Privacy policy

Last updated 7 October 2026

The short version: we collect what we need to run your account, we keep it in Europe, we don’t sell it, we don’t use advertising or tracking, and you can download or delete everything whenever you like.

Who we are

TheDayRate is run by Ben Campbell, trading as TheDayRate in Northern Ireland (“we”, “us”). We decide how your personal information is used, so under UK data protection law we’re the “controller”. If you have any questions about your information, email hello@thedayrate.com.

What we collect, why, and our legal reason

What	Why	Legal reason
Your name and email address	To create your account, sign you in, and send you emails about your account, such as sign-in links and password resets.	Contract: we need it to give you an account.
Your password	To sign you in. We only store a scrambled version (a “hash”) that can’t be turned back into your password.	Contract.
Your Google or Microsoft details, if you choose to sign in with one	To recognise you. We receive your name, email address, profile picture and an account ID, plus sign-in tokens that we don’t use to read anything else in your Google or Microsoft account.	Contract.
What you put into TheDayRate: your business details, bank details, clients and their contact details, invoices, expenses, trips and settings	That’s the service. We store it so you can see and use it on any device.	Contract.
Your IP address, device and browser when you sign in, and a count of recent sign-in attempts	To keep accounts secure: to slow down anyone guessing passwords, and to show you where you’re signed in.	Legitimate interests: keeping your account and the service secure.
If you were invited: your email, who invited you and when	So you can create an account while TheDayRate is invite-only.	Legitimate interests: running an invite-only early version.
Your email address, if you join the waitlist	To confirm you’re on the list and to tell you when TheDayRate opens.	Consent. You can leave the list at any time.

You need to give us your name and email address to have an account. Everything else you add is up to you.

Most of this comes from you. If you sign in with Google or Microsoft, some comes from them. If you were invited, your email address came from the founder who invited you.

If you add your clients’ details, such as a contact name and email for invoices, we store them only so you can invoice those clients. You’re responsible for having a good reason to keep them, as you would in any accounts system.

When you choose a new password, we check it hasn’t appeared in a known data breach using the Have I Been Pwned service. Only the first five characters of a scrambled version of the password are sent, so neither the password nor anything that identifies you leaves TheDayRate.

Who else handles it

We use a small number of companies to run TheDayRate. They act on our instructions under data processing agreements, and only use your information to provide their service to us.

Who	What they do	Where
Cloudflare, Inc.	Hosts the website and the database your account and data are stored in. It also sees your IP address when you visit, to deliver and protect the site.	Your account and data are stored in Western Europe. Cloudflare is a US company and its network is worldwide.
Resend (Plus Five Five, Inc.)	Sends our emails, such as sign-in links, password resets, invites and waitlist confirmations. It keeps a short record of the emails it sends.	United States.
Google or Microsoft	Only if you choose to sign in with them.	Under their own privacy policies.

Where your information is handled outside the UK, it’s protected in the ways UK law requires. Cloudflare and Resend are certified under the UK Extension to the EU–US Data Privacy Framework, and also sign standard contractual clauses with the UK Addendum.

We never sell your information, and we don’t share it with advertisers. We’d only share it with anyone else if the law required us to.

Cookies and storage on your device

We use one cookie, to keep you signed in. It’s needed for the service to work, so we don’t ask for consent. There’s no advertising, analytics or tracking of any kind.

Your choice of light or dark mode, colour and spacing is saved in your browser, not on our servers.

How long we keep it

Your account and everything in it: for as long as you have an account. If you delete your account, it’s deleted straight away, and copies in our database’s recovery history are gone within 30 days.
Sign-in records (device, browser and IP address): until you sign out or they expire, at most 30 days after you last use them. Counts of sign-in attempts are deleted after a day.
Links we email you (sign-in, confirmation and reset links): they stop working after 10 minutes to 24 hours, and are then deleted.
Invites: until you join, or until we take the invite back.
The waitlist: until TheDayRate opens, or sooner if you ask us to remove you.

Keeping invoices and business records for HMRC is your responsibility. Download a backup from Settings before deleting your account if you need to keep them.

Keeping it safe

Everything travels over an encrypted connection. Passwords are stored as hashes, never as text. Each person can only ever reach their own data, and repeated wrong passwords are slowed down. If something ever went wrong that put your information at risk, we’d tell you and, where the law requires it, the Information Commissioner’s Office.

Your rights

You have the right to:

see the information we hold about you
have it corrected if it’s wrong
have it deleted
take a copy with you, in a format other software can read
ask us to stop or limit using it
object to us using it for our legitimate interests
withdraw your consent, for example by leaving the waitlist

You can do most of this yourself in Settings: change your details, download a backup of everything, or delete your account. For anything else, email hello@thedayrate.com and we’ll reply within a month. We don’t make decisions about you by automated means that have legal or similarly significant effects.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.

Children

TheDayRate is for people running their own business. It isn’t meant for anyone under 18, and we don’t knowingly collect information about children.

Changes to this policy

If we change this policy in a way that matters, we’ll email you before it takes effect. The date at the top shows when it last changed.