Privacy Policy

Who we are

daismo is operated by Cypher Agency Pty Ltd (ACN 678 167 443, ABN 84 678 167 443), trading as Cypher AI. This policy explains what we collect, why, who else sees it and how long we keep it. We handle personal information in line with the Australian Privacy Principles.

What we collect about you

• Account details: your email address, and a display name if you give one. Passwords are stored only as a cryptographic hash; we never see them. If you turn on two-factor authentication we store what is needed to check your codes.
• Your saved prompt library: prompts, packs, favourites and reusable context you choose to save are stored against your account, so they follow you from one browser to another. If you use daismo without an account they stay in your browser and never reach us.
• How you use the product: when a prompt is opened, copied, scheduled or scored, which assistant you chose, and when. We record the identifier of the item and the action, never the text of a prompt. We also count runs against your workspace’s allowance.
• Feedback you send us: the category, the page you sent it from and what you wrote. We check it for personal information before accepting it and refuse things like card numbers outright.
• Your acceptance of these documents: which version you accepted, when, and the IP address you accepted from.
• Technical data: while you are signed in, your session record holds the IP address and browser description it was created from. For visitors without an account we count free runs against a random identifier and against the IP address, and we limit how often sign-in and similar requests can be made from one IP address.
• Billing details, held by Stripe, not by us. We store only a customer reference and the workspace’s subscription status. We never see your card number.

What a business records in daismo

• Workspaces and membership: the workspace name, who belongs to it and in what role, and invitations sent. An invitation stores the email address it was sent to, which may belong to someone who has no account with us and never creates one. Unanswered invitations expire after seven days.
• The business’s own records: its profile and goals (industry, size, location, how it approaches AI), which areas of work apply to it, its register of AI tools, providers and specific uses, and prompts and context shared into the workspace. This is business information, and it belongs to the workspace rather than to the person who typed it.
• A history of changes to the register: when an AI tool, provider or use is created or changed, we keep a record of which field changed, its old and new values, who made the change and when. The history is kept so a business can show how a decision came about. Correcting a record does not remove its earlier value from the history. If something should not have been recorded at all, contact us.
• Names of people who are not users. A register entry records an accountable owner as free text, and a use can name the people a tool affects. Those are often colleagues, contractors or advisers with no account here. Only record someone else’s details where you have a proper basis to, and keep it to what the record needs: a role or a work address rather than anything personal.

What we deliberately don’t hold

• Your provider API key. If you use your own key it stays in your browser and is sent with each request. It is never written to our database or logs.
• The prompts you score. We don’t keep them after returning your result. We record that a run happened, on which lane and which model, and nothing of what it said.

Prompt content and AI providers

Scoring a prompt necessarily sends its text to a third-party AI provider. That is the only time we send your content to one; nothing else in daismo is sent to an AI model.

The included model runs on a provider’s free tier, and free tiers commonly reserve the right to use submitted content to improve their services, including human review. Treat anything you put in that lane as disclosed to that provider. For confidential material, use your own API key: that request goes to the provider you chose, under your own agreement with them.

“Open in” is sent by your browser, not by us. When you choose to open a prompt in ChatGPT, Claude or Copilot, your browser takes the prompt to that service in the link, and that service’s own terms and privacy policy apply from then on.

Who else processes your data

• Groq: prompt text, to score it with the included model. With your own key, the provider you chose instead, such as Anthropic.
• Neon: database hosting for accounts, workspaces and everything a business records in daismo
• Upstash: sign-in sessions, usage counters and rate limits
• Stripe: payments and billing
• Resend: the emails we send, which are verification, password reset, workspace invitations and account deletion
• Netlify: hosting, and the server logs described below

Several of these process data outside Australia, chiefly in the United States: the application itself runs there, and Groq and Resend hold data there. We don’t sell your personal information, and we don’t share it for advertising.

Cookies and browser storage

Our cookies are all functional. They keep you signed in, remember whether you asked to stay signed in, carry you through two-factor sign-in, and hold the random identifier that counts free runs for visitors without an account, which lasts up to 400 days. There are no advertising or analytics cookies.

Your browser also keeps some things that never reach us: your own API key if you use one, your light or dark choice, the assistant you prefer to open prompts in, a draft in progress, and, if you use daismo signed out, your prompt library.

Server logs

When something goes wrong we log the kind of error together with the account and workspace identifiers involved, so it can be traced. Our logs do not include prompt text, what you typed into a form, or your IP address. Our hosting provider keeps them for a limited period, and keeps its own records of the requests it serves.

How long we keep things

• Your account, library and usage history: for as long as your account exists. They are deleted when you delete it.
• Feedback: while your account exists, and for 30 days after you delete it, no longer linked to you. Then it is deleted.
• Sign-in sessions expire after 30 days, or sooner when you sign out or change your password. Usage counters expire automatically: anonymous ones within a day, a workspace’s within a few weeks of the month it counts.
• A workspace’s records, including the change history, last as long as the workspace does and are not removed when one member leaves. When you delete your account, your name is removed from the history of a workspace that carries on, and the changes themselves stay.
• Saved readiness checks, where that feature is available to your workspace, are deleted 30 days after a free trial ends without a subscription. A workspace with a subscription keeps them.

Archiving is not deletion, and we try to say which we mean. Some things are archived rather than removed: a business goal you drop, and an AI tool or provider you retire, keep their record and their text so the history of a decision survives the decision. They leave your working views and stay in the workspace. Deleting the workspace removes them.

Stripe keeps its own records. When a workspace is deleted we cancel its subscription and delete our copy of the plan, but Stripe keeps the customer record and past invoices under its own obligations, and we cannot remove those.

We keep the record that you accepted a particular version of these documents for as long as your account exists. It is deleted with the account.

Security

Passwords are hashed, sessions can be revoked, and two-factor authentication is available from your account page, and required for owners and administrators of a workspace with more than one person in it. Changing your password signs out every other session. Each business’s data is held in its own separate database schema rather than filtered out of a shared one.

No system is perfectly secure, so we limit what a breach could expose where we can. Your provider API key never reaches us; it stays in your browser. Your saved prompt library does reach us when you use an account, because that is what makes it follow you between devices; it only stays local if you use daismo signed out.

Your rights, and how to use them

• A copy of your data. Your account page downloads everything held against you: profile, library, recent usage, workspaces, feedback and more. Owners and administrators can also download a workspace’s register as a handover report.
• Deleting your account. Your account page does it in two steps: your password, then a link we email you. If you are the only owner of a workspace other people are still in, it asks you to hand that over first.
• Anything else, including asking what we hold or asking us to correct it: email support@daismo.com.au and we will respond within a reasonable time.

If you’re unhappy with how we’ve handled your information, contact us first. If we don’t resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Modules not yet available

We are building further parts of daismo, such as an inventory of the software a business uses and guided setup. They are switched off and collect nothing. Before any of them is switched on for customers we will update this policy to describe what it collects.

Changes

If we make a material change to this policy we’ll give reasonable notice by email before it takes effect.

Contact

Cypher Agency Pty Ltd (ACN 678 167 443, ABN 84 678 167 443), trading as Cypher AI: support@daismo.com.au