Privacy policy

Last updated: 26 October 2026

1. Data controller

The website www.dayfinite.com is operated by ZHANG Heng, sole trader (entrepreneur individuel) trading as Dayfinite, 1 rue Marcel Carné, 94340 Joinville-le-Pont, France (“we”). We are the controller of the processing described here. For any privacy question or request: bonjour.support@gmail.com. Full details: Legal notice.

2. In short

No account. We do not ask for your name and do not link your answers to your identity (name, email).
Your questionnaire answers are sent to our server only to compute your estimate. They are processed in memory and are not stored (no database, no files, no logs).
In your browser, answers are kept until you close the tab. At checkout, a copy is also kept so we can deliver your report; it is no longer used after 24 hours (details in section 5).
Your answers are never sent to our payment provider (Stripe) or our analytics provider (PostHog).
We do not sell your data and use no advertising trackers.
Dayfinite gives an estimate for personal reflection; it is not a medical service.

3. Data we process

Questionnaire answers: Age, sex at birth, country of residence, height, weight, waist size, smoking, alcohol, physical activity, resting heart rate, sleep, night work, diet, self-rated health, conditions (including high blood pressure and cancer history), education level, social contact and family history. Some of this is health data (a special category under article 9 GDPR).
Payment data: Entered on the Stripe Checkout page: payment method, email address and other details Stripe asks for, amount and currency. We never have access to your full card number. Stripe gives us the payment status and the details shown in its dashboard (for example the email you entered), which we use only for support, refunds and accounting.
Technical data: IP address, used at request time to determine your country (for the price) and to limit abuse (in-memory counters kept for about 60 seconds); server error logs, which contain no answers or payment identifiers; access logs kept by our host Vercel; your language preference.
Analytics: Seven journey events (for example “preview viewed”, “checkout started”), with the language, the price tier and, for a purchase, the currency and amount, a random ID for the browser tab, and a timestamp. No answers, no results and nothing that identifies you by name or email.
Support messages: The content of the emails you send us and your email address.

4. Purposes and legal bases

Computing your estimate and delivering the report you bought: for health data, your explicit consent (article 9(2)(a) GDPR), collected before the questionnaire starts when you press “Agree and start”; otherwise, performance of the contract (article 6(1)(b)).
Payment, refunds and accounting: performance of the contract and legal obligations (article 6(1)(b) and (c)).
Linking the purchase to your browser, keeping the service secure, limiting abuse and fixing errors: performance of the contract and our legitimate interest in a secure service (article 6(1)(b) and (f)).
Analytics: our legitimate interest in understanding how the service is used (article 6(1)(f)), in a set-up with no cookies and no stored IP address.
Answering your requests: legitimate interest and, where relevant, performance of the contract.

5. Your health answers

They are processed in your browser and, during computation, in our server’s memory (hosted by Vercel): to show the preview, to prepare checkout and to recompute the full report after the payment is verified. They are not kept after the request.
In the browser, they are stored in sessionStorage, which is cleared when you close the tab. At checkout, a checkout copy is saved in sessionStorage and in localStorage, so your report can be found even if the payment app opens a new tab. This copy is no longer used after 24 hours. The localStorage copy is deleted once the payment is verified or, if it has expired, on your next visit to the site; the sessionStorage copy is cleared when you close the tab. You can delete them at any time by clearing the site’s data in your browser.
The payment cookie contains a one-way fingerprint of your answers that cannot be used to recover them.
They are never sent to Stripe or PostHog, are not used for advertising or profiling and are not linked to your identity.
You can withdraw your consent at any time. Before checkout, simply stop the questionnaire or close the tab. Once checkout has started, a copy of your answers stays in your browser so we can deliver the report you bought, and each time you open the report this copy is sent to our server again to compute it. To withdraw completely, clear the site’s data in your browser. Because we do not store your answers, nothing remains on our side.

6. Cookies and browser storage

We use no advertising cookies. The site only uses:

Cookie “days-left-payment-binding” (HttpOnly, necessary): Links your purchase to the browser you paid with. Duration: up to 24 hours.
Cookie “days-left-locale” (necessary): Remembers the language you chose. Duration: 1 year.
Questionnaire consent (sessionStorage, necessary): Records that you agreed to the processing of your answers by pressing “Agree and start”, for this tab only. It holds only the time you agreed, with no answers or results. Duration: until you close the tab.
Questionnaire answers and progress (sessionStorage): Let you resume the questionnaire after a reload. Duration: until you close the tab.
Checkout copy (sessionStorage and localStorage): Lets us show your report when you return from payment. It is no longer used after 24 hours. Duration: until you close the tab (sessionStorage); in localStorage, until the payment is verified or, once expired, until your next visit to the site.
Analytics ID (sessionStorage): A random ID that groups the events of one tab. Duration: until you close the tab.
Display markers (localStorage and sessionStorage): Prevent showing a window you have already seen again: the report’s holiday window (keyed by the payment reference, kept until you clear the site’s data) and the in-app browser tip (until you close the tab). They contain no answers or results.

PostHog runs in memory only and writes no cookies or storage on your device.

7. Recipients and processors

Vercel Inc.: website hosting and computation.
Stripe: payment processing. For some purposes (fraud prevention, regulatory obligations), Stripe acts as a separate controller: stripe.com/privacy.
PostHog: analytics, hosted in its European Union region, with IP addresses discarded.
Google (Gmail): receiving and handling emails sent to support.

We do not sell or share your data for advertising.

8. Transfers outside the European Union

Vercel, Stripe and Google are US companies or part of US groups, so your data may be processed in the United States. These transfers rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. Analytics data is hosted by PostHog in its European Union region.

9. Retention

Questionnaire answers: not stored on our servers; in the browser, until you close the tab.
Checkout copy: no longer used after 24 hours; deleted when you close the tab (sessionStorage) and, in localStorage, once the payment is verified or, once expired, on your next visit to the site. You can delete it at any time by clearing the site’s data.
Payment cookie: up to 24 hours. Language cookie: 1 year.
Analytics events (PostHog): kept for 12 months.
Error and access logs (Vercel): kept for a short period according to the host’s default settings.
Payment records: kept by Stripe and by us for as long as accounting rules require, generally 10 years in France.
Support emails: kept for 12 months after your request has been handled, then deleted.

10. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time (without affecting processing already carried out). Email us at bonjour.support@gmail.com; we reply within one month.

Because there is no account and your answers are not stored, we usually cannot identify you: requests will mostly concern payment records and emails. Please give the email you entered at checkout or the Stripe receipt number.

You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority in your country.

11. Minimum age

The service is only for people aged 18 or over.

12. Regional information

United States: We do not sell your personal information or share it for targeted advertising. Depending on your state, you may have rights to access, correct and delete your information: email us.
China (PIPL): Health information is sensitive personal information: we process it only with your separate consent, collected before the questionnaire. Your data is processed outside mainland China (in the European Union and the United States) by the recipients listed above. You can exercise your rights by email.
Japan (APPI): Your data may be entrusted to the providers listed above, located in the European Union and the United States. You can request access, correction or that we stop using it by email.
South Korea (PIPA): Your data may be transferred to the providers listed above, located in the European Union and the United States, for the purposes described. You can exercise your rights by email.

13. Changes

We update this policy when our processing changes. The date of the last update is shown at the top of the page.