Privacy Notice · Updated 16 October 2026
Controller and customer responsibilities
For website operation, accounts, support, security, and its own business records, the controller is max.recall information systems GmbH, Künstlergasse 11/1 OG, 1150 Vienna, Austria. Contact privacy@dayharbor.ai or +43 1 2369786 about privacy.
For content processed inside a customer's workspace, that customer normally determines the purpose and acts as controller. max.recall processes it on the customer's documented instructions under the applicable agreement. Contact us for a data-processing agreement and current subprocessor information. This notice provides information; it does not request blanket consent.
Data we process
- Accounts and access: email, username, name, organization, membership, permissions, verification, invitations, authentication, and account preferences.
- Project and commercial content: clients, staff and work contact details, assignments, objectives, tasks, descriptions, notes, schedules, time entries, rates, budgets, purchase orders, quotations, invoices, service sheets, and uploaded images or PDFs.
- Task conversations: message text, author identity snapshots, chosen audiences and recipients, reply references, timestamps, read positions for unread indicators, and named first-read receipts available to message authors within the sharing rules. These workspace conversations are separate from website support enquiries.
- Evidence and AI results: retained source files and fingerprints, extracted facts, suggestions, source references, model information, confirmed allocations, project revisions, and audit events identifying the actor and change.
- Technical and support information: IP addresses, request and session information, timestamps, errors, security records, and messages or files supplied when contacting us. The contact form records your name, email address, subject, and message in our Operations inbox. The conversation also retains staff replies, timestamps, delivery status, and related operational audit events.
Required account fields are needed to establish and secure access. The customer chooses project content and must limit it to information necessary for its work. Do not submit sensitive personal data without a suitable legal basis and safeguards.
Purposes and legal bases
We process information to provide agreed services and respond to pre-contract enquiries (Article 6(1)(b) GDPR where applicable); meet legal duties (Article 6(1)(c)); and administer business accounts, respond to support requests, prevent abuse, secure the service, and defend legal claims (Article 6(1)(f), based on those legitimate interests). For customer-controlled content, processing follows documented customer instructions and the customer's applicable legal basis.
Where an optional activity relies on consent, consent is requested separately and may be withdrawn for future processing without affecting earlier lawful processing. A user's permission to run invoice analysis is a product control; the customer still needs the appropriate legal basis for processing information about other people. Dayharbor's AI suggestions are reviewed by a person and do not themselves make decisions with legal or similarly significant effects.
AI and connected services
OpenAI assistance runs when an authorized user requests it and the service is configured. Quotation intake sends source material for a proposed project structure. Description drafts use current project, objective, and task content; project drafts may also use recent saved descriptions, and project or task drafts can include optional live issue-tracking context. Short-form suggestions use the project name, language, and description. Improving a Jira issue draft sends the current summary and description together with its task, objective, project, and language context. Project-icon generation sends the project description.
Invoice analysis requires explicit consent to send the invoice and relevant project, task, rate, and time-entry data to OpenAI. It can extract fields and propose work matches for an uploaded or connected invoice. Uploading an invoice alone does not call OpenAI. Manual review remains available. The application retains relevant extraction evidence and suggestions for review; users separately confirm accounting allocations.
Time-to-task assessment runs when an authorized delivery editor requests it. It sends the project's objective and task catalogue, currently unassigned recorded-time entries, and confirmed assignment history to OpenAI. This context includes descriptions, source references, person names and identifiers, activity notes, dates, services, and durations. Dayharbor retains assessment results, evidence, and processing metadata, including results with no suggested match. Assessment does not assign time automatically: users separately review and accept task assignments. Manual assignment remains available.
Invoice analysis and time-to-task assessment requests disable provider application-state storage, but this is not a promise of zero provider retention. Provider processing, locations, abuse monitoring, and retention depend on the endpoint, account, and agreed data controls. Check the current OpenAI API data controls before transmitting sensitive content.
Configured issue-tracking connections retrieve live issue context and can create issues using a reviewed summary, description, and Dayharbor task link. Time-tracking connections synchronize recorded time, can create linked customers and projects, and archive active linked source projects when their local project is deleted. Billing connections can create linked customers, retrieve invoice evidence, or create reviewed drafts. Customer creation sends the legal name and, for billing customers, the VAT identifier where supplied. Those providers process data under their applicable contracts and settings. The organization is responsible for authorizing its connections and any onward sharing.
Recipients and international transfers
Data is available to authorized organization members, explicitly permitted client viewers, and service personnel where needed for operation or support. Published client views include planned effort and budget/invoiced totals both excluding and including VAT for work explicitly made client-visible; team names remain separately optional. They do not expose hidden work, internal notes, source records, staff contact details, raw rates, invoice references, or invoice documents.
Client viewers can exchange client-shared messages on published tasks. Internal conversations remain restricted to their authorized audiences; publishing a task does not publish its internal messages. Project access and message audience determine who can read each conversation.
Task-message email notifications start disabled. Addressed staff who enable them and have an email address receive the message body, sender identity, project and task context, and a task link through the configured email-delivery provider.
Recipients may include contracted hosting and infrastructure providers, configured email-delivery providers, OpenAI for requested AI tasks, connected issue-tracking, time-tracking, and billing services, professional advisers, and authorities where required. Processing arrangements depend on the deployment and customer agreement. Request the current subprocessor and hosting details from privacy@dayharbor.ai.
Some providers or their support operations may process data outside the European Economic Area. Where required, transfers must be covered by an applicable adequacy decision, Standard Contractual Clauses, or another lawful mechanism and any necessary supplementary safeguards. Ask us for the arrangements applicable to your deployment and how to obtain a copy of relevant safeguards. No universal EU-only processing or zero-retention commitment is implied.
Retention and deletion
We retain data for the service relationship, documented customer instructions, legal obligations, security, and the establishment or defence of claims. Retention depends on the type and purpose of the record rather than a single period for all data.
Contact conversations are retained as needed to answer the enquiry, provide follow-up support, document the business relationship, and meet applicable retention duties or resolve disputes. Closing a conversation marks it complete; it does not erase the messages. Contact us to request deletion or information about the retention applicable to your enquiry.
Original quotation and invoice PDFs, service sheets, and their links are retained as source evidence. Project or membership deletion can leave audit events, actor identity snapshots, project history, and accounting evidence intact. Those retained records are not automatically erased by removing a live item. Business records subject to legal retention, incident records, backups, and dispute records may need to remain longer than ordinary active data.
Contact us for deletion, export, or retention instructions that go beyond application controls. External provider copies, files already downloaded, and source-system records follow their own retention arrangements. An application deletion does not erase them.
Browser storage
Dayharbor uses session and security cookies for sign-in and request protection. Browser local storage remembers your chosen Classic or Paper appearance and whether this browser has successfully established an application session, which changes the public entry label from “Sign in” to “Open Dayharbor” without storing account details. Inside the application, local storage also remembers preferences such as presentation density, selected workspace or project, and filters. These preferences remain until changed or cleared in the browser. Session and security storage follows the relevant session or expiry controls.
The public pages do not include advertising trackers, analytics scripts, embedded maps, or remote font services. Fonts and brand assets are served with the application. The contact form sends your details to Dayharbor only when you submit it; necessary request-protection cookies may be used. Contact links open your email or telephone application. External links are only contacted when followed.
You can clear or block browser storage in your browser settings. Clearing preferences resets them; blocking necessary session storage can prevent sign-in. Optional invoice-analysis consent is requested in its own workflow and is not inferred from using this website.
Security and your rights
We use access controls, organization separation, protected credentials, and audit information to secure the service. Customers must protect their devices, invitations, credentials, permission choices, source files, and exports. Report suspected unauthorized access or a vulnerability to security@dayharbor.ai.
Subject to applicable conditions, you can request access, correction, erasure, restriction, or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. For information within a customer's workspace, contact that customer first; we assist it as required. For our own account, website, or support processing, write to privacy@dayharbor.ai. We may need to verify identity or authority.
You can complain to the supervisory authority where you live, work, or believe an infringement occurred. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna; dsb@dsb.gv.at, +43 1 52 152-0, dsb.gv.at. The GDPR describes the applicable rights and conditions.
Changes and contact
This notice is versioned independently from the Terms of Service. We update it when the service or relevant processing changes and communicate material changes as required. For privacy, hosting, transfer, or data-processing questions, contact privacy@dayharbor.ai.