Daymuster
Try free

Legal

Data Processing Addendum

Last updated: May 24, 2026

Draft. This template is structurally complete and reflects how Daymuster actually processes data, but it has not yet been reviewed by counsel. Use this as the starting point for procurement discussions. The version each customer signs is countersigned by Daymuster and supersedes this draft. Email connect@theauctores.in for an executable PDF.

This Data Processing Addendum (the "DPA") forms part of the Daymuster Subscription Agreement (the "Agreement") between Daymuster (a product of The Auctores, "Processor" or "Daymuster") and the customer identified in the Agreement ("Controller") and applies whenever Daymuster processes Controller Personal Data on Controller's behalf.

1. Definitions

Terms not defined here have the meanings given in the GDPR (Regulation (EU) 2016/679), the UK GDPR, and, where applicable, the CCPA. "Personal Data" means any information relating to an identified or identifiable natural person Controller submits to the Daymuster service.

2. Scope and Roles

Controller is the data controller of Controller Personal Data processed via the Daymuster service. Daymuster is the data processor. Each party will comply with the obligations applicable to its role under applicable data protection laws.

3. Processing Details

  • Subject matter: provision of the Daymuster service (tasks, time tracking, client management, credential vault, invoicing, client portal, optional AI features).
  • Duration: for the term of the Agreement plus the 30-day soft-delete grace period thereafter.
  • Nature and purpose: hosting, storing, and processing Controller Personal Data solely to provide the service and as documented in the Privacy Policy.
  • Categories of data subjects: Controller's employees, contractors, clients, and stakeholders.
  • Categories of Personal Data: name, email, authentication data, time-tracking entries, task content, comments, file attachments, billing contact info, and any other Personal Data Controller chooses to submit.

4. Sub-processors

Daymuster uses the following sub-processors to deliver the service. Controller authorises this list on subscription. Daymuster will give at least 30 days' notice, by in-app admin notification and by email to the workspace admin, before adding or replacing a sub-processor; Controller may object in writing.

  • Neon, Inc., managed Postgres database hosting (United States, us-east-2).
  • Vercel Inc., application hosting, edge CDN, serverless functions, blob storage.
  • Anthropic, PBC, AI inference for optional features (meeting notes to tasks, client profiles, drafts, summaries). Disabled at the workspace level by the admin.
  • Google LLC, Sign in with Google, and the Google Chat integration where a workspace switches it on (US region).
  • Sentry (Functional Software, Inc.), application error monitoring (US region).
  • Crisp IM SAS, live chat on the public website (EU region). Not used inside the application.
  • GitHub, Inc., source hosting and the scheduled job that runs nightly backups (US region).
  • Resend, Inc., transactional email (invitation, password reset, trial-expiring notices).
  • PayPal Holdings, Inc., subscription billing.
  • Backblaze, Inc., nightly database backups, encrypted at rest by the provider and in transit over TLS (US region).

5. Security Measures

Daymuster implements technical and organisational measures appropriate to the risk, including: TLS 1.2+ in transit; AES-256 at rest for the credential vault; bcrypt for password hashes; SSO and TOTP 2FA for the operator admin console; least-privilege access controls; per-organisation data isolation enforced at the application layer; audit logging of every super-admin action; nightly backups to separate off-site storage, encrypted at rest by the provider and in transit, deleted after 30 days; per-workspace AI spend caps and an admin-controllable kill switch. The current detailed list is maintained at /security.

6. International Transfers

Where Controller Personal Data is transferred outside the EEA/UK, Daymuster relies on the European Commission's Standard Contractual Clauses (Module Two, controller-to-processor) and the UK International Data Transfer Addendum, incorporated by reference. Daymuster will not transfer Personal Data to a jurisdiction without an adequacy decision unless an equivalent safeguard applies.

7. Data Subject Rights

Controller is responsible for responding to data subject requests. Daymuster will assist Controller by:

  • providing per-user erasure (anonymisation of the user record) through the in-app Settings surface, and a per-user export: each user can download their own data from Settings as a machine-readable JSON file;
  • providing organisation-level data export from Settings, Advanced, as CSV across tasks, time entries, clients, credentials metadata, activity, invoices, comments, Knowledge, attendance and leave;
  • providing organisation-level deletion (soft-delete with 30-day restore window, followed by permanent erasure via the scheduled cron job).

8. Personal Data Breach

Daymuster will notify Controller without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Controller Personal Data, with the information required by Article 33(3) GDPR to the extent then available. Daymuster will provide reasonable assistance in Controller's notifications to supervisory authorities and affected data subjects.

9. Audit Rights

Daymuster will make available all information reasonably necessary to demonstrate compliance with Article 28 GDPR, including the Security Measures in Section 5 and an annually-updated security questionnaire on request. Controller may conduct an audit no more than once per year, on 30 days' written notice, during business hours, at Controller's expense, subject to a confidentiality agreement. Third-party audit reports (SOC 2 once available) will be accepted in lieu of direct audits where they cover the relevant controls.

10. Deletion or Return on Termination

On termination of the Agreement, Controller may export its Personal Data via the in-app CSV export for up to 30 days. After that grace period Daymuster will permanently erase all Controller Personal Data from the production database, and within a further 30 days from off-site backups, except where retention is required by law.

Off-site database backups are a separate copy, encrypted at rest, held in a private bucket, and deleted 30 days after they are taken by a lifecycle rule on that bucket. They are restored only to recover the service, so Personal Data can persist in them for up to 30 days after erasure from the production database.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement.

12. Governing Law

This DPA is governed by the law specified in the Agreement. Where the Agreement does not specify, English law applies.

Questions or redline requests? Reply to your account email or contact connect@theauctores.in. Daymuster will return a countersigned DPA reflecting agreed modifications.

See also: Privacy Policy · Security · Terms of Service