysync is based in Australia and Tour Chat data is hosted in Amazon Web Services data centres in the Sydney region. Your data may be transferred to, and processed in, countries other than Your country of residence, including Australia and (for limited purposes such as analytics and push notification delivery) the United States and the European Union.

5.2. Where We transfer Personal Data from the EU/EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, We rely on appropriate safeguards including:

5.3. For transfers from Australia, We comply with Australian Privacy Principle (APP) 8 by taking reasonable steps to ensure overseas recipients handle Your data consistently with the Australian Privacy Principles.

5.4. You may request a copy of the applicable transfer mechanism by contacting Us at [email protected].

5.5. Transfers through an integration You connect. Where You connect an application under section 4.5, the provider of that application may store and process the transmitted data in any country in which it or its own providers operate, which may include the United States and other countries outside Australia and outside Your country of residence. That transfer is made on Your instruction and under Your authorisation, within the scopes You granted. We do not impose, and are not able to impose, the safeguards described in 5.2 and 5.3 on a provider with which We have no contractual relationship, and those safeguards do not apply to it.

5.6. Before connecting an application, You are responsible for satisfying Yourself that the resulting transfer is lawful in Your jurisdiction, and for putting in place any transfer mechanism required between You (or Your organisation) and that provider.

6.1. We retain Your Personal Data for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

6.2. General retention periods:

6.3. When Personal Data is no longer needed, We will securely delete or anonymise it using industry-standard methods.

7.1. We implement appropriate technical and organisational measures to protect Your Personal Data against unauthorised access, alteration, disclosure, or destruction, including:

7.2. While We strive to protect Your Personal Data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7.3. In the event of a data breach that poses a risk to Your rights and freedoms, We will notify the relevant supervisory authority and affected individuals in accordance with applicable data protection laws (within 72 hours for GDPR, or as otherwise required).

7.4. Chat Encryption and Access. Chat messages, attachments, and reports are encrypted in transit using TLS 1.2 or higher and at rest using industry-standard storage encryption. Messages are stored on Our servers in a form that is readable by Daysync for the limited purposes of operating the Service, providing user support at Your request, debugging, and content moderation. Daysync does not provide end-to-end encryption for Tour Chat. Daysync employee access to chat content is restricted to authorised personnel, is logged, and is permitted only where (a) You have asked Daysync support for assistance, (b) Our engineers need to investigate a defect or incident, or (c) a moderation review is required following a report. If You require end-to-end encrypted communication, You should use a service designed for that purpose.

Depending on Your jurisdiction, You may have some or all of the following rights regarding Your Personal Data:

If You are in the EU/EEA or UK, You have the right to:

To exercise these rights, contact Us at [email protected]. We will respond within 30 days (extendable by a further 60 days for complex requests). Note that, in respect of chat messages, the right to erasure may be subject to limitations where messages form part of a conversation involving other participants, in which case We may retain message content while removing or anonymising Your authorship.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/11855174331

Supervisory Authority: You have the right to lodge a complaint with Your local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the UK, contact the Information Commissioner's Office (ICO) at https://ico.org.uk.

We provide you with an easy way to submit us privacy related request like a request to access or erase your personal data. If you want to make use of your data subject rights, please visit our Trust Center: https://app.prighter.com/portal/11855174331

If You are in Australia, You have the right to access Your Personal Data held by Us, request correction of inaccurate data, and complain to the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au.

If You are a California resident, You have the right to: know what Personal Data We collect; request deletion; request correction; opt-out of sale/sharing (We do not sell or share Personal Data as defined under CPRA); non-discrimination for exercising rights; and limit use of sensitive Personal Information.

To exercise Your CCPA/CPRA rights, contact Us at [email protected].

If You are in Brazil, You have rights under the Lei Geral de Proteção de Dados (LGPD) including access, correction, anonymisation, portability, deletion, information about sharing, and the ability to revoke consent. Contact Us at [email protected].

If You are in South Africa, You have the right to access, correct, and delete Your Personal Data under the Protection of Personal Information Act (POPIA). Contact Us at [email protected].

If You are in Canada, You have the right to access and correct Your personal information under PIPEDA and applicable provincial legislation. Contact Us at [email protected].

9.1. The Service, including Tour Chat, is intended for users aged 18 and over. We do not knowingly collect or process Personal Data from individuals under the age of 18.

9.2. If We become aware that We have collected Personal Data from a user under 18, We will take steps to suspend the account and delete the data promptly.

9.3. If You are a parent or guardian and believe Your child has provided Us with Personal Data, please contact Us at [email protected].

The Service may contain links to third-party websites or services not operated by Us. We are not responsible for the privacy practices of these third parties. We encourage You to review the privacy policies of any third-party services You access through the Service.

11.1. With Your consent (where required by law), We may send You promotional emails about new features, special offers, or other information we think You may find interesting.

11.2. You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email, updating Your preferences in Your account settings, or contacting Us at [email protected].

11.3. Even if You opt out of marketing communications, We may still send You essential transactional and service-related messages.

12.1. We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on You. If this changes, We will update this Privacy Policy and provide appropriate notice and opt-out mechanisms.

12.2. Where You connect an AI assistant, agent, or similar application under section 4.5, any output, suggestion, summary, or recommendation it produces is generated by that third-party provider and not by Us. We do not use such output to make decisions about You.

12.3. Output generated by a connected application may be inaccurate, incomplete, out of date, or misleading. You remain responsible for reviewing it before relying on it, and for any action taken in the Service through a connected application.

13.1. We may update this Privacy Policy from time to time. We will notify You of material changes by posting the updated policy on the Service, updating the "Last Updated" date, and sending an email notification at least 30 days before the changes take effect.

13.2. Your continued use of the Service after the effective date constitutes Your acceptance of the updated Privacy Policy. If You do not agree, You should discontinue use of the Service.

Daysync has appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with this Privacy Policy and applicable data protection laws.

EU, UK and Swiss data subjects may contact our DPO and exercise Your data subject rights through our appointed privacy representative, Prighter Group, at: https://app.prighter.com/portal/11855174331

All other data subjects may contact our DPO by email at [email protected] or by post to: Daysync PTY LTD, Level 4, 172 St Georges Terrace, Perth 6000, WA, Australia.

If You have any questions, concerns, or requests regarding this Privacy Policy or Our data practices, please contact Us: