Privacy notice.
How DayBack Ltd handles the personal data in DayBack.
Who we are
DayBack is a lesson-preparation tool for teachers, run by DayBack Ltd, a company registered in England and Wales, company number 16451209, registered office 86-90 Paul Street, London EC2A 4NE. We are the data controller for the personal data described here.
If you have a question about your data, or you want to use any of the rights below, email hello@dayback.app. A person reads that address.
What we collect
Your email address. Your email address is your account. You sign in with a link we email you, or with your Google account. There is no password.
If you sign in with Google. Google tells us your email address, your name, a link to your Google profile photo and an identifier for your Google account, so we recognise you next time. We ask Google for nothing else: not your contacts, your files or your calendar. We do not keep the access keys Google issues when you sign in, so DayBack cannot act in your Google account.
What you make in DayBack. The briefs you write (topic, subject, year group, duration, and the optional class context), any files you upload as starting material, and the lessons, slides and worksheets DayBack produces for you. This is your work, and we treat it as yours.
Technical logs, without your content. Our servers keep structured logs so we can find and fix faults: timestamps, error codes, and the identifiers of a request, job or lesson. Your briefs, your uploads, the prompts we send to the AI model and the lessons it writes back are never written to our logs. When we record an AI call we record the model, how long it took, how many tokens it used and what it cost, never the text.
Nothing about your pupils. See “Pupils” below.
We do not buy personal data, we do not build advertising profiles, and we do not sell anything to anyone.
Why we use it, and our lawful basis
Under the UK GDPR we need a lawful basis for each use. Ours are:
| What we use | Why | Lawful basis |
|---|---|---|
| Your email address, and if you sign in with Google your name, profile photo link and Google account identifier | To sign you in by emailed link or with Google, to keep you signed in, and to email you about your account or a fault that affects you | Contract (Article 6(1)(b)). We cannot give you an account without it |
| Your briefs, uploads, lessons and worksheets | To generate, store, check, edit, present, print and export your teaching materials | Contract (Article 6(1)(b)). This is the service you asked for |
| Sending a brief to our AI provider | To generate the lesson you asked for | Contract (Article 6(1)(b)) |
| Technical logs, and per-account rate limits | To keep DayBack working, to investigate faults, and to stop abuse or runaway cost | Legitimate interests (Article 6(1)(f)). Running a service that stays up and is not abused. Logs hold no lesson content, so the effect on you is minimal |
| Page-speed measurements (see the cookie notice) | To see whether pages load quickly enough | Legitimate interests (Article 6(1)(f)). The data is aggregated and carries no cookie or identifier |
| Answering your email, including a deletion request | To deal with what you asked, and to keep a record that we did | Legitimate interests (Article 6(1)(f)), and legal obligation (Article 6(1)(c)) where we must keep a record |
We do not use your data to train AI models, and neither does our AI provider (see “Who processes your data”).
We rely on legitimate interests only where we have weighed them against your interests and concluded the processing is proportionate. Ask us at hello@dayback.app if you would like the reasoning.
Who processes your data
We use a small number of suppliers. They act on our instructions under a written data-processing agreement.
| Processor | What they do for us | Where they process it |
|---|---|---|
| Vercel | Hosts the DayBack web app in your browser, and measures page-load speed | Global edge network; static files only |
| Railway | Runs our API, our background worker, our Postgres database and the storage bucket that holds your uploaded files and lesson images | EU-West (Amsterdam), Netherlands |
| Amazon Web Services (Amazon Bedrock) | Runs the AI models that write your lesson. We use OpenAI’s GPT models through Bedrock | United States (us-east-1) |
| Resend | Sends your sign-in link and any service email | European Union region |
| Pexels | Supplies the photographs used to illustrate lessons, with the photographer credited | Image search only; no personal data is sent |
Signing in with Google. If you choose it, Google confirms who you are. For that step Google is a separate controller acting under its own privacy policy, not a processor of ours. We receive only the details listed under “What we collect”.
International transfers
Everything we store stays in the European Economic Area: our database, our file storage and our email provider all run in the EU.
One step leaves the UK and the EEA: the AI call. When you generate a lesson, your brief, and the text of any file you uploaded, is sent to Amazon Bedrock in the United States, which returns the lesson. Nothing is kept there. Amazon Bedrock does not retain the inputs or outputs of an API call and does not use them to train models. We do not enable request logging in our AWS account.
That transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as part of our agreement with Amazon Web Services. You can ask us for a copy of the safeguards that apply.
Pupils
DayBack is for teachers, and we do not want any pupil’s personal data in it.
DayBack asks about your class, not about individuals. You can tell it the class size, how many pupils have SEND or EAL needs, how many are working above or below, and what the class already knows. Those are counts and descriptions, not registers.
The brief also checks what you type and blocks anything that looks like a name, an email address or an ID number. That check is a safety net, not a guarantee.
If you think you entered something identifying: delete it from the brief or the lesson yourself if you can still see it, and email hello@dayback.app telling us which lesson it was. We will remove it from our database, our storage and our backups, and confirm when it is gone. You do not need to explain yourself, and it will not affect your account. If a pupil’s data has been put at risk, tell your school’s data protection lead too. Your school is the controller for pupil data, not us.
Your rights
Under the UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you, in a portable form;
- correct anything that is wrong;
- delete your account and your content;
- restrict or object to what we do with it, including anything we do on the basis of legitimate interests;
- explain a transfer or a lawful basis.
To use any of these, email hello@dayback.app from the address you sign in with. We will reply within one month. We will not charge you, and we will not make you use a form.
Deleting or exporting your account today. DayBack does not yet have a button for this. Until it does, email hello@dayback.app and we will do it by hand: we will export your lessons or delete your account and its content, and confirm when it is done, within 30 days.
If you are not happy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or call 0303 123 1113. We would rather you told us first, so we can put it right.
How long we keep things
| What | How long |
|---|---|
| Your account, email address, name and profile photo link | While your account is open, then 12 months after you last sign in, then deleted |
| Your briefs, uploads, lessons and worksheets | While your account is open, or until you delete them. Deleted from backups within 30 days after that |
| Technical logs | 30 days |
| Records of a sign-in email being sent | 30 days at our email provider |
| Emails you send us, and our reply | 24 months |
| Records we must keep by law | For as long as the law requires |
Nothing is kept “just in case”. If you ask us to delete your account, we delete it.
Changes to this notice
If we change how we handle your data we will update this page and change the date below. If the change is significant, such as a new processor handling your lesson content, a new purpose, or a change to where the AI call happens, we will email you before it takes effect.
Last updated: 27 September 2026