Privacy notice

Last updated 27 October 2026.

In short

• The website uses no cookies, no analytics or tracking scripts, no advertising and no forms. Fonts, videos and scripts are served from this website.
• The DaySight MCP software runs on your computer. It does not send us your Workday data, credentials, tokens or conversations, and it has no telemetry.
• We receive personal data only when you write to us, for example to ask for a licence key.

1. Who is responsible

Paulo Poinha, Chruzackerstr 28, 8193 Eglisau, Switzerland, contacts@daysight.dev, is the controller of the personal data described here. We apply the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

2. When you visit the website

The website is hosted by GitHub Pages (GitHub, Inc., USA, a Microsoft company), and all requests to daysight.dev pass through Cloudflare, Inc. (USA), which provides the DNS and acts as a proxy in front of the website. When you open a page or download a file, these providers receive technical data that your browser sends: your IP address, the date and time, the address of the page or file you asked for, the browser type and the page you came from. They use it to deliver the website, to keep it secure and to compile statistics. We do not receive this data as personal logs, and we may see aggregated traffic figures such as the number of requests and the countries they come from. We do not use it to identify you. Our legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).

3. Cookies and similar technologies

We do not set cookies or store anything in your browser. The website does not load fonts, scripts or videos from other sites. We do not use analytics, advertising or social media plug-ins.

4. When you write to us

Email to contacts@daysight.dev is received by our own mail server (Stalwart Mail Server), which runs on a server hosted by Hetzner Online GmbH in Germany. If you email us, we process your email address, your name if you give it, the content of your message and anything you attach, for example your organization and the request code from the trial. We use it to answer you, to prepare a quote and to issue a licence key. The request code is a hash of your Workday tenant name, not the name itself. Please do not send client secrets, tokens or real employee data. The legal basis is the steps before a contract and the performance of a contract (Art. 6(1)(b) GDPR) or, for general questions, our legitimate interest in answering them.

If you buy a licence, we also keep a licence register (organization, contact person, request code, type of licence, issue and expiry dates) and the invoicing records that the law requires us to keep (Art. 6(1)(c) GDPR).

5. The DaySight MCP software

The software runs on your computer and connects only to your Workday tenant. It does not contact us. It stores on your computer an encrypted sign-in token, your settings and a trial record that holds a hash of your tenant name and the first and last dates of use. Nothing in these files is sent to us. The data that the software retrieves from Workday is passed to the AI assistant you use, for example Claude or ChatGPT, under that provider's terms. For privacy and safety we recommend Claude Enterprise, which does not use your conversations to train models. You decide which data your assistant may receive and are responsible for it as the controller of your HR data. We are not your processor for that data because we never receive it.

6. Who receives data

Hosting and network providers as described in section 2, Hetzner Online GmbH (Germany), which hosts the server on which we run our own mail server, and, if you buy a licence, our accountant and payment providers. We do not sell personal data and we do not use it for advertising.

7. Transfers abroad

Our mail server is in Germany, which Switzerland and the EU treat as having adequate data protection. GitHub and Cloudflare are based in the USA. Where personal data is transferred to countries without an adequate level of data protection, this relies on the providers' certification under the Swiss-US and EU-US Data Privacy Frameworks or on standard contractual clauses, as the providers document.

8. How long we keep data

Emails are kept for as long as needed to answer you and to manage the licence, and then deleted unless a legal retention period applies. The licence register and invoicing records are kept for the statutory retention period, which is generally ten years in Switzerland. Provider logs follow the providers' own retention rules.

9. Your rights

You can ask us for access to your data, correction, deletion, restriction of processing, a copy in a common format, and you can object to processing based on legitimate interests. Write to contacts@daysight.dev. You can also complain to a data protection authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the authority of your country in the EU or EEA.

10. Security

We use encrypted connections (HTTPS) for the website and limit access to the data we hold. The software keeps its secrets on your computer; details are on the security page.

11. Changes

We may update this notice, for example when we add a feature that processes data. The version on this page applies from the date shown above.