The short version
Dyal uses the data needed to organize and share schedules, manage accounts and maintain the service. We do not sell personal data or share it for targeted advertising. We do not use the content of your schedules to train artificial intelligence models. You may request access, a copy, corrections or deletion, as applicable.
Who is responsible for your data
Dyal is operated by Industria Creativa JoseDEspinal, EIRL, a company registered in the Dominican Republic. Tax registration number (RNC): 131-23335-1. For privacy matters, contact [email protected].
We are the controller for data we use to administer accounts, answer inquiries and protect the service. When an organization determines why and how data in its schedules is used, that organization is the controller and Dyal processes the data on its behalf under lawful instructions and the applicable processing agreement. This does not remove our own legal obligations. Personal or household use may receive different legal treatment.
What data we use and where it comes from
- Account: name, email, language, appearance preferences and password stored as a hash, not readable text. If you choose Google, we receive your account identifier, name and email. We do not request access to your Google contacts or calendars.
- Schedules: schedule names and settings, people listed and their colors, shifts, dates, times, labels, members and permissions. You or other authorized people enter this information.
- Invitations: the email address provided by the person inviting you and the information needed to manage the invitation.
- Technical data: IP address, browser information, sessions and logs needed to operate and protect the service. These may also be generated when visiting the site or opening a shared link without an account.
- Inquiries: your email, message content and information you provide to help us resolve them.
We currently do not request payment details or access to your device’s precise location. Do not include sensitive or unnecessary information in names, labels or messages. Free text can contain personal data even if there is no dedicated field for it.
How we use it
When we act as controller, we use the following grounds to the extent recognized by applicable law:
| Purpose | Legal basis |
|---|---|
| Create your account, authenticate you, display your schedules and provide requested features | Performance of our contract with you |
| Manage access for an organization’s representatives or invitations sent by users | Legitimate interest in providing the requested collaboration and administering the relationship with that organization |
| Protect the service, prevent abuse and resolve technical problems | Legitimate interest in maintaining a secure and reliable service |
| Handle inquiries and requests | Performance of the contract for inquiries about the contracted service; legitimate interest in answering other inquiries; legal obligation for rights requests where applicable |
| Comply with valid legal requirements | Compliance with a legal obligation applicable to the processing |
We rely on legitimate interests only when your rights and interests do not override them. When we act on behalf of an organization, that organization is responsible for determining and communicating its legal basis.
Data needed to create and maintain an account is required to provide that service. Google is optional: you can register using email. This policy provides information about processing; reading it or continuing to use Dyal does not constitute consent to new uses. If an optional feature requires consent, we will request it separately and you may withdraw it.
We do not use your data for solely automated decisions that produce legal or similarly significant effects on you.
If you appear in a schedule without an account
Your name and shifts may have been entered by the person managing the schedule. That person or organization must be entitled to do so and provide any required information. You may ask them for changes directly or contact us. When we process the data on an organization’s behalf, we will forward the request to it and assist with handling it; you do not need an account to contact us.
Who can see the data
People with access to a schedule may view or change information according to their permissions. Anyone with a shared week link can view it without an account and forward the link. Revoking it does not remove copies or screenshots others have saved.
Our authorized personnel may access data when needed for support, security or operations.
Providers acting on our behalf must process data under the applicable instructions and contractual obligations. Some external services, such as the Google account you use to authenticate, also have their own terms and policies for their independent processing.
We may disclose information when there is a valid legal obligation or when necessary and permitted to defend rights or address security incidents. We will limit disclosure to what is appropriate in each case.
Processing in other countries
We operate from the Dominican Republic and our providers may process data in other countries.
Where an international transfer requires specific safeguards, it must be covered by the appropriate legal mechanism. You may contact us for information about safeguards and request a copy, subject to necessary legal limitations to protect confidential information. Using Dyal does not, by itself, constitute consent to transfers without safeguards.
Cookies and similar technologies
We use cookies to maintain your session and remember your sign-in when requested. We currently do not use advertising or analytics cookies. You may delete or block cookies in your browser, although some features may stop working.
Cookies and storage used: If we introduce technologies requiring consent, we will request it before activation and allow withdrawal.
How long we keep data
Where we must keep information for a legal obligation or a claim, we limit it to what is necessary, restrict its use to that purpose and delete it when the need ends. Closing your account does not automatically remove records another organization must lawfully retain about you in its own schedules.
Security
We apply technical and organizational measures appropriate to the risk and limit access to those who need it. No system guarantees absolute security. If an incident affects your data, we will make the notifications required by applicable law and, when acting on an organization’s behalf, inform it as required by our obligations. You may report incidents to [email protected].
Your rights and how to exercise them
Depending on applicable law, you may request access, correction, deletion, a copy or portability of your data, restrict processing or object to certain uses. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Rights may have conditions and exceptions; we will explain any refusal or limitation. We will not treat you unfavorably for exercising them.
Contact [email protected]. We will request only proportionate information needed to verify your identity or a representative’s authority. We respond within the applicable legal deadline; where the GDPR applies, normally within one month, and will explain any lawful extension and its reason within that period.
You can export weeks using Dyal’s available options and delete a schedule in its settings. For a complete copy or account closure, contact us. Exporting a schedule and exercising access rights to your own data are different requests: we will also protect other people’s rights.
You may complain to the competent data protection authority, including one where you live or work when the law permits. You do not need to contact us first or use only Dominican authorities.
Children
Dyal accounts are intended for people who are at least 18 and legally able to enter into a contract. We do not knowingly allow accounts below that age. An adult may include minimal information about children in a family schedule when entitled to do so. Avoid publicly sharing details that could reveal a child’s whereabouts. If you discover a child’s account or improperly entered information about a child, contact us so we can investigate and take appropriate action.
Changes to this policy
We will publish updates and their date here. If a change materially affects how we use your data, we will notify you by email or a visible notice before applying it, unless a legal obligation requires otherwise. Where consent is required, we will request it separately. No change reduces your mandatory rights.
Talk to us
Anything about your information, or anyone else's, goes to [email protected].