Privacy Policy

Effective Date: March 8, 2026

Last Updated: June 22, 2026

Laguna Goods, LLC, doing business as DayGist ("DayGist," "Company," "we," "us," or "our"), operates the DayGist service accessible at getdaygist.com (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein. If you do not agree with this Privacy Policy, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

When you register for and use the Service, we collect:

• Account registration information, including your email address, phone number, and account password
• Preferences, including your timezone and preferred daily message delivery time
• Payment information, which is collected and processed by our payment processor, Stripe, Inc. We do not receive, process, or store your full credit card number, expiration date, or CVV on our servers.

1.2 Information Collected Through Plaid

We use Plaid, Inc. ("Plaid") as our financial data connectivity provider. When you connect a financial institution through our Service, you authorize Plaid to access certain financial account information on your behalf.

Plaid may collect the following from your financial institution: (a) your financial institution login credentials, which are handled entirely by Plaid and are never transmitted to or stored by DayGist; (b) account balance information, including current and available balances; (c) account names, types, and institutional affiliation; and (d) account and routing numbers, used by Plaid for connection purposes.

From Plaid, DayGist receives only: account display names, account types (e.g., checking, savings, credit), current and available balances, and the name of the financial institution. We use this data solely to generate your daily balance summary text message.

For information about how Plaid collects, uses, and shares your data, please review Plaid's End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy. You may review and manage your Plaid connections at any time through the Plaid Portal at https://my.plaid.com.

1.3 Information Collected Automatically

When you interact with our website, we may collect: IP address (logged at the point of SMS consent for TCPA compliance purposes), browser type and version, pages visited and referring URLs, and timestamps of access.

We use privacy-respecting analytics to understand how users interact with our website. We also use the Meta (Facebook) advertising pixel solely to measure the effectiveness of our advertising and reach people who may be interested in DayGist. The pixel collects website-interaction data only (such as pages visited and whether you started a trial) — it never has access to your financial data, account balances, or bank credentials, which are governed by the pass-through model described in Section 2.

Under California law, use of the advertising pixel may constitute “sharing” of personal information for cross-context behavioral advertising. You can opt out at any time using the “Your Privacy Choices” link in our website footer, and we honor the Global Privacy Control (GPC) browser signal automatically. See Section 8.2 for your California rights. We do not load the advertising pixel for users who have opted out or whose browser sends a GPC signal, and if you opt out while browsing, we immediately stop the pixel and revoke its consent for the rest of your session.

2. Our Pass-Through Data Model

DayGist operates on a pass-through architecture for all financial data. This means:

(a) When generating your daily text message, our system retrieves your current account balances from your financial institutions via the Plaid API.

(b) The balance data is formatted into a text message and transmitted to your phone number via our SMS delivery provider, Twilio, Inc.

(c) The financial data — including all balance amounts, account numbers, and account details — is immediately discarded after message delivery. This data is NOT written to, stored in, or cached in our database, file system, or any other persistent storage medium.

(d) We retain only: (i) encrypted Plaid access tokens necessary to maintain your ongoing bank connection; (ii) delivery status logs consisting of a timestamp and success or failure status indicator, which contain no financial data content; and (iii) a truncated message preview limited to the first 50 characters, retained for 30 days solely for troubleshooting purposes.

(e) Your bank login credentials are never transmitted to, received by, processed by, or stored by DayGist at any point in the Service's operation.

3. How We Use Your Information

We use your personal information for the following purposes:

• To provide the Service, including fetching account balances, formatting and delivering your daily SMS summary, and managing your account preferences and connected financial institutions
• To process payments and manage your subscription through our payment processor, Stripe
• To maintain and improve the Service, including monitoring message delivery success rates, diagnosing connection errors, and improving message formatting and delivery timing
• To communicate with you regarding service-related matters, including account connection issues requiring re-authentication, billing confirmations and payment failures, trial expiration reminders, material changes to our Terms of Service or this Privacy Policy, and responses to your support requests
• To comply with legal obligations, including maintaining consent records as required under the Telephone Consumer Protection Act (TCPA), responding to lawful requests from regulatory or law enforcement authorities, and fulfilling our obligations under applicable financial data protection laws

We also use limited website-interaction data (such as pages visited and trial sign-ups) to measure and target our own advertising through the Meta advertising pixel, as described in Section 1. This never includes your financial data, account balances, or bank credentials. You may opt out of this advertising use at any time (see Section 1 and Section 8.2).

We do NOT use your information for: sale, rental, or commercial exchange with any third party for their own purposes; building financial profiles, creditworthiness assessments, or risk scoring; advertising by or on behalf of third parties (other than our own advertising measurement described above); any purpose not disclosed in this Privacy Policy. We never use your financial data for any advertising purpose.

4. SMS Communications and TCPA Disclosure

4.1 Consent

SMS consent is collected separately from account registration through a dedicated, optional consent checkbox presented during the sign-up process at getdaygist.com. By affirmatively checking the SMS consent checkbox, you provide your prior express written consent under the Telephone Consumer Protection Act (47 U.S.C. § 227) to receive recurring automated text messages from DayGist at the mobile phone number you provide. Your consent is provided freely and is not a condition of creating an account, completing a purchase, or accessing any other aspect of the Service. Users who do not provide SMS consent will receive their daily balance summary via email. You may enable or disable SMS delivery at any time through your account settings.

4.2 Message Frequency and Charges

Message frequency is approximately one (1) message per day, plus occasional service-related alerts including, but not limited to, bank connection issues requiring action, billing and payment notices, and trial expiration reminders. Message and data rates may apply depending on your mobile carrier and service plan. DayGist is not responsible for any charges imposed by your carrier.

4.3 Opt-Out

You may revoke your consent and stop receiving text messages at any time by any of the following methods: replying STOP, QUIT, END, CANCEL, or UNSUBSCRIBE to any message from DayGist; emailing support@getdaygist.com with your opt-out request; using the SMS preferences in your account settings at getdaygist.com; or any other reasonable method of communicating your revocation of consent.

We will process opt-out requests within ten (10) business days of receipt in accordance with FCC regulations. Following your opt-out, you will receive a single confirmation message acknowledging your request, and no further text messages will be sent. The confirmation message will not contain promotional or marketing content. After opting out of SMS, your daily balance summary will be delivered via email.

4.4 Help

Reply HELP to any DayGist message for support contact information, or contact support@getdaygist.com directly.

4.5 Consent Records

In compliance with TCPA requirements, we maintain records of your SMS consent including: the date and time consent was provided (in UTC), the IP address from which consent was submitted, the specific consent disclosure language displayed to you at the time of consent, and the method by which consent was obtained. These consent records are retained for a minimum of five (5) years following the date of consent or the date of your last interaction with the Service, whichever is later.

5. Third-Party Service Providers

We share your personal information with the following categories of third-party service providers, solely as necessary to operate and deliver the Service:

Plaid, Inc. — Financial data connectivity. Plaid accesses your financial account information to retrieve account balances on our behalf. Plaid's collection, use, and sharing of your data is governed by Plaid's End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy.

Twilio, Inc. — SMS message delivery. Twilio processes your phone number and message content solely to deliver text messages on our behalf.

Stripe, Inc. — Payment processing. Stripe collects and processes your payment method information to manage subscription billing. DayGist does not have access to your full payment card number. Stripe's privacy policy is available at https://stripe.com/privacy.

Amazon Web Services, Inc. (AWS) — Cloud infrastructure. Our backend services, database, and encryption key management operate on AWS infrastructure located in the United States. Data is encrypted at rest and in transit within the AWS environment.

Meta Platforms, Inc. — Advertising measurement. We use the Meta advertising pixel to measure and target our own advertising, which shares limited website-interaction data (such as pages visited and trial sign-ups) with Meta. This never includes your financial data, account balances, or bank credentials. You may opt out at any time (see Sections 1 and 8.2).

We do not sell, rent, lease, license, or otherwise commercially transfer your personal information to any third party for their own marketing, advertising, or commercial purposes. We do not share your financial data with any party other than as described above for the sole purpose of operating the Service.

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

6. Data Security

We implement administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

Encryption at rest: All sensitive data stored in our systems, including Plaid access tokens, is encrypted using the Advanced Encryption Standard with 256-bit keys (AES-256). Encryption keys are managed through AWS Key Management Service (KMS) with automatic key rotation enabled.

Encryption in transit: All data transmitted between your browser and our servers, and between our servers and third-party providers, is protected using Transport Layer Security (TLS) version 1.2 or higher.

Access controls: Access to production systems and databases is restricted through AWS Identity and Access Management (IAM) policies enforcing the principle of least privilege. All access to production infrastructure requires multi-factor authentication (MFA).

Monitoring and logging: We maintain audit logs of access to production systems and monitor for unauthorized access attempts and anomalous activity.

Incident response: We maintain a documented incident response plan. In the event of a confirmed data breach involving your personal information, we will notify affected users within seventy-two (72) hours of discovery, or sooner if required by applicable law.

No method of electronic transmission or digital storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

7. Data Retention and Deletion

We retain your personal information only as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law:

Account information (email address, phone number, preferences): Retained while your account is active. Deleted within thirty (30) days of a verified account deletion request.

Encrypted Plaid access tokens: Deleted immediately upon account cancellation, subscription expiration, trial expiration without conversion, or verified user deletion request. Upon deletion, we call Plaid's /item/remove API endpoint to formally disconnect the financial institution link and revoke our access.

Message send logs: Retained for four (4) years in accordance with the federal TCPA and Florida FTSA statutes of limitations. These logs record delivery status (success/failure), timestamps, and Twilio message identifiers. They contain no financial data content. After four years, send logs are automatically purged via DynamoDB TTL.

TCPA consent and opt-out records: Retained indefinitely. The TCPA places the burden of proving prior express written consent on the message sender. We retain consent records (including the timestamp, IP address, and version of the consent disclosure you agreed to) and opt-out records (including the timestamp and method of your opt-out request) for an indefinite period as required for legal compliance and defense against potential claims. These records survive account deletion under the legal-compliance exemption of California Civil Code § 1798.105(d). For full details, see our Data Retention Policy.

Payment and billing records: Retained by Stripe in accordance with Stripe's data retention policies and applicable financial record-keeping regulations.

To request deletion of your account and all associated personal data, you may: use the "Delete My Account" feature in your account dashboard at getdaygist.com, or email a deletion request to privacy@getdaygist.com. Upon receiving and verifying a deletion request, we will delete or anonymize your personal information within thirty (30) days, except where retention is required by applicable law or regulation.

8. Your Privacy Rights

8.1 All Users

Regardless of your location, you have the right to: access the personal information we hold about you upon verified request; correct inaccurate or incomplete personal information; request deletion of your account and associated personal data; revoke SMS consent at any time as described in Section 4.3; disconnect your financial institution connections at any time through our Service or through Plaid Portal at https://my.plaid.com; and receive a copy of your personal data in a commonly used, machine-readable format upon request.

8.2 California Residents — CCPA/CPRA Rights

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) as amended by the California Privacy Rights Act:

Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you in the preceding 12 months, the categories of sources from which the information was collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share the information.

Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions provided by law.

Right to Correct: You may request that we correct inaccurate personal information that we maintain about you.

Right to Opt-Out of Sale or Sharing: We do not sell your personal information. We do share limited website-interaction data (such as pages visited and trial sign-ups) for cross-context behavioral advertising through the Meta advertising pixel, as described in Section 1. You have the right to opt out of this sharing, and you may do so at any time using the “Your Privacy Choices” link in our website footer. We also honor the Global Privacy Control (GPC) browser signal as a valid opt-out request and automatically suppress the advertising pixel for users whose browser sends that signal. We never share your financial data for advertising.

Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (as defined under the CPRA), we use it only as necessary to provide the Service and for purposes permitted under applicable law.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of the above rights, contact us at privacy@getdaygist.com. We will verify your identity before processing your request, which may require you to provide additional information. You may also designate an authorized agent to submit a request on your behalf by providing written authorization.

We will respond to verified consumer requests within forty-five (45) days of receipt, or notify you if an extension of up to an additional forty-five (45) days is required and the reason for the extension.

8.3 Residents of Other U.S. States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with enacted consumer data privacy legislation may have additional rights under their respective state laws, including rights to access, correction, deletion, data portability, and the right to opt out of certain data processing activities. To exercise any applicable rights, please contact us at privacy@getdaygist.com.

9. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, individuals under the age of eighteen (18). If we become aware that we have inadvertently collected personal information from a child under 18, we will take commercially reasonable steps to delete such information as promptly as possible. If you believe that a child under 18 has provided us with personal information, please contact us at privacy@getdaygist.com.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes to this Privacy Policy, we will provide you with notice by: sending an email to the address associated with your account, and/or posting a prominent notice on our website at least thirty (30) days before the changes take effect.

The "Last Updated" date at the top of this Privacy Policy indicates when it was last revised. Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this Privacy Policy periodically.

11. Gramm-Leach-Bliley Act (GLBA) Notice

To the extent that DayGist, operated by Laguna Goods, LLC, is considered a "financial institution" under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.), we comply with the GLBA's requirements regarding the collection, use, and protection of consumers' nonpublic personal financial information. We do not disclose nonpublic personal information to nonaffiliated third parties except as permitted under 12 C.F.R. §§ 1016.13, 1016.14, and 1016.15. We maintain a comprehensive information security program incorporating administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of your nonpublic personal information, in accordance with the FTC's Safeguards Rule (16 C.F.R. Part 314).

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Laguna Goods, LLC (dba DayGist)

Privacy Inquiries: privacy@getdaygist.com

General Support: support@getdaygist.com

Website: https://getdaygist.com