Privacy Policy

Day Eight is an AI automation agency in Australia. We design, build and run AI staff for other businesses (answering calls, drafting replies, chasing leads, filling the calendar) and we run the client platform where you approve everything those AI staff want to do.

This policy covers our public website and the platform you sign in to, and it explains what we do with information about you and about the people you deal with. “We”, “us” and “our” mean Day Eight. “You” means a client, someone thinking about becoming one, or anyone who gets in touch.

What you send us

• Contact details: your name, your business name, your email address, and a phone number if you give us one.
• Your intake: the answers you give about your business: the tools you use, the work that is eating your week, the outcome you want.
• Whatever you put into the platform: brand notes, documents, target customer descriptions, contact lists, draft copy, screenshots.
• Your messages: the emails you send us and anything you choose to include in them.

What the platform records

• Your account: the email address you sign in with, the sign-in links we send, and the session that keeps you signed in.
• Your engagement as it moves: the intake, the plan, the build, the sandbox test results, the go-live decision and what has run since.
• Every proposed action and every decision on it: the exact draft an agent wanted to send, who approved or rejected it, and when. This sits in an audit log that cannot be edited after the fact, deliberately.
• Call recordings and write-ups, when you agree to them: if we record a call with you, the audio is stored in our private Sydney bucket, transcribed, and turned into notes. We ask before we start recording, and you can ask us to delete a recording, its transcript and its notes at any time.
• Operational logs: job and run records, errors, and the ordinary server logs our host keeps (IP address, browser, pages requested, timestamps).

What your connected accounts expose to it

When you connect Google (Gmail, Google Calendar) or a CRM, you do it through that provider’s own OAuth screen and you choose the permissions we get. Inside those permissions the platform can read what an approved task needs and prepare what you asked for: reading your calendar to offer a booking time, preparing a Gmail draft, looking up a contact record. It pulls what the task needs and no more, and it cannot send, book or change anything until a person approves that specific action.

Some of what you give us or connect is personal information about other people: your customers, your leads, your contacts. You are responsible for having the right to hand it to us. We treat it under this policy and use it only for the work you have asked for.

We use what we collect to:

• understand your business well enough to draft a plan, and then build, test and run what you approved;
• let the AI agents draft the emails, bookings, posts and record changes they want to make, and put those drafts in front of you;
• show you your approvals inbox, your results and your audit history;
• email you the things the platform needs to email you: sign-in links, approval requests, alerts when something needs attention;
• invoice you and take payment;
• answer your questions and fix things when they break;
• keep the platform secure, and investigate misuse or abuse;
• meet our legal and tax obligations.

Two things we do not do: we do not sell or rent personal information, to anyone, ever. And we do not use your data, or your customers’ data, to train AI models. Your data is sent to a model to produce your output, and that is all.

Each one does a single job, and we send it only what that job needs. The first group is used for every client. The second is used only if you buy the service it belongs to: if you never buy that service, we never send your data there.

Used for every client

• Supabase: the database, file storage and sign-in behind the platform, including the sign-in link we email you. Our project is hosted in Supabase’s Sydney region, and every table is protected by row-level security so one client’s data is never readable by another.
• Anthropic: the Claude models behind every AI feature. When we draft a plan, build a solution, or an agent writes a message, the relevant content goes to the Anthropic API and the result comes back to us.
• Stripe: payments and subscriptions. Card details are entered with Stripe and stay with Stripe; we never see or store a full card number.
• Resend: the notification email we send you: approval requests and alerts.
• Vercel: hosting. Vercel serves this website and the platform and keeps ordinary request logs.
• Google: only if you connect it, and only at the permission level you grant: Gmail and Google Calendar, through OAuth.
• OpenAI: transcribing call recordings, and generating text where a second model gives a better result than Claude alone.

Used only for the service they power

• OpenAI, Google (Gemini) and Perplexity: the AI search engines a GEO visibility audit has to ask about your business, and the models behind some copy and research work.
• fal.ai: generating images and short video for the social media service. Your brief and brand notes go with the request.
• Cartesia and ElevenLabs: turning approved scripts into speech for the receptionist and voice work.
• Apollo, Clay, Instantly, Smartlead and HeyReach: the lead generation and outreach platforms. Your target-customer description goes to them, and the lead lists and campaign results come back.

We are the customer of record for these suppliers, so their terms bind us and we hold the keys. Ask us and we will tell you exactly which of them your engagement touches, and send you their current terms and data-processing pages.

A CRM or any other tool you connect is your account under your agreement with that provider; we act inside it with the access you give us. Beyond this list, we share information only with our professional advisers (accountant, lawyer, insurer) under confidentiality, or with authorities where the law requires it.

This is the part clients ask about most, so here it is in full.

• You connect an account yourself, on the provider’s own screen. We never ask for a password, and you should never send us one.
• The access token that comes back is encrypted in a secrets vault. Our database stores only a reference to it; the secret itself is never written into a table in plaintext.
• It is decrypted on our server only, at the moment an approved job needs it. It is never sent to your browser, and it is never written into logs, drafts or audit entries.
• Access is limited to the permissions you granted. If a new automation needs more, we ask you to approve a new connection rather than quietly widening the old one.
• You can revoke it at any time, from the provider’s own security settings, which stops it immediately without going through us. Ask us to disconnect from our side and we destroy the stored token and mark the connection revoked.

Every agent we build runs in propose mode. It drafts the exact email, booking, message or record change and then stops. The draft goes to your approvals inbox, a person reads it, and only after that person approves does anything leave the platform.

That is a privacy control as much as a quality one: nothing is sent to your customers, and nothing is written into your systems, without a person having seen it first. Every one of those decisions is recorded: what was proposed, who decided, and when.

• Row-level security in the database, so a client can only ever read their own data.
• Passwordless sign-in by emailed link, so there is no password stored anywhere for someone to steal.
• Connected-account secrets in a vault, never in plaintext in the database.
• An audit log of who did what and when, which cannot be edited afterwards.
• Access limited to the people at Day Eight working on your engagement.

No system is completely secure and we are not going to pretend otherwise. If a breach ever puts your information at risk, we will tell you, and we will notify the regulator where the law requires it.

• Enquiries that do not become engagements: kept while there is a real chance we are still talking, then deleted.
• Account, intake, plan, build and results data: kept while your account is open, because the platform needs it to keep running.
• The audit and approval history: kept for the life of the account. It is the record of who approved what, so it is deliberately not editable and not pruned.
• Call recordings, transcripts and their write-ups: kept while your account is open because the notes feed the work, and deleted on request. Ask us and we delete the audio, the transcript and the notes together.
• Connected-account tokens: kept until you revoke the connection or close the account, then destroyed.
• Invoices, payment records and anything else the law makes us keep: kept for as long as the law requires, even after the account closes.

When an account closes we delete or de-identify the rest within a reasonable period. If you want that done sooner, ask us.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that is wrong or out of date;
• ask us to delete it; we will, apart from records the law requires us to keep and the audit entries that record decisions already made;
• ask how it has been used and who we have shared it with;
• tell us to stop sending you marketing email, at any time;
• complain if you think we have mishandled it.

To ask for any of these, email dayeightcontact@gmail.com with “Privacy request” in the subject line. We will confirm we have it, we may need to check that you are who you say you are, and we aim to answer within 30 days. We do not charge for this.

If our answer does not satisfy you, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.

The marketing pages (everything you can read without signing in) set no cookies of their own. There is no advertising pixel, no analytics tag and no third-party tracker on them.

The signed-in platform sets one kind of cookie: a session cookie that keeps you signed in after you click your emailed link. It is strictly necessary: clear it and you are signed out. That is the whole list, which is why there is no cookie banner to click through: there is nothing here to opt into.

If we ever add analytics, or anything else that is not strictly necessary, we will say so on this page and ask you first.

The platform’s database is hosted in Supabase’s Sydney region, so your platform data sits in Australia. Several of the suppliers above do not: Anthropic, Stripe, Resend and Vercel are United States companies, and Google operates globally. So some information (a prompt sent to a model, an email we send you, a payment, a page request) is processed overseas, most often in the United States.

We choose suppliers that publish their security and privacy commitments, and we send each of them only what they need. We do not control where every part of their own infrastructure sits, so we are not going to promise you a data-residency guarantee we cannot back.

We will update this policy as the platform changes. The date at the top always tells you when it last changed. If a change materially affects how we handle your information, we will email account holders rather than quietly editing the page.

Questions, requests or complaints about privacy go to dayeightcontact@gmail.com, and a person reads them. The commercial side of working with us is covered by our Terms of Service.