Privacy Policy

We Are Singular, Lda, incorporated in Portugal (NIPC: PT513858512), operates Daaam. Contact us at humans@daaam.app. Our designated project data-protection contact is Bruno Afonso at bruno@wearesingular.com.

This policy describes the Service as it operates today. We will update it before introducing materially different processing, including payment processing or new monitoring.

An asset is an image, video, document, or other file you manage in Daaam, including any previews or edits made from it. A Workspace is the shared space where you organise assets and control access. These terms are defined in our Terms of Service.

When Daaam is a controller or processor

We Are Singular is the controller for the account, profile, waitlist, onboarding-email, security, and operational data that we decide how to use to operate Daaam.

For assets, metadata, comments, and other personal data that a customer places in a Workspace, We Are Singular generally acts as a processor on the Workspace customer’s instructions. The customer or organisation that controls the Workspace is responsible for having a lawful basis to upload, organise, share, and otherwise use that data. If you use Daaam on behalf of an organisation, that organisation may be the controller of your Workspace activity and content.

For a Data Processing Agreement, contact humans@daaam.app.

Data we process

Website and waitlist data

We use your email address to manage the waitlist and send the communications you requested. A timestamp stored in your browser limits repeated submissions; it does not contain your email address.

Our website receives ordinary request information, such as IP address, browser information, page address, time, and response status, to deliver and protect the site.

Account, profile, and authentication data

Email address, account and session identifiers, display name, job title, profile-image URL, and information used to display a default avatar
Password and session information needed for authentication; Daaam does not store your plaintext password
Workspace memberships, roles, permissions, invitations, API-key metadata, and registered webhook configuration
Email-verification status and recent verification-email send times used to limit repeat requests
First-upload, first-share, and first-invitation times used to record onboarding progress

Onboarding emails

We send new users a welcome email and guidance on uploading assets, creating a share, and inviting a teammate. Messages are selected automatically according to whether you have reached those steps, including reminders when a step has not yet been completed.

We may add onboarding guidance for new core features as Daaam evolves. We will update this policy before using additional personal data or introducing materially different processing for that guidance.

For accounts created after this feature is introduced, our email provider receives your email address, account identifier, first name when available, signup method, and signup and first-use progress for your first completed upload, share-link creation, and invitation sent. This does not include assets, filenames, search terms, Workspace content, share recipients, or invitees’ email addresses. The invitation milestone relates to the person sending the invitation. Existing accounts are not added in bulk.

This email processing is separate from optional product analytics and does not depend on your analytics choice. Every onboarding email includes an unsubscribe link. You can also object to this processing by emailing humans@daaam.app. Daaam does not currently offer an onboarding-email toggle in Profile. Unsubscribing stops these emails but does not delete the contact record or stop onboarding-progress updates. You can request deletion through our manual procedure. Necessary account, security, invitation, and share-delivery messages are sent separately.

Our email provider processes contact, message-delivery, and unsubscribe records on our behalf. Depending on the email settings, it may also record email opens and link clicks. This email measurement is separate from the consent-gated analytics in the application.

Legal basis: legitimate interests in providing limited guidance on using the account you created (GDPR Art. 6(1)(f)), subject to your right to object. Promotional communications require a separate lawful basis and prior consent where required by applicable electronic-communications law; accepting the Terms is not marketing consent.

Workspace content and metadata

Assets, including uploaded images, videos, documents, edits, watermarks, and previews
Filenames, descriptions, alternative text, folders, boards, tags, workflow states, comments, favourites, share-link configuration, custom properties, copyright records, and shared Licences
File information such as type, size, dimensions, colour data, and processing status
Embedded metadata, which may contain names, copyright details, dates, camera or software information, and location data
AI-generated descriptions, object labels, visible text, colour, mood and style labels, and suggested focal points
Search data derived from asset content and metadata for semantic and similar-image search; text and image queries submitted to search
Media source URLs, attachment identifiers, titles, captions, descriptions, alternative text, and associated post titles and links supplied through a connected WordPress site
Information about requested ZIP downloads and temporary download archives

You are responsible for reviewing asset metadata and for having permission to upload personal data relating to other people.

Activity, security, and support data

We keep activity records and diagnostic information needed to operate and protect Daaam. These include Workspace audit events recording the acting user, action, affected content identifiers, event details, IP address, browser information, and time; request logs recording the method, path, status, duration, account identifier, and Workspace identifier; and upload, processing, delivery, and error information needed to operate and troubleshoot the Service. Workspace owners and admins can view Workspace audit records, including recorded IP addresses.

We also keep usage records containing operation times, resource-use and cost estimates, and Workspace, asset, and related operational identifiers.

We also process messages and files you choose to send for support.

Optional product analytics

Signed-in users may explicitly opt in to limited product analytics. We do not collect product-analytics events for you before you opt in. Operational exception capture described below is separate and is not part of this opt-in.

Analytics uses pseudonymous account and Workspace identifiers and limited information such as the application screen, upload method and asset count, search mode and result count, asset category, share creation, or invited-member role. Successful semantic-search events include the submitted search term, information about its length and word count, whether it returned results, and its duration. Search terms can contain personal or confidential information, so do not enter information you do not want included in optional analytics. Similar-image searches do not send the selected filename.

Browser analytics events include the full application URL at the time of the event. The URL can contain the Workspace identifier, content identifiers, query parameters (including submitted search terms), and a fragment. Do not place personal, confidential, or secret information in application URLs or search terms.

We do not intentionally include your name, email address, filenames, comments, or assets in analytics events. Our analytics provider receives ordinary network information when your browser sends an event. We discard IP addresses for analytics and do not use session replay, automatic interaction recording, heatmaps, automatically displayed surveys, automatic error reporting, or web-performance monitoring as part of optional product analytics. In-app feedback you choose to submit is described separately under In-app feedback.

We record your analytics choice, the applicable notice version, and when you made the choice. You can withdraw consent at any time in Profile. Rejecting a renewed notice or withdrawing consent stops collection and removes saved analytics identifiers from your browser. A material change to the analytics notice requires a new opt-in.

Operational exception tracking

We collect unexpected application errors to diagnose failures, protect reliability, and recover service issues. This is separate from optional product analytics and is not controlled by the product-analytics consent preference. Error reporting does not use session replay or automatic interaction recording.

Error reports may include the error type, message, diagnostic details, response status, and information about where the error occurred. Reports from your browser include the full application URL, which can contain the Workspace identifier, content identifiers, query parameters (including search terms), and a fragment. Server error reports include the request path without query parameters. Reports concerning asset processing may also include asset and Workspace identifiers.

When you are signed in, server error reports may use your pseudonymous account and Workspace identifiers independently of analytics consent. Browser error reports attach those identifiers only when your current product-analytics consent is effective; otherwise they are not linked to your account. Anonymous server and asset-processing reports are not used to create personal profiles or derive location information from IP addresses.

Legal basis: legitimate interests in operating, securing, and improving the reliability of the Service (GDPR Art. 6(1)(f)).

We discard IP addresses for error reports and do not intentionally include names, email addresses, filenames, comments, or assets. Error messages and diagnostic details may nevertheless contain incidental personal information if the error or URL exposed it. Error reports are retained for 12 months. Error tracking does not save cookies or persistent browser storage.

See the Cookie Policy.

In-app feedback

Daaam offers an optional feedback form from the sidebar and application error page. Feedback is separate from optional product analytics and operational exception capture, and is not controlled by the product-analytics consent preference. Submitting the form is your consent to send the message and the details described here.

A feedback submission includes your message, your profile name when available, and the application URL reduced to its origin and path. Query parameters and fragments are removed, so search terms and one-time tokens in those parts of the URL are not sent. When you are signed in with effective product-analytics consent, feedback also includes your pseudonymous account and Workspace identifiers. Feedback submitted from the error page may be linked to the related error report. Your message can contain personal or confidential information if you enter it; do not enter information you do not want included.

Legal basis: consent, given by submitting the form (GDPR Art. 6(1)(a)); and our legitimate interests in diagnosing and resolving issues and improving the Service (Art. 6(1)(f)).

Retention: feedback is retained for 12 months.

Browser storage: feedback does not save cookies or persistent browser storage. See the Cookie Policy.

Avatar-request data

To display a default avatar, the avatar provider and its delivery providers receive information that may be based on your name, email address, or account identifier, together with ordinary request data such as your IP address and browser information.

Blog author avatars use a one-way hash of the Daaam author’s email address, not the visitor’s email address. The avatar provider and its delivery providers still receive ordinary visitor request data, such as IP address and browser information.

Billing data

Daaam does not currently offer paid plans or accept payments. We therefore do not currently collect payment-card or billing data for the Service. If billing or new monitoring is introduced, we will update this policy and the Terms before that processing begins.

Why we process data

Purpose	Typical GDPR basis
Create accounts; authenticate users; provide Workspaces and features	Performance of a contract (Art. 6(1)(b))
Store, transform, analyse, organise, search, and deliver Workspace content	Customer instructions; the customer is responsible for its lawful basis
Send invitations, security notices, and other service messages	Contract and legitimate interests (Art. 6(1)(b), Art. 6(1)(f))
Provide onboarding guidance based on signup and first-use milestones	Legitimate interests (Art. 6(1)(f)); you may object at any time
Operate logs, audit trails, abuse controls, and service recovery	Legitimate interests in security and reliability (Art. 6(1)(f))
Capture unexpected application errors for diagnosis and recovery	Legitimate interests in security and reliability (Art. 6(1)(f))
Receive and act on feedback you submit through the in-app form	Consent by submission (Art. 6(1)(a)); legitimate interests (Art. 6(1)(f))
Manage the waitlist and optional waitlist communications	Consent (Art. 6(1)(a)); you may withdraw it at any time
Collect optional, limited product-analytics events	Consent (Art. 6(1)(a)); you may withdraw it at any time
Respond to rights requests, binding orders, and other legal obligations	Legal obligation (Art. 6(1)(c)); legal claims where applicable

We do not rely on a billing or tax-retention purpose today because the Service does not currently process payments.

How we use Workspace content

We process content to store, transform, organise, analyse, search, watermark, preview, share, and deliver it, and to secure and support those operations. We do not sell or monetise Workspace content or its metadata. We do not use it to train our own or another party’s AI or machine-learning models.

AI image analysis

Eligible images are analysed automatically unless the upload or integration request specifies that analysis should be skipped. Authorised users can also request analysis later. Analysis produces descriptions, object labels, visible text, colour, mood and style labels, and suggested focal points for cropping.

Analysis uses the image and selected metadata: filename, title, description, caption, keywords, capture date, location (including GPS coordinates where present), creator, credit, and copyright information. This context can contain personal data. Generated metadata and focal points are stored with the asset and may be used in search, displayed to authorised users, or sent to an integration configured by the customer. We do not authorise providers to use Workspace content for model training.

AI output can be incomplete or inaccurate. It assists asset discovery and editing; it does not establish identity, copyright ownership, permission to use an asset, or facts about a person. Daaam does not use this analysis for facial recognition, biometric identity matching, or decisions that produce legal or similarly significant effects on people.

Semantic and similar-image search

Semantic search finds assets by meaning as well as by words in their metadata. Similar-image search uses asset images and the reference image you submit to find relevant assets. Search data includes information derived from asset content and metadata, asset and Workspace identifiers, and supporting information such as uploader identity, upload date, and image orientation. It can reflect personal information in the source content and is treated as Workspace data, not anonymous data. Search operates within the requesting Workspace, with results subject to your access permissions. Preparing content for search does not publish it or make it searchable by other Workspaces.

Skipping AI image analysis does not disable normal media processing or metadata-based search. A reference image submitted only for similar-image search is processed to answer that search; it is not added as an asset to the Workspace or retained as part of its asset-search data. Optional analytics and operational logs may separately receive search information as described above.

Media processing and access

We process assets for metadata extraction, previews, transformations, watermarking, and downloads. Authorised personnel may access content only where reasonably necessary for support requested by a customer, security or incident response, service recovery, or a binding legal obligation. The providers listed below process content as needed to provide their part of the Service, under their applicable terms.

We disclose data only in these situations:

To other members of the Workspace according to the Workspace’s roles and permissions
To people who receive a share link, including a public or password-protected share
To the infrastructure and communications providers listed below
To a webhook endpoint, WordPress site, API client, or other integration that a Workspace owner or authorised API-key holder configures
To professional advisers, authorities, or another party where required by binding law or reasonably necessary to establish, exercise, or defend legal claims
As part of a corporate transaction, with appropriate confidentiality and notice where required

Customer-configured webhook endpoints, WordPress sites, API clients, and share recipients are not Daaam sub-processors. They are recipients selected by the customer. A webhook may receive asset and folder identifiers, name, alternative text, caption, description, tags, and focal points. Customers are responsible for the destination, its security, and its own privacy terms.

WordPress integration

The DAAAM Media plugin connects a WordPress site to the Service using an API key configured by the site operator. Daaam’s Terms of Service and this policy apply to the connected Service. The WordPress site operator remains responsible for its own website, privacy notice, hosting, and other plugins.

Depending on the enabled features and the key’s permissions, the integration:

Sends uploaded or migrated assets to Daaam, including filenames, file metadata, source URLs, attachment identifiers, titles, descriptions, captions, and alternative text
Sends the title and link of the post associated with an attachment, where available
Sends search queries and requests asset information, folders, previews, and media for browsing and insertion
Synchronises supported metadata between Daaam and WordPress and sends configured updates, including asset availability and focal points
Delivers assets published on the site through Daaam and its delivery providers

When visitors load that media, we and our delivery providers receive ordinary request data, such as IP address, browser information, media address, and time. The plugin does not add Daaam product analytics to your site’s public pages. The site operator remains responsible for its own privacy notice, cookies, and other plugins.

Assets sent through the plugin are subject to the same processing, AI analysis, search, and retention described above.

Disconnecting or uninstalling the plugin, or rolling back a migration, does not delete the assets already held in Daaam. Deleting a WordPress attachment moves the Daaam asset to Trash only when the site’s optional setting and API-key permission allow it. Permanent deletion from Daaam is a separate action. Copies, metadata, and backups held by WordPress or its host must also be handled by the site operator.

Current service providers

Provider	Purpose	Data and location
Supabase	Database and authentication	Account and Workspace data; database in Europe
Backblaze	Asset storage	Assets; storage in Europe
Cloudflare	Application hosting on edge workers, CDN, security, email, AI search and analysis, and usage accounting	Request information, usage records, and the content needed to provide these features; global network
Modal	Compute and media processing	Assets, reference images, and related information needed for processing
Loops (Astrodon Corp.)	Waitlist and onboarding emails	Contact details, onboarding progress, delivery and unsubscribe records; United States
DiceBear (Florian Körner)	Default avatars	Avatar information and browser request data
Automattic (Gravatar)	Blog author avatars	Author email hash and visitor request data
PostHog EU Cloud	Optional analytics, error reporting, and feedback	Usage, diagnostic, and feedback data described above; Europe

See GDPR & Data Processing for first-party provider documentation and international-processing details.

Storage and security

Assets are stored in Europe. We use encrypted connections and role-based access controls, restrict access to sensitive credentials, and redact credentials in application logs.

A person who obtains a valid direct media link may retrieve the asset without signing into Daaam. Anyone who holds a valid link may use it. Share links can also be forwarded by their recipients. Use share passwords and expiry controls where appropriate. Daaam does not provide end-to-end encryption or account-based access restrictions on every direct media request. Do not upload material whose risk profile requires those protections.

No online service can guarantee absolute security. Contact humans@daaam.app if you believe data or credentials have been exposed.

Retention

Account and profile data: Retained while the account is active and then handled through the manual deletion procedure described on our GDPR page
Workspace data and content: Retained while the Workspace exists. Moving an asset to Trash hides it but does not start an automatic 30-day deletion; it remains until an authorised user restores or permanently deletes it
AI metadata and search data: Retained with the asset, including while it is in Trash. Permanent asset deletion also initiates removal of the associated generated metadata and search data, which may take time to complete
Temporary uploads and downloads: Incomplete uploads and temporary downloads are subject to cleanup. An unsuccessful upload may leave an asset record, including its filename, declared size, file type, and uploader, so users can see the failure; that record remains until the asset is deleted. A completed ZIP download is offered for 24 hours; related temporary records and files may remain briefly while cleanup completes
Workspace audit data: Retained with the Workspace. If an account is removed from a shared Workspace, its activity records may remain for accountability, but we will remove or anonymise personal fields where required by an approved deletion request
Sign-in data: Sign-in cookies have configured lifetimes of up to 7 days and session-renewal cookies up to 30 days. Sign-in access may end earlier on sign-out, revocation, or account deletion
Waitlist data: Retained until you unsubscribe, request deletion, or the waitlist purpose ends, subject to limited provider, legal, and suppression records
Onboarding-email data: First-step times remain with the account profile. Contact and associated onboarding records do not expire automatically. We remove them through an approved deletion request or when the onboarding purpose ends. Unsubscribing stops emails rather than erasing records; limited suppression records may remain to prevent further emails. Provider deletion and backup limits still apply
Operational logs: Retained for the period reasonably needed for security, reliability, troubleshooting, and legal claims. We do not currently publish a single fixed retention period because the period depends on the type of record
Product analytics, operational exceptions, and feedback: Retained for 12 months. Your product-analytics consent decision and notice version remain with your account so Daaam can enforce the current preference
Backups: Deletion is applied to live systems first. Residual backup copies, if present, remain isolated from normal use until the applicable backup cycle expires. If a backup is restored, completed deletion requests must be reapplied
Billing and tax records: None are created by the current Service. If payment processing is introduced, the applicable records and retention periods will be disclosed before billing begins

Copies downloaded or held by customers and their integrations are outside our deletion process.

International processing

Service providers and customer-selected destinations may process personal data outside the EEA. The provider list above identifies their roles and locations.

International transfers subject to GDPR require an applicable transfer mechanism and supplementary measures where required. Provider locations and sub-processors can change; contact our data-protection contact for the current contractual details. A customer that selects an external webhook, WordPress/API destination, or share recipient is responsible for the transfer it instructs us to make.

Your rights

Subject to the conditions and exceptions in applicable law, you may request access, rectification, erasure, restriction, portability, or objection, and may withdraw consent. These rights apply to all our users where doing so is practical, even when the GDPR does not directly apply.

Email humans@daaam.app or contact Bruno Afonso. We normally respond within one month after receiving and, where necessary, verifying a request. See our GDPR page for the complete request and deletion procedure.

Law-enforcement and illegal-content requests

We may preserve or disclose data where required by binding Portuguese or EU law, a valid court order, or another lawful request from a competent authority. We review requests and limit disclosure to data we hold that is legally required.

If we become aware of apparently illegal or seriously harmful content, we may restrict access, preserve relevant evidence, and report it where required or permitted by applicable law. This statement does not claim that Daaam currently performs general automated content scanning.

Supervisory authority

You may lodge a complaint with the CNPD (Comissão Nacional de Proteção de Dados) or, where applicable, the data protection authority in your EU/EEA country of residence or work.

Cookies and browser storage

We use necessary sign-in and protected-share cookies, a timestamp to limit repeated waitlist submissions, and browser storage for analytics only after you opt in. Error reporting and feedback do not save cookies or persistent browser storage. We do not use advertising or cross-site tracking cookies. See the Cookie Policy.

Children

Daaam is not directed at individuals under 16, and accounts may not be created by anyone under 16. Contact us if you believe a child has provided personal data contrary to this policy.

Changes to this policy

We will update the date at the top when this policy changes. Where a change materially affects how we process personal data, we will provide any advance notice or renewed choice required by applicable law before the change takes effect.