Privacy Policy
Dailify places outbound calls on behalf of South African financial advisers, and books verified appointments into their calendars. This policy describes what personal information we handle, why, and what we do not do with it.
Who we are
Dailify is operated by Ghost AI ("we", "us"), the responsible party for the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA).
| Information Officer | Garth — garth@ghost-ai.co.za |
|---|---|
| Contact | garth@ghost-ai.co.za |
| Service address | https://dailify.co.za |
Two groups of people
Dailify handles information about two distinct groups, and the rules differ for each.
Brokers — our customers
Financial advisers and their staff who sign in to Dailify. We are the responsible party for their account information.
Prospects — the people we call
Consumers a broker asks us to contact. The broker is the responsible party for that data; Dailify is an operator processing it on their documented instruction, under POPIA section 21.
Broker information we hold
| What | Why |
|---|---|
| Name, work email, mobile number | To create and secure the account |
| Brokerage name, FSP licence number, VAT number | Regulatory identification and invoicing |
| Calendar connection and the email address of the connected account | To read availability and book meetings |
| Wallet balance and ledger entries | Billing for verified appointments |
| Audit records of actions taken in the portal | Accountability, and dispute resolution |
Calendar data — Google and Microsoft
Connecting a calendar is optional, and Dailify cannot book meetings without one. When you connect one, this is exactly what we ask for and what we do with it.
Google account data
| Scope | What it lets us do |
|---|---|
userinfo.email | Read the email address of the account you connected, so the portal can show you which calendar is attached. |
calendar.events.freebusy | Read busy blocks only — start and end times. This returns no event titles, no attendees, no descriptions and no locations. |
calendar.events | Create, update and cancel only the meetings Dailify books. We do not read, edit or delete events created by anyone else. |
We deliberately do not request the broader auth/calendar scope, which would grant full
read and write access to every event on every calendar. The two narrower scopes above do everything
the product needs.
Microsoft 365 account data
The Microsoft integration uses User.Read, Calendars.ReadWrite and
OnlineMeetings.ReadWrite, with offline_access so the connection survives
without asking you to sign in before every booking. Free/busy is read through Microsoft Graph's
getSchedule, which likewise returns busy intervals and no event content.
Limited use
Dailify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we do not:
- transfer or sell Google user data to third parties, other than as needed to provide the service, or for security or legal reasons;
- use Google user data for advertising, or for any purpose unrelated to booking and managing appointments;
- allow humans to read Google user data, except where you explicitly ask us to, where it is necessary for security or to comply with the law, or where the data is aggregated and anonymised; or
- use Google user data to develop, improve or train generalised artificial-intelligence or machine-learning models.
How the connection is stored
The refresh token that keeps your calendar connected is encrypted with AES-256-GCM before it is written to our database, and decrypted only in memory for the duration of a single API call. It is never logged and never displayed.
Withdrawing access
You can disconnect a calendar in the Dailify portal, or revoke access directly in your Google Account or Microsoft account, at any time. Revocation takes effect immediately. Campaigns that depend on that calendar pause rather than book blindly, and the stored token is discarded.
Calls and recordings
- Every call opens by stating that the call is recorded, on whose behalf it is being made and why. This is said before anything else is discussed. The caller is an AI assistant: that is not announced in the opening, and it is stated plainly and immediately whenever anybody asks. The assistant never claims to be a person.
- A person may opt out at any point in the call, and is then added to our suppression list.
- We call only numbers a broker has supplied with a recorded basis for contact — the source, the wording consented to, the channel and the date are all stored against the lead.
- Numbers on a broker's own do-not-call list, and on the platform-wide opt-out list, are screened before every dial. National Consumer Commission registry screening begins once our registration completes.
- Recordings and transcripts are anonymised 180 days after the call.
Where the data lives
Personal information is stored in South Africa. Two processors necessarily receive some data outside it: Google and Microsoft, when you connect a calendar of theirs, and only the calendar data described above. Their own terms govern that processing.
Who else sees it
We do not sell personal information. We share it only with service providers who are necessary to run Dailify — hosting, telephony, email delivery and payments — each bound to process it only on our instruction. We disclose information to a regulator or a court only where the law requires it.
How long we keep it
| Recordings and transcripts | Anonymised after 180 days |
|---|---|
| Appointment and billing records | Five years, as required by financial-services record-keeping rules |
| Calendar tokens | Until you disconnect or revoke; discarded immediately on either |
| Account information | For the life of the account, then deleted or anonymised |
Your rights under POPIA
You may ask us what personal information we hold about you, ask us to correct or delete it, object to processing, or complain to the Information Regulator. Write to garth@ghost-ai.co.za and we will respond within 30 days.
The Information Regulator of South Africa can be reached at complaints.IR@justice.gov.za.
Security
- All traffic is encrypted in transit with TLS.
- Calendar refresh tokens are encrypted at rest, as described above.
- Each brokerage's data is isolated at the database level by row-level security, not by application code alone.
- Recordings, transcripts and consent proofs are held in private storage and reachable only through short-lived signed links.
Changes
If we change this policy we will update the date at the top, and tell account holders by email where the change is material.