Daylyf Privacy Policy
Last updated: 22 Aug 2026
Data Controller: Daylyf Ltd Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom Company number: 17374540 (registered in England and Wales) ICO registration number: ZC210969 Contact: privacy@daylyf.com
1. Who we are
Daylyf is a UK-based marketplace that lets verified guests book private homes and spaces by the hour for daytime use only. Daylyf is strictly day-use; overnight stays are not permitted. This Privacy Policy explains what personal data we collect when you use our mobile app, what we do with it, who we share it with, and the rights you have under the UK GDPR and EU GDPR.
By creating a Daylyf account or using the Daylyf app, you agree to this Privacy Policy. If you do not agree, please do not create an account.
2. The data we collect
2.1 Account & profile data
| Data | Source | Purpose |
|---|---|---|
| Name, email, password (hashed) | You, via signup | Account creation, sign-in |
| Phone number | You | SMS verification, host/guest coordination |
| Profile photo | You, via camera or library | Trust signal on your profile |
| Account role (guest / host / admin) | Daylyf | Determines features available to you |
| Verified flags (email, phone, ID, proof of address) | Daylyf systems + Didit | KYC and Booking Access Gate |
2.2 Identity verification (Tier 1 KYC)
We use Didit as our identity verification processor to confirm your government-issued ID and run a liveness check. You complete verification in Didit's hosted flow inside the Daylyf app.
Daylyf does not use Stripe Identity for Tier 1 ID verification. Stripe is used for payments and host payouts (see Section 2.7). Hosts who connect a bank account also complete Stripe Connect's own identity and bank checks so Stripe can pay them out — that is separate from Didit.
What Didit stores and processes
Didit (as our processor, under their privacy policy and Data Processing Addendum) collects and processes:
- Photos of your ID document (passport, driving licence, or national ID — front/back where applicable)
- Selfie / liveness capture and face-match analysis
- Document metadata (type, issuer, expiry, extracted name fields)
- Verification session logs and the automated verification decision
Didit's privacy policy is published at https://didit.me/legal/privacy-policy.
What Daylyf stores
Daylyf applies data minimisation: we do not copy ID images or liveness video into Daylyf storage when Didit approves you. We store only what we need to operate the marketplace and meet audit obligations:
| Data held by Daylyf | Purpose |
|---|---|
| Verification outcome (approved / rejected / pending) | Trust badges, booking access gate |
| Verified ID flag and verification timestamps | Fraud prevention, audit trail |
| Legal name bound at verification time | Must match ID; locked after approval |
| Didit session reference | Support, disputes, ICO or regulator requests |
| Webhook audit events (event ID, status, time) | Idempotent processing and compliance trail |
What Daylyf does not store from the Didit flow
- ID document images (front/back)
- Selfie / liveness video or biometric templates
- Full OCR extracts from your document
If we need to evidence a verification for a dispute, Subject Access Request, or regulatory request, we may retrieve a compliance report from Didit using the session reference — without routinely copying those files into Daylyf systems.
Retention split
| Location | What | How long |
|---|---|---|
| Daylyf (Supabase) | Outcome flags, session ID, name binding, webhook audit | While your account is active; deleted or anonymised when your account is erased (see Section 6) |
| Didit (processor) | ID images, liveness media, extracts, session decision | Per retention configured in our Didit Business Console (aligned to our needs — typically up to 5 years) |
When you exercise erasure rights, we delete or anonymise Daylyf-held verification fields and request deletion of the Didit session where their terms and our legal obligations allow.
Special category data: facial images and liveness data may be special category data under UK GDPR Article 9. We process this data on the basis of your explicit consent in the Didit flow and, where applicable, substantial public interest in preventing identity fraud.
2.3 Tier 2 verification (proof of address)
If you choose to upload proof of address (utility bill, council tax, bank statement) for a Tier 2 trust badge, we store the document in encrypted Supabase Storage. Only Daylyf admins reviewing your submission can read it. Approval status is host-visible; the document itself is not.
2.4 Host lawful right to host (compliance vault)
After Tier 1 ID verification, hosts must upload evidence of lawful authority to list:
- Ownership title / deed (owners), or
- Signed lease plus written landlord permission (tenants), or
- Written agent authority (authorised agents)
We store these files in an encrypted document vault. Only Daylyf admins reviewing the submission can read them. Approval status is used for host listing eligibility; the documents themselves are not shown to guests.
2.5 Listing data (hosts)
Hosts upload property titles, addresses, descriptions, amenities, prices, house rules, capacity, check-in instructions, and live-captured room photos (gallery uploads are blocked). We extract photo EXIF metadata, compute a SHA-256 hash of each photo for chain-of-custody, and use server-side checks (including independently re-hashing the stored file) to verify each photo was captured live, for fraud-prevention purposes.
Hosts must also upload property safety certificates for each listing (gas safety / no-gas declaration, EPC, electrical safety / EICR, and fire safety evidence). These files are stored in a private document vault and are visible only to the host and Daylyf admins reviewing the listing. Guests do not see the documents.
2.6 Booking & messaging data
| Data | Stored where | Why |
|---|---|---|
| Booking time slot, party size (adults, children, pets) | Daylyf booking records | Service delivery |
| Pet type when applicable | Daylyf booking records | Host preparation |
| Vehicle registration (if parking) | Daylyf booking records | Host parking control |
| Guest and host chat messages | Daylyf messaging records | In-app coordination |
| Enquiries (pre-booking questions) | Daylyf enquiry records | Pre-booking screening |
2.7 Optional arrival / check-in photos
If you choose to capture arrival photos when you visit a booked space, Daylyf captures:
- A live photo from your device camera (not gallery), watermarked with your booking code, the capture time, and coordinates
- Whatever EXIF metadata your device attaches to the photo (typically a timestamp)
- Coarse geolocation, checked against the listing's location to help protect you and the host if a dispute arises
- A SHA-256 integrity hash, which Daylyf independently re-computes from the stored file to confirm it was not altered after capture
Arrival photos and opening Active Stay are recommended for your protection but are not required to complete a booking. If you skip them, we do not capture this photo data for that visit.
When captured, this data is retained for the duration of your stay plus 90 days for dispute resolution, then deleted.
2.8 Payment & payout data (Stripe)
We use Stripe Payments and Stripe Connect Express to process guest payments and host payouts.
| What | Who processes it | What Daylyf stores |
|---|---|---|
| Guest card / payment method | Stripe | Stripe customer / PaymentIntent / Checkout references, amount, currency, status — never full card numbers |
| Host bank details & payout KYC | Stripe Connect (hosted onboarding + Express Dashboard) | Stripe connected-account ID and onboarding / payout readiness status |
| Platform fee (13% of booking) | Stripe (application fee on the charge) | Fee amount on the booking / payment record |
| Refunds, disputes, chargebacks | Stripe + Daylyf support | Dispute / refund outcome references |
When you pay for a booking, you may be redirected to Stripe Checkout or a Stripe-hosted payment page. When a host links payouts, they are redirected to Stripe-hosted Connect onboarding and may later open the Stripe Express Dashboard to manage bank details and identity information Stripe requires.
Stripe's privacy policy: https://stripe.com/privacy Stripe Connected Account Agreement: https://stripe.com/connect-account/legal
2.9 Device & technical data
- Device type, OS version, app version
- Push notification token (Expo Push)
- IP address (from your device when calling our backend)
- Login country — when you sign in, we derive the country your request came from to help detect suspicious account access. We store only the country (never the IP address used to determine it), and we keep these login-country records for 90 days.
- Language, locale, timezone
- App crash logs and basic error diagnostics (Sentry)
2.10 AI-assisted features
If you use AI Auto-Generate (descriptions, pricing suggestions, local guides), we send the input you provide (e.g. property title, amenities) plus minimal context to OpenAI. We do not send your name, email, ID document, or chat conversations. OpenAI's data handling: https://openai.com/policies
2.11 What we do not collect
- We do not sell personal data.
- We do not run third-party advertising trackers inside the app.
- We do not access your contacts, calendar, microphone, or photo library without an explicit OS-level prompt and a clear in-app reason.
- We do not record audio.
3. Why we process your data (lawful bases under UK GDPR Article 6)
| Purpose | Lawful basis |
|---|---|
| Creating and securing your account | Contract (Art. 6(1)(b)) |
| Verifying your identity (KYC) | Legal obligation + Legitimate interest in fraud prevention (Art. 6(1)(c) and (f)) |
| Processing bookings and payouts | Contract |
| Sending transactional emails (booking confirmations, password reset) | Contract |
| Sending marketing emails | Consent (Art. 6(1)(a)) — opt-in only, opt-out always available |
| Detecting fraud, abuse, account takeover | Legitimate interest |
| Complying with court orders, regulatory requests | Legal obligation |
4. Who we share data with (sub-processors)
We use the following processors. Each is bound by GDPR-compliant Data Processing Addenda.
| Processor | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase (Supabase Inc.) | Database, auth, storage, realtime | Account, listing, booking, messaging data | EU/US (configurable) |
| Didit | Tier 1 ID verification / liveness (processor) | ID document images, selfie/liveness, extracted name fields, session decision — stored by Didit, not in Daylyf vault | Per Didit DPA (SCCs / UK IDTA as applicable) |
| Stripe Payments / Connect | Guest payments, refunds/disputes, host Connect Express onboarding & payouts | Card data, billing details, host bank/payout KYC (held by Stripe); Daylyf holds only Stripe IDs and transaction outcomes | Global (with SCCs / UK IDTA as applicable) |
| Resend | Transactional email | Email address, message content | US (with SCCs) |
| Cloudflare Turnstile | Bot/CAPTCHA defence at signup & login | Challenge token, IP | Global edge |
| OpenAI | Optional AI copy / pricing suggestions | Listing inputs you provide | US (with SCCs) |
| Expo / EAS Push | Push notifications | Device push token, message body | US |
| Sentry | Crash reporting & error monitoring | Device/OS info, app version, crash stack traces, non-payment error context | US/EU (with SCCs) |
| Apple App Store / Google Play | App distribution | Subject to platform privacy | Global |
We do not share personal data with anyone else except where legally required (court orders, law enforcement requests with valid legal basis).
5. International data transfers
Some of our processors are located outside the UK / EEA (notably Stripe, Didit where applicable, OpenAI, Resend). When we transfer your data outside the UK / EEA, we rely on:
- The UK Adequacy Regulations where they apply (e.g. EU member states), or
- Standard Contractual Clauses (SCCs) with the UK International Data Transfer Addendum, or
- Other appropriate safeguards under UK GDPR Article 46.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account & profile | While your account is active + 30 days after deletion request |
| KYC outcome & Didit session reference (Daylyf) | While your account is active; deleted or anonymised when your account is erased |
| KYC ID images & liveness (Didit, as processor) | Per Didit retention policy in Business Console (typically ≤5 years, aligned with Daylyf) |
| Tier 2 proof-of-address uploads (Daylyf encrypted storage) | While account active + retention per trust/AML policy after review |
| Host lawful-right uploads (Daylyf encrypted vault) | While account active + retention per trust / dispute policy after review |
| Property safety certificates (Daylyf private vault) | While listing active + retention per safety / dispute policy after delist |
| Booking & payment records | 7 years (UK tax / accounting law) |
| Messages between guest and host | 2 years after the booking ends |
| Check-in photos & EXIF | 90 days after stay ends |
| Marketing email opt-in record | Until you opt out, then 12 months proof-of-consent |
| Login-country records | 90 days |
| Server logs / IP / device data | 90 days |
After these periods, data is deleted or irreversibly anonymised.
7. Your rights under UK / EU GDPR
You have the right to:
- Access the personal data we hold about you ("Subject Access Request").
- Rectify inaccurate data (most fields you can edit yourself in-app).
- Erase your data ("right to be forgotten") — see Section 8 below.
- Restrict or object to processing.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time (e.g. unsubscribe from marketing).
- Lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/
To exercise any of these rights, email privacy@daylyf.com. We respond within 30 days.
8. How to delete your account
You can delete your Daylyf account at any time:
- In the app: Profile → Legal & Account → Delete my account.
- By email: privacy@daylyf.com from your registered address.
Deletion removes your profile, avatar, listings (if no active bookings), enquiries, chat messages, and your KYC outcome fields (deleted or anonymised at the same time). We retain a minimal legally-required footprint — booking and payment records — for up to 7 years as required by UK law.
If you have active or upcoming bookings as a guest, you must cancel them before deletion. If you are a host with active bookings, you must complete or cancel them first. Daylyf will not silently void a counterparty's reservation.
Your in-app deletion flow is enforced and irreversible after a short cooling-off window.
9. Cookies & similar technology
The Daylyf mobile app does not use cookies in the traditional web sense. Our marketing and legal websites at daylyf.com use a small number of strictly-necessary and analytics cookies — see our separate Cookie Policy.
10. Security
We protect your data with:
- TLS encryption in transit, AES at rest (Supabase managed)
- Row-Level Security on every database table
- Role-based access controls and JWT verification on every API call
- Cloudflare Turnstile bot defences on signup and login
- Per-user rate limits on sensitive endpoints (Didit identity sessions, AI suggestions)
- Account lockouts after repeated failed sign-in attempts
- Forensic camera capture (no gallery upload) to deter fake listings
- Separate encrypted storage buckets for KYC and proof-of-address documents
No system is perfectly secure. If we ever experience a personal data breach affecting your data, we will notify the ICO within 72 hours and notify affected users without undue delay.
11. Children
Daylyf is not directed to children under 18. We do not knowingly collect data from anyone under 18. Children may appear in a booking party (as "Children" count and to sit on the booking record) but the booking and account holder must be 18+.
12. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of the document reflects the most recent change. Material changes will be notified in-app and by email at least 14 days before they take effect.
13. Contact
- Privacy questions: privacy@daylyf.com
- Data protection contact: privacy@daylyf.com
- Postal address / registered office: Daylyf Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
- Company number: 17374540
- ICO registration number: ZC210969
- ICO complaints: https://ico.org.uk/make-a-complaint/