Privacy policy

Last updated 10 October 2026

The short version: we collect what we need to run your account, we keep it in the European Union, we don’t sell it, we don’t use advertising or tracking, and you can download or delete everything whenever you like.

Who we are

TheDayRate is run by Ben Campbell, trading as TheDayRate in Northern Ireland (“we”, “us”). We decide how your personal information is used, so under UK data protection law we’re the “controller”. If you have any questions about your information, email [email protected].

What we collect, why, and our legal reason

What	Why	Legal reason
Your name and email address	To create your account, sign you in, and send you emails about your account, such as sign-in links and password resets.	Contract: we need it to give you an account.
Your password	To sign you in. We only store a scrambled version (a “hash”) that can’t be turned back into your password.	Contract.
Your Google or Microsoft details, if you choose to sign in with one	To recognise you. We receive your name, email address, profile picture and an account ID, plus sign-in tokens that we don’t use to read anything else in your Google or Microsoft account.	Contract.
What you put into TheDayRate: your business details, bank details, clients and their contact details, invoices, expenses, trips and settings	That’s the service. We store it so you can see and use it on any device.	Contract.
Your IP address, device and browser when you sign in, and a count of recent sign-in attempts	To keep accounts secure: to slow down anyone guessing passwords, and to show you where you’re signed in.	Legitimate interests: keeping your account and the service secure.
Receipt photos and PDFs you add to expenses	So you can keep proof of your expenses with your records. They’re only fetched when you open them.	Contract.
Invoices you email from TheDayRate: who you sent them to, when, the invoice itself, and when the link was first opened	To send the invoice from your name with your reply address, give your client a private link to view and print it, and show you its history.	Contract.
Your calendar’s private link, if you connect a calendar	To read your gigs into the Diary. We fetch the calendar when you ask and don’t keep a copy of it on our servers.	Contract.
If you connect HMRC for Making Tax Digital: your National Insurance number, HMRC sign-in tokens, the figures you send, and details about your device and connection	To send your updates and tax return to HMRC when you choose to. HMRC requires the device and connection details (such as your browser, screen size, time zone and IP address) with every submission to help prevent fraud. The sign-in tokens are encrypted.	Contract, and legal obligation for the details HMRC requires.
If you were invited: your email, who invited you and when	So you can create an account while TheDayRate is invite-only.	Legitimate interests: running an invite-only early version.
If you joined with a tester link: which link, when, and how long your free use lasts	To give you the free period you were promised, and to know how many places are left.	Legitimate interests: running a test with early users.
Your email address, if you join the waitlist	To confirm you’re on the list and to tell you when TheDayRate opens.	Consent. You can leave the list at any time.

You need to give us your name and email address to have an account. Everything else you add is up to you.

Most of this comes from you. If you sign in with Google or Microsoft, some comes from them. If you were invited, your email address came from the founder who invited you.

If you add your clients’ details, such as a contact name and email for invoices, we store them only so you can invoice those clients. You’re responsible for having a good reason to keep them, as you would in any accounts system.

When you choose a new password, we check it hasn’t appeared in a known data breach using the Have I Been Pwned service. Only the first five characters of a scrambled version of the password are sent, so neither the password nor anything that identifies you leaves TheDayRate.

Who else handles it

We use a small number of companies to run TheDayRate. They act on our instructions under data processing agreements, and only use your information to provide their service to us. HMRC, Google and Microsoft are different: they only get information when you choose to send it or sign in with them, and they’re responsible for it under their own rules. Have I Been Pwned never receives anything that identifies you.

Who	What they do	Where
Cloudflare, Inc.	Hosts the website and the database your account, data and receipts are stored in. It also sees your IP address when you visit, to deliver and protect the site.	Your account, data and receipts are stored in the European Union, in a database locked so it can’t be stored or run outside the EU. Cloudflare is a US company and its network is worldwide.
Resend (Plus Five Five, Inc.)	Sends our emails, such as sign-in links, password resets, invites and waitlist confirmations. It keeps a short record of the emails it sends.	United States.
HM Revenue & Customs	Receives your Making Tax Digital updates and tax return, only when you choose to send them. HMRC is responsible for what it does with them.	United Kingdom.
Have I Been Pwned (Troy Hunt)	Checks a new password hasn’t appeared in a known data breach. Only the first five characters of a scrambled version of the password are sent, so it never sees your password or anything that identifies you.	Worldwide, on Cloudflare’s network. The service is run from Australia.
Google or Microsoft	Only if you choose to sign in with them.	Under their own privacy policies.

Where your information is handled outside the UK, it’s protected in the ways UK law requires. Cloudflare and Resend are certified under the UK Extension to the EU–US Data Privacy Framework, and also sign standard contractual clauses with the UK Addendum.

We never sell your information, and we don’t share it with advertisers. We’d only share it with anyone else if the law required us to.

Cookies and storage on your device

These are everything TheDayRate keeps on your device. Each one is needed for the service to work, or remembers something you chose, so we don’t ask for consent. There’s no advertising, analytics or tracking of any kind.

Cookies

What	Why	How long
Sign-in cookie `better-auth.session_token`	Keeps you signed in.	30 days from your last visit, or until you sign out.
Sign-in check `better-auth.state`	Only while you sign in with Google or Microsoft: checks the sign-in started on TheDayRate.	5 minutes.
HMRC connection check `hmrc_state`	Only while you connect TheDayRate to HMRC: checks the connection started here.	15 minutes.

Stored in your browser

What	Why	How long
Your look `tdr:look`	Your choice of light or dark mode, colour and spacing.	Until you clear your browser’s data.
Device ID `tdr:device-id`	Only if you use Making Tax Digital: a random code HMRC requires with every submission to help prevent fraud. It identifies this browser, not you.	Until you clear your browser’s data.
News choice `tdr:news-source`	Which news source you picked on the Social page.	Until you clear your browser’s data.
Menu `tdr:nav-open`	Which sections of the menu you left open.	Until you clear your browser’s data.
Data question `tdr:import-asked`	Remembers that we’ve already asked whether to move records from this browser into your account, so we don’t ask again.	Until you clear your browser’s data.
Records kept in this browser `tdr:data:v1`	Only if you used TheDayRate on this device before you had an account: those records, so you can move them into your account. The demo saves nothing.	Until you move them across or clear your browser’s data.

How long we keep it

Your account and everything in it: for as long as you have an account. If you delete your account, it’s deleted straight away, and copies in our database’s recovery history are gone within 30 days.
Sign-in records (device, browser and IP address): until you sign out or they expire, at most 30 days after you last use them. Counts of sign-in attempts are deleted after a day.
Links we email you (sign-in, confirmation and reset links): they stop working after 10 minutes to 24 hours, and are then deleted.
Tester places: while you have an account. They’re deleted if you delete your account.
Invites: until you join, or until we take the invite back.
Invoices you’ve emailed: the private link and the record of who it was sent to are kept with your account. They’re deleted if you delete your account.
Your HMRC connection: until you disconnect it in TheDayRate, or HMRC’s access ends. Anything you’ve sent to HMRC stays with HMRC.
The waitlist: until TheDayRate opens, or sooner if you ask us to remove you.

Keeping invoices and business records for HMRC is your responsibility. Download a backup from Settings before deleting your account if you need to keep them.

Keeping it safe

Everything travels over an encrypted connection. Passwords are stored as hashes, never as text. Each person can only ever reach their own data, and repeated wrong passwords are slowed down. If something ever went wrong that put your information at risk, we’d tell you and, where the law requires it, the Information Commissioner’s Office.

Your rights

You have the right to:

see the information we hold about you
have it corrected if it’s wrong
have it deleted
take a copy with you, in a format other software can read
ask us to stop or limit using it
object to us using it for our legitimate interests
withdraw your consent, for example by leaving the waitlist

You can do most of this yourself in Settings: change your details, download a backup of everything, or delete your account. For anything else, email [email protected] and we’ll reply within a month. We don’t make decisions about you by automated means that have legal or similarly significant effects.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.

Children

TheDayRate is for people running their own business. It isn’t meant for anyone under 18, and we don’t knowingly collect information about children.

Changes to this policy

If we change this policy in a way that matters, we’ll email you before it takes effect. The date at the top shows when it last changed.