This policy explains what personal data Daawid processes, why and for how long. It covers daawid.com, the console where owners manage their entries, Daawid's MCP server for AI apps, its REST API at api.daawid.com, and the emails Daawid sends. In short: the public pages set no cookies and use no trackers, and we keep nothing about the people who read them.
Contact
Write to contact@daawid.com about anything in this policy.
Reading Daawid's pages
When you open a page on daawid.com, your browser sends a request with your IP address and technical details, such as the browser's name (its user agent). Cloudflare, which hosts Daawid, processes these to deliver the page and to protect the site from attacks. Daawid itself stores none of them.
The pages set no cookies, store nothing in your browser, run no scripts and load nothing from other companies: fonts and images come from Daawid's own addresses.
We count how often each page is read: which page, its language, the response code, and a category of reader, such as a person or the AI assistant of a named AI company. The category comes from the user agent, which is read in memory and then discarded. We store no IP address, no user agent, no cookie, no referrer and no location, so a count says nothing about who read the page. Single counts are kept for 3 months, daily totals for as long as the entry exists.
Legal basis: our legitimate interest in delivering and protecting the site and in knowing how it is read (Art. 6(1)(f) GDPR).
AI apps that search Daawid
AI apps such as Claude and ChatGPT search Daawid for their users through its MCP server, and anything else can through its REST API. For each search we keep, for 30 days: the day (no time of day), which AI company's app asked, as the app names itself or as its user agent says, what was asked (the words, a place, a category, filters) and which entries were found, in which order. Nothing ties a search to a person or to another search: no IP address, no account, no session and no cookie. To see what is missing, the person who runs Daawid sees totals, and the words of searches that found nothing once the same search came at least 3 times within 30 days.
After 30 days only counts remain: searches per day and AI company, how often each entry was found and at which position, and the words of a search only if the same search came at least 10 times within 30 days. The owners of an entry see these counts for their entry, including the words of such frequent searches, and how many searches of the last 30 days were for what the entry does, where it works. They also see which of the words their own entry says searches matched, and how often it was found through each of its categories, month by month and for as long as the entry exists: only what the entry says itself, never other words a search had. Each entry an AI app or a caller of the REST API opens, and each card an AI app receives to show its user, is counted like a page read, by the same categories of reader.
To limit abuse, we count each kind of caller's reads through the MCP server and the REST API per minute and IP address. The count and the address are in memory for that minute, written nowhere, and then gone.
Daawid makes no automated decisions about anyone. Search results are ordered by fixed rules, the same for everyone: https://daawid.com/docs/ranking.
Legal basis: our legitimate interest in improving search and its order, in showing owners how they are found, and in finding abuse (Art. 6(1)(f) GDPR).
Requests to an entry's owner
Some entries take requests through Daawid: messages, callback requests, appointment requests and quote requests. When your AI app prepares one for you, we keep what it sends: your name, your email address, your phone number and language if given (a callback request always has a phone number), what you want to send, such as the times that suit you, a postal code, when you would like the work done and your budget, which entry and offering it is for, and which AI company's app made it. Nothing goes to the entry's owner until you confirm it on Daawid's page: for every request, we email you a six-digit code, which you type in there before you press Send. The code email names the entry and holds the code, nothing of your request. We keep the code and the page's link only as coded values (hashes).
When you send a request, we email it to the entry's owner, who can answer you at your email address, and show it in their inbox in Daawid's console, where the people who run the entry on Daawid can read it, mark it as won or lost, or delete it. From then on, the owner is responsible for what they do with your data, under their own privacy notice, which the page links to. An entry without a notice of its own has Daawid's standard one, which names the owner as responsible.
To limit abuse, we count the code emails for an hour: per email address, under a coded value of it, and per browser, under a keyed hash of its IP address; then the counts are gone. We count each request's steps (made, sent, delivered, opened by the owner, and won or lost, as the owner marks it) per entry, day, AI company and kind of request, with nothing about you.
Legal basis: taking the steps you asked for (Art. 6(1)(b) GDPR), and our legitimate interest in preventing abuse and in showing owners their requests (Art. 6(1)(f) GDPR).
Reporting an entry
Anyone can report an entry to Daawid on its report page, which every entry page links to. We keep what you give us there: what you say is wrong, your explanation, your name, your email address and your statement that the report is accurate and made in good faith, with which entry and which version of it you reported, and when. We email you a six-digit code first, and the report counts once you type it in. We keep the code and the page's link only as coded values (hashes), and count the code emails for an hour, as for requests.
A confirmed report goes into Daawid's review queue, where Daawid's reviewers read it, with your name and email address. A person decides whether the entry is suspended, and we email you the decision with its reason. We tell the reviewers by email that a report came in, without your name or address. If the entry is suspended, its owners get our reason by email; we don't give them your name or email address unless the law obliges us to.
Legal basis: our duty to handle reports about what we host and to tell those concerned about our decisions (Art. 6(1)(c) GDPR, with Art. 16 and 17 of the Digital Services Act), and our legitimate interest in keeping fakes and fraud off Daawid (Art. 6(1)(f) GDPR).
Owners: your account and your entries
To publish an entry, you sign in with your email address. Clerk handles the sign-in: it sends the code or link that confirms your email address, keeps you signed in with cookies on the console, which are needed for that, and tells us your email address and an ID. Addresses at disposable-email services can't sign up: we check the address's domain against a public list of such services, and keep nothing of the check. We store your account (that email address, the ID and when you signed up), your organization and its members, your entries with their drafts and published versions, and a log of important actions, such as publishing, deleting an entry or connecting an AI app.
What you publish is public on purpose: anyone, people and AI apps alike, can read it. Each published version replaces the one before on the public pages, at once. We keep earlier versions in our database, where nobody else can read them, for 90 days after a newer one replaced them, so that a mistake can be put right, or for as long as a request or a report still refers to them. After that, only their number and dates stay. If your entry names other people, such as your staff, you need their consent or another right to publish their details.
You can have Daawid fill in your entry from your website. Daawid then reads the address you give and up to seven more pages of the same site, keeping to what its robots.txt allows. What the pages state goes into an import, which we keep for 30 days; nothing from it is published until you have checked it. To read the pages' text, Daawid sends it to Anthropic, whose model Claude writes down the facts the pages state.
You can have Daawid check what AI assistants tell customers about you. Daawid then sends Anthropic a customer's question with your entry's name, what it is and its town; Anthropic's model Claude searches the web and answers. Daawid then sends Anthropic that answer with your entry's name, ways to reach you, places, opening hours and offerings, and Claude says what the answer gets right, wrong or leaves out. We keep each check, with the answer and the pages it cites, for 90 days.
Pictures you upload, such as your logo or photos of your work, are public at media.daawid.com as soon as you upload them, at an address no one can guess, so that your page can show them. Before we store a picture, we remove its location, camera and time details (EXIF, XMP and IPTC data, comments and text); photos are also made smaller in your browser before they are sent. We store the picture, its type, size and dimensions, which account uploaded it for which entry, and when. If people can be recognized in a photo, you need their consent or another right to publish it.
You can switch on requests from AI apps for an entry: messages, callback requests, appointment requests and quote requests, each by itself. Daawid then emails each request to the address you choose: the one you sign in with, or another one, to which we first email a link to confirm it. That email names the entry, not you. Nothing goes there before someone confirms it, and for 24 hours after that: we email every owner of the entry, at the address they sign in with, a link that stops the change without signing in. We keep the address with the entry, never published, for as long as the entry exists; the links we sent are kept for 7 days after the change started, was stopped or cancelled, or ran out, and only as coded values (hashes). When requests are switched on or go to a new address, we email every owner of the entry at the address they sign in with. In your inbox, we keep when a request was opened and whether it was marked won or lost; your insights count these steps, without the sender.
You can add your website to an entry, so that the entry shows that Daawid confirmed you control it. We store the website's address, the record we issue for it (a random token, which is public once you add it to your DNS or your website), the name of your DNS provider when we recognize it from public DNS, which owner added the website and when, and when each check ran and what it found. To check, Daawid asks the public DNS resolvers of Cloudflare, Google and Quad9 for the record; only when DNS has none does it read your website's home page and the file /.well-known/daawid, as DaawidVerifier (https://daawid.com/docs/verifier). A verified website is public in your entry, with the dates Daawid verified it and last found its record. Daawid checks it every day for a week, then every week, and emails every owner of the entry when a website is added, removed or verified, when its record is missing, when it is back, and when it no longer counts. A removed website's record stays with the entry, so that it counts again if you add the website back. When another organization's entry shows control of the same website, the newer one doesn't count yet, and we check both records: if the first entry's record is gone, we email its owners, without naming the other organization, and the website moves after 7 days unless their record is back; if both records are there, a person at Daawid decides whose it is, and we email both entries' owners the decision with its reason, to which they can reply. When the public DNS resolvers keep giving different answers for a website's record, a person at Daawid looks into it.
If Daawid suspends one of your entries after a report, or after its own checks, we email every owner of the entry our reason, and you can reply to appeal; a person at Daawid reads every reply. We keep the decision, its reason and which reviewer made it with the entry, and log when it was made and lifted. We tell Daawid's reviewers by email when a website check needs a person, naming the entries and the website.
Each entry has a plan: Free, Pro or Business. We store which plan an owner chose for it, when, and which account chose it, and whether an owner said they keep a paid plan when we asked before 1 March 2027. When an entry has had all the requests its plan takes in a month, we count each request that couldn't come through, with nothing about the customer, and show the count to its owners. Nobody is charged without adding a card; when charging starts, the payment details go to the payment provider we name here then.
You can export an entry and delete it in the console at any time. A deleted entry disappears within a minute, with the requests and reports about it; its address is kept only as a coded value (a keyed hash), so that it is never given to anyone else, and its daily counts are deleted. To delete your account, write to contact@daawid.com from its address: we then delete it, its entries and the log of its actions.
Daawid sends you emails through Resend: a welcome when you sign up, a reminder before what you said about your capacity runs out, a link to confirm a change you asked for from an AI app, a link to confirm another address for an entry's requests, a note with a link that stops another address before requests go there, a note when an entry's requests are switched on or go to a new address, the requests customers send you through Daawid, if you take them, and the notes about your websites: when one is added, removed or verified, when its record is missing, when it is back, when it no longer counts, when another organization shows control of it while your record is gone and when it moved, and a reviewer's decision about whose it is; and about your plan: when an entry moves to another plan; once a month, when an entry's requests couldn't come through because its plan's requests for the month were used, how often that happened; and once before 1 March 2027, whether you keep a paid plan.
Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR); for the log, our legitimate interest in security and in tracing changes (Art. 6(1)(f) GDPR).
Owners: changes from an AI app
You can connect an AI app such as Claude or ChatGPT to your entries. When you allow it, we store which app it is (the web address it names itself by), when you connected it and when it was last used. The app gets a key that works for an hour, and a second key to renew it, of which we store only a coded value (a hash). A connection ends when you disconnect the app in the console, or after 90 days without use.
Changes to names, contact details, addresses and legal details wait until you confirm them with a link we email you, which works for 24 hours. A waiting change is deleted 7 days after it is confirmed, cancelled or expired. When your AI app reads your own entry while you are signed in, we count nothing for it: we check, in memory, which entries your account belongs to.
Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).
Who else processes data for us
- Cloudflare (USA; we keep the published entries and the pictures in its EU storage): hosting, network, storage of the published entries and the pictures owners upload, and counting. It sees every request to Daawid, including IP addresses.
- Neon (USA; our database is in the EU): Daawid's database, with accounts, entries, the search log and the counts.
- Clerk (USA): sign-in to the console.
- Resend (USA; we use its EU region): Daawid's emails.
- Google (USA): Daawid's mailbox, where emails to contact@daawid.com arrive and are answered.
- Anthropic (USA): reading the text of your website when you have Daawid fill in your entry from it, and answering and comparing when you run the AI check.
- Backblaze (USA; we use its EU region): Daawid's backups, encrypted before they leave, with a key only Daawid holds, so Backblaze can't read them.
- GitHub (USA): runs the daily job that makes the backups. The data passes through that job to be encrypted, on a machine that is thrown away when the job ends, and GitHub keeps none of it.
- Sentry (USA; we use its EU region): reports of errors in Daawid's own code, so that we hear when something breaks. A report says which part of Daawid it was, the kind of error, where in the code, and which route, by its pattern and not its address. It carries what the error says about itself, with email addresses, phone numbers, web addresses, IDs and keys taken out before it leaves. It holds no IP address, no account, and nothing of the request.
Each of them works for us under a data processing agreement, except GitHub, which offers one only to companies, and Daawid isn't one yet: GitHub runs that job under its own terms and privacy statement. Where data reaches the USA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified under it, as GitHub is, and otherwise on the EU's standard contractual clauses.
To check a website that an owner added to an entry, Daawid asks the public DNS resolvers of Cloudflare, Google (USA) and Quad9 (Switzerland) for its record. They see which name was asked, from Daawid's servers, under their own privacy policies.
After a publish, we send the addresses of the changed pages to IndexNow, a service shared by search engines such as Bing, so that they visit sooner. Search engines and AI crawlers read the public pages like any other visitor.
Google and Bing tell us, as they tell any site's owner, which searches led to our pages: the words of a search, the page, how often it was shown and clicked, and its average position, leaving out searches few people made and nothing about who searched. We copy these every night and show each entry's to its owners on their insights page. They come from Google's Search Console and Bing Webmaster Tools, in which Daawid has an account, under those companies' own terms.
How long we keep data
- Requests at Cloudflare: under Cloudflare's own terms; Daawid stores none.
- Single page counts: 3 months. Daily totals: as long as the entry exists.
- The search log: 30 days. After that, only counts, and the words of searches that came at least 10 times within 30 days.
- Which of an entry's own words searches matched: as monthly counts, as long as the entry exists.
- The searches on Google and Bing that led to an entry's page: as they report them, 24 months at most, and no longer than the entry exists.
- Accounts and entries: until you delete them. Earlier published versions: 90 days after a newer one replaced them, or as long as a request or a report refers to them; then only their number and dates.
- An entry's plan, who chose it and when, and which emails about it went out: as long as the entry exists.
- Imports from your website: 30 days.
- AI checks: 90 days.
- Requests to an entry's owner: one that wasn't sent, a day after it ran out (an hour after it was made) or was cancelled; a sent one, 90 days, or until the owner deletes it. Their counts stay, with nothing about the sender.
- The address an entry's messages go to: as long as the entry exists. The links to confirm such an address and to stop it: 7 days after the change started, was stopped or cancelled, or ran out (24 hours after the link was sent, if nobody confirmed it).
- Counts of code emails: one hour.
- Counts of reads per kind of caller and IP address: one minute, in memory only.
- Error reports: 30 days, at Sentry.
- Reports about an entry: one whose code wasn't typed in, within a day; a confirmed one, with the reporter's name and email address, a year after its decision, or when the entry is deleted.
- Decisions in the review queue: a year after the case was closed or the suspension lifted; a suspension that holds, as long as it holds; none longer than the entry.
- Websites added to an entry, with their records and what their last check found: as long as the entry exists, removed ones too, so that their records still count if they are added again.
- Pictures you upload: while your draft or your published entry uses them, then 30 days. When you delete a published entry, its pictures are deleted within a minute, unless another entry uses the very same picture.
- The log of important actions: as long as your account exists.
- Connected AI apps: until you disconnect them, or 90 days without use.
- Changes waiting for your confirmation: 7 days after they are confirmed, cancelled or expired.
- Emails you write to us: until what you wrote about is dealt with, unless the law obliges us to keep them longer.
- The address of a deleted entry: for good, as a keyed hash only, so that it is never given again.
- Backups of the database and the pictures, encrypted: 30 days, and gone for good within 8 days after that. So what is deleted above can stay in a backup that long, where nobody reads it. Should we ever have to bring a backup back, we delete again whatever we know was deleted since, and tell the owners that the changes of the last day may be lost.
Writing to us
When you write to contact@daawid.com, your email arrives in Daawid's mailbox at Google (Google Workspace), where it is read and answered. We use what you wrote to answer you. Legal basis: our legitimate interest in answering (Art. 6(1)(f) GDPR), or our duty, when you ask under the rights below (Art. 6(1)(c) GDPR).
Your rights
You can ask what data we have about you, and have it corrected, deleted, restricted or handed over in a common format (Art. 15 to 20 GDPR). You can object to processing that rests on our legitimate interest (Art. 21 GDPR). Write to contact@daawid.com, from the email address you are asking about, so that we can tell it is yours: we answer within a month. You can also complain to a data protection authority, in particular the one where you live or work (Art. 77 GDPR).
We can't tell which searches and page reads are yours, because we keep nothing that links them to a person.
Changes to this policy
When what Daawid does changes, this policy changes with it. The date at the top shows its version.