Privacy Policy
Last updated:
This policy explains what personal data By30Days processes, why, with whom it is shared and what rights you have. It applies to this website (by30days.com), the By30Days panel, its administration panel and the e-mails we send about your account. It does not cover the platforms you connect to By30Days (for example Telegram, Bluesky or Mastodon): their own policies apply there.
1. Who is responsible for your data
By30Days ("we") is the controller of the personal data described in this policy.
- Contact, privacy questions included: [email protected]
For users in the United Kingdom, By30Days is the controller under the UK GDPR. For users in Canada, the person responsible for our privacy practices (PIPEDA, principle 1) can be reached at the contact above.
2. What we collect and why
We collect only what the service needs. The table lists each category, why we process it and the legal basis under the GDPR and UK GDPR.
| Data | Why we process it | Legal basis |
|---|---|---|
| Website visits: the IP address and browser information of each request to by30days.com | To deliver the pages and protect the website from abuse | Legitimate interest in running the website (Art. 6(1)(f)) |
| Account data: name, e-mail address, password (stored only as a hash by our authentication provider), second-factor settings, interface language and time zone | To create and secure your account, sign you in and send account e-mails | Performance of the contract (Art. 6(1)(b)) |
| Organization details you enter in Settings: organization name, legal name, tax ID, address, contact e-mail and phone, website | To identify the account holder and issue billing documents | Contract; legal obligation to keep accounting records (Art. 6(1)(c)) |
| Team data: e-mail addresses of the people you invite and their role in your account | To let you work as a team | Contract; for invitees who are not users yet, our legitimate interest in delivering the invitation (Art. 6(1)(f)) |
| Workspace content: topics, research tasks and schedules, collected source materials, drafts and their version history, style guides and samples, media you upload, publication records | To provide the service | Contract |
| Connected channel credentials: bot tokens, app passwords and OAuth tokens for the platforms you connect, and your account identifiers and handles there | To publish where you ask us to | Contract |
| Support: messages and attachments you send to support, and the time you were last active in the panel (used only to decide whether to e-mail you a reply) | To answer your requests | Contract; legitimate interest in running support |
| Usage and billing records: credit balance and transactions, which model or service an action used and what it cost, who triggered the action | To bill your usage and show you what it costs | Contract; legal obligation to keep financial records |
| Technical and security data: IP address and browser information at sign-in (held by our authentication provider) and when a draft version is saved, a log of security-relevant actions (action, path, user ID), rate-limit counters, and browser reports of content-security-policy violations | To keep accounts secure, prevent abuse and investigate incidents | Legitimate interest in security (Art. 6(1)(f)) |
| Sign in with Google: your name and e-mail address from Google, if you use it | To sign you in | Contract |
We do not run advertising or analytics trackers on this website or in the panel, and we do not sell personal data. We do not ask for special categories of data (health, beliefs, biometrics and the like) and do not knowingly process them. If you were invited to an account, your e-mail address came from the person who invited you. E-mails about your account (confirmations, codes, invitations, task and publication results, support replies) are part of the service; the notification kinds you can switch off are listed in Settings.
Where Canadian law applies (PIPEDA), the same processing rests on your consent, given when you create an account and configure the service; you can withdraw it, subject to legal or contractual restrictions, by closing your account or writing to us.
3. Information about people who are not our users
To research a topic you choose, By30Days gathers publicly available material: articles, posts and comments from the web and social networks, together with the author names or handles, dates, excerpts and links to the originals. This material is stored with the research task, shown to you as sources and used to write drafts that cite those sources. We do not build profiles of the people behind these posts, do not combine the material with other data and do not use it for any purpose other than the task it was collected for. The legal basis is our and our users' legitimate interest in researching public discussion (Art. 6(1)(f)). Because notifying every author individually would involve disproportionate effort (Art. 14(5)(b)), this policy serves as the public notice. If you are an author and want a quote or reference removed, write to [email protected].
4. AI processing
Drafts, translations, edits, topic ideas and illustrations are generated by third-party AI models. To do this we send the research topic, the collected materials and the text you are working on to the model provider selected for the operation. Nothing is published automatically: every draft is reviewed and published by a person on your team. We do not use your content to train models. Model providers process the data under their own terms.
5. Who we share data with
To run By30Days we use service providers (processors) of the following kinds. Each processes data on our behalf under contractual data-protection terms and only for the purpose named here:
- hosting of the panel and this website, the database, authentication and file storage — in the European Union;
- delivery of transactional e-mail;
- AI models that generate text and images;
- web and social search, trend data and page retrieval for research — these providers receive the research topic and the addresses of the pages to read;
- delivery and protection of this website, and bot protection on the sign-in and sign-up forms.
We do not publish the names of these providers; you can ask us for the current list at [email protected].
When you sign in with Google, Google receives what it needs to sign you in. When you publish through a connected channel, the content and your channel credentials are sent to that platform (Telegram, Bluesky or the Mastodon instance you chose) at your request; those platforms are independent controllers. We may also disclose data when the law requires it, to protect our rights, or as part of a merger or acquisition, in which case this policy continues to apply.
6. International transfers
Your account and content are stored in the European Union. Some of our providers process data in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or an adequacy decision, as set out in each provider's data-processing terms. You can ask us for details at [email protected].
7. How long we keep data
| Data | Retention |
|---|---|
| Account, organization, team and workspace content | For as long as your account exists. When you ask us to delete the account, we delete it within 30 days, except for the records below |
| Research materials | With the task, until you delete the task or the workspace |
| Draft version history | 365 days per version |
| Model usage records (which model, tokens, cost) | 365 days |
| Application audit log and security event log | 90 days |
| Platform-administrator access journal | Up to 365 days |
| Rate-limit counters and one-time codes | From a few minutes up to 2 days |
| Support attachments that were never sent | 48 hours |
| Hosting and application logs | Up to 30 days |
| Credit ledger and billing documents | For as long as accounting and tax law requires after the account is closed |
8. Your rights
You can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to its processing; receive the data you gave us in a portable format; and withdraw consent where processing is based on consent. Write to [email protected]. We may ask you to confirm your identity and will answer within one month. You can also change most of your account data yourself in Settings.
You have the right to complain to a supervisory authority: in the EU, the authority of the country where you live or work; in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Canada, the Office of the Privacy Commissioner (priv.gc.ca).
9. Cookies
This website sets no cookies. The panel uses only cookies that are necessary for it to work, with no advertising or analytics cookies. The full list is in the Cookie Policy.
10. Security
Data travels over TLS. Passwords are stored only as hashes, and you can protect your account with a second factor. Every workspace is isolated at the database level, the service runs under least-privilege roles, security-relevant actions are logged, and dependencies and code are scanned for known vulnerabilities and leaked secrets. No system is perfectly secure; if we learn of a breach that puts you at risk, we will notify you and the competent authority as the law requires.
11. Children
By30Days is a tool for organizations and is not intended for anyone under 16. We do not knowingly collect data from children.
12. Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. AI-generated drafts are proposals that a person reviews.
13. Changes to this policy
When we change this policy, we publish the new version here with its date. For material changes we will notify you by e-mail or in the panel before they take effect.
14. Contact
E-mail: [email protected].