Privacy Policy

Effective date

2026-10-13

Who operates DayRate

DayRate is operated by Mauricio Quito as an individual, who is responsible for DayRate’s handling of personal information described here. For privacy questions or data requests, contact privacy@trydayrate.com.

Data used to run DayRate

DayRate processes account and workspace identity, membership and settings, and the business information users enter or generate. That may include client and contact details, projects, Bookings and work dates, Quotes, Proposals, Retainers, Invoices, payments, receipts, related documents, and communications. It also handles service and security records needed to operate the product. Some of this information may be commercially sensitive; workspace access is limited by the roles and permissions configured in DayRate.

Site use and document activity

DayRate uses sign-in and other first-party session or preference storage needed for the service. Public Quote and Proposal responses may record the name, email, message, user agent, and referrer a visitor provides or sends. Public Invoice and Receipt views or downloads may record a user agent, referrer, and shortened IP-derived hash. An optional Invoice engagement feature uses a random first-party pseudonymous context to group activity. These records support document workflows, security, and service operation; the IP-derived hash is not anonymous. DayRate does not currently change this collection in response to a browser Do Not Track signal. The current application code does not install a third-party cross-site advertising tracker; service providers may receive technical request information to deliver their services.

Optional Google Calendar connection

The Google Calendar connection is optional and limited to explicitly authorized beta accounts. The following applies when the feature is enabled for your account. If you choose Connect Google in DayRate Settings, Google asks you to authorize identity information (openid and email) and read access to your calendar list (calendar.calendarlist.readonly). Initial connection does not request permission to read or write events. When Booking export becomes available and you explicitly choose Authorize Booking export, DayRate requests the additional calendar.events.owned permission. That permission covers reading, creating, changing and deleting events on calendars you own broadly; DayRate restricts its use to managed Booking copies and does not import unrelated events. DayRate uses Google's stable account identifier (sub) to associate the connection with your DayRate user. A verified email claim becomes a masked display hint only; email is not the identity key.

DayRate reads calendar-list identifiers, names, time zones and ownership status so you can deliberately select an owned destination. Connecting Google or choosing a destination does not start export. Booking export and synchronization remain disabled during initial connection acceptance and require separate enablement. Google authorizations in the current External/Testing phase expire after seven days, including offline refresh credentials; reconnection may be required.

What DayRate sends to Google

During an enabled connection flow, DayRate communicates with Google to obtain your authorization, verify your Google account and read your owned-calendar list. Booking export and background synchronization are not enabled during initial connection acceptance. DayRate does not send your Bookings, client or project names, rates, invoice details or private notes to Google as part of that connection test.

Google's owned-events permission is requested only through the separate Booking export consent step. Completing that consent still leaves export off until you explicitly enable it in Settings. Any later export release requires separate feature enablement and disclosure of the operations and data involved. DayRate remains the authority for its business records.

Where Booking export is enabled, DayRate sends the work dates or scheduled times needed for its managed event copies. Event titles default to “DayRate Booking.” If you explicitly choose “Project name,” the title contains the Booking’s saved project-name text; an empty name falls back to “DayRate Booking.” Review this text for confidential information before sharing it. DayRate does not add client records, rates, invoices, payment details or internal notes to these events. Copies remain private, with no attendees or reminders, and Google edits do not change DayRate business records.

Connection storage and security

When the optional connection is enabled, DayRate stores the Google account identifier, masked account hint, granted permissions, owned-calendar metadata and your destination/export settings. The private Calendar service encrypts each Google refresh credential separately using envelope encryption backed by AWS KMS before storing the encrypted credential in the Calendar database. That service uses the credential to obtain temporary access for the connection functions you authorize. The public DayRate web process does not receive the plaintext refresh credential. DayRate uses access controls and encrypted transport and storage to reduce exposure; these safeguards are not a promise of absolute security.

Your controls and disconnect

When the connection is enabled for your account, Settings lets you review its status, choose an eligible owned destination and disconnect. Connecting or selecting a destination does not enable export. Export and synchronization remain disabled during initial acceptance.

A completed disconnect removes DayRate's active stored Google OAuth credential, disables export and makes queued synchronization work ineligible for that connection. DayRate also attempts to revoke the Google grant and reports that outcome separately. If revocation is not confirmed, Settings links to Google Account permissions, where you can remove DayRate's access. DayRate reports a failed or incomplete operation rather than claiming it completed. Disconnect does not move or delete events already in Google and does not erase DayRate's Bookings.

Calendar records and retention

Credential removal and removal of other Calendar records are separate. Non-credential records, such as account/calendar metadata and destination settings, can remain after disconnect. Disconnect is not a complete account, workspace or Calendar-metadata erasure operation.

You may request removal of disconnected Calendar metadata at privacy@trydayrate.com. DayRate verifies your identity and authority, reviews the records and reports which supported actions can be completed. It explains retained categories and their reasons, including applicable legal obligations or unresolved security and support matters. DayRate does not promise an automatic metadata-deletion deadline while its Production cleanup operation is not continuously active.

Account and data deletion requests

You may request account or data deletion at privacy@trydayrate.com. DayRate verifies account identity and, for workspace data, your authority before disclosing or changing data; email possession alone is not enough for destructive action. There is no automatic DayRate account or workspace deletion today. Sign-in identity, DayRate account records and workspace business records are separate. If you are the only workspace owner, DayRate reviews the workspace and its records before account closure; deleting sign-in access does not erase them.

Disconnect removes the stored Google OAuth credential through the supported operation; Google grant revocation is reported separately. Existing event copies in Google are separate from DayRate metadata. Business and financial records, including Invoices, payments, Receipts and communications, may require separate accounting, legal, contractual, security or operational retention. DayRate explains the categories it can act on, retained categories and their reasons, and unresolved work after verification. Manual intake does not make complete account deletion or export available today.

Sharing and policy changes

DayRate uses service providers for authentication, hosting, data storage, communications and optional Calendar operation as described above. DayRate does not sell personal information or share it for cross-context behavioral advertising under the current implementation. Providers may receive technical request information to deliver their services. DayRate's application code does not include a third-party tracker that collects your activity across unrelated sites.

DayRate will post material changes to this policy with an updated effective date before the changed practice takes effect. Where additional notice or consent is required, DayRate will provide it. A new use of Google user data will be disclosed and consent requested before that use.

Service providers and limited use

DayRate relies on service providers to authenticate users, host the application, store data, deliver communications, and operate the optional Calendar connection. Providers process data as needed to supply those services. DayRate does not sell Google user data or use it for advertising. DayRate’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. This is a commitment about use of data, not a claim that Google has verified or approved DayRate.

Questions

Privacy and data-request contact: privacy@trydayrate.com. See Support and contact for general help.