Dear Dilara — Privacy Policy
Last updated: 18 October 2026
1. Who we are
Dear Dilara ('we', 'us', 'our') helps parents save everyday moments. You send text, voice notes, photos and videos to a WhatsApp chat, and we turn them into emails delivered to an address you choose. We are the data controller for the personal data described in this policy.
- Privacy contact: info@deardilara.co.uk
2. What this policy covers
This policy applies to our website (deardilara.co.uk), your account dashboard, and the Dear Dilara WhatsApp service. The service is for adults aged 18 or over. It is not directed at children, and we do not knowingly collect personal data from children directly. Content you send may include information about your child, which you provide to us as their parent or guardian.
3. The information we collect
Account information
- The email address you sign in with
- The destination email address where your entries are delivered
- Your child's name (or the name you give the diary)
- The phone number you message us from, which we capture when you link WhatsApp
- A one-time linking code used to connect your phone to your account
Content you send us
- Text messages and captions
- Voice notes, photos and videos
Content we generate
- Written transcripts of voice notes
- Short AI-generated subject lines, and light formatting of transcripts (paragraph breaks and punctuation, not rewriting)
Message records
- For each message: its type, the time it was received, its delivery status and any error details
- For voice notes, the transcript
Billing information
- Your plan and subscription status, and a Stripe customer reference
- Card details are collected and held by Stripe. We never see or store your full card number.
Usage and technical information
- Server logs containing identifiers such as your user ID, message ID and event type
- IP address, browser and device information
- Pages visited and actions taken on our website (for example, clicking 'Get started')
Support communications
- Anything you send us when you contact support
4. How we use your information, and our legal bases
| What we do | Legal basis (UK GDPR) |
|---|---|
| Create and run your account, link your WhatsApp number, process each message and email it to you | Contract |
| Transcribe voice notes and generate subject lines | Contract |
| Take payment and manage your subscription | Contract; legal obligation (accounting records) |
| Retry failed messages and let our team investigate and resend them | Contract; legitimate interests (running a reliable service) |
| Keep the service secure and prevent fraud or abuse | Legitimate interests |
| Monitor errors and system health | Legitimate interests |
| Measure how the website is used (analytics that use cookies or similar technologies) | Consent |
| Respond to support requests | Contract; legitimate interests |
| Comply with the law | Legal obligation |
5. What happens to your messages
- You send a message to our WhatsApp number. It reaches us through Meta's WhatsApp Business Platform.
- If it contains media, we download it temporarily. Voice notes are sent to OpenAI to be transcribed, and the transcript is used to create a subject line and a tidied version of the text.
- We email the result, with your photos, videos or original voice recording attached, to the destination address you chose, using our email provider.
- We delete the temporary copy of the media.
We do not read your messages as a matter of course, we do not use your content to train AI models or for advertising, and we do not sell your data.
Failed messages. If we cannot deliver a message, we keep a copy of it (including any media) in restricted storage so our team can resend it and fix the problem. Only authorised staff can access it. It is deleted once it has been resent successfully, and in any case within 7 days.
Once it is in your inbox. After delivery, the email is in the hands of your email provider. Email is not always encrypted in transit, so please keep your mailbox secure.
6. Who we share information with
We use trusted providers to run the service. They process data on our behalf, except where noted.
| Provider | What they do | Notes |
|---|---|---|
| Meta (WhatsApp Business Platform) | Receives your WhatsApp messages and passes them to us; delivers our replies | Meta also acts under its own terms and privacy policy |
| Supabase | Database, sign-in, and short-term storage of failed messages | Hosted in West Europe |
| OpenAI | Transcribes voice notes and generates subject lines and formatting | Under OpenAI's API terms, API data is not used to train its models by default |
| Postmark | Sends our emails, including sign-in codes and your journal entries | |
| Stripe | Payments and subscription management | Stripe is also a controller for its own fraud and compliance purposes |
| Railway and Vercel | Hosting for our backend and website | |
| Sentry | Error monitoring | Configured not to collect personal data by default |
| PostHog | Website analytics | EU-hosted; no session recording |
| Custom | Log storage and search |
We may also disclose information where the law requires it, to protect our rights or the safety of others, or to a buyer if our business is sold (we would tell you first). We do not sell your personal data.
7. International transfers
Some of our providers (such as OpenAI, Meta, Stripe, Vercel, Railway and Sentry) may process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge for certified providers) or the UK International Data Transfer Agreement or Addendum, together with additional safeguards where appropriate.
8. How long we keep your information
| Information | How long |
|---|---|
| Account details | Until you delete your account |
| Message records and transcripts | Until completely processed, no more than 7 days |
| Photos, videos and voice recordings | Not kept after delivery |
| Failed messages (including media) | Until resent, and no more than 7 days |
| Billing and tax records | As required by law, typically 6 years |
| Logs and error reports | 90 days |
| Support correspondence | As long as needed to resolve your request, and a reasonable time afterwards |
9. Your rights
Under UK data protection law you have the right to:
- Be told how your data is used (this policy)
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased
- Restrict or object to certain processing
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on consent
You can change your destination email, manage billing, or delete your account from your dashboard. Deleting your account removes your account details and message records from our systems. Emails already delivered to your inbox are in your mailbox and are not affected, and we may keep billing records we are legally required to retain. For anything else, email support@deardilara.co.uk. We aim to respond within one month.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
10. Cookies and similar technologies
We use essential cookies and local storage to keep you signed in. We use analytics to understand how the website is used, and where required we ask for your consent before setting analytics cookies or similar identifiers. We do not use advertising cookies and we do not record your sessions.
11. Your child's and other people's information
The diary is about your child, and you provide their information as their parent or guardian. Please only send content you are entitled to share. If your photos, videos or voice notes include other people, especially other children, make sure you are comfortable sharing them. Please use the service for personal and family purposes only.
12. Security
We protect your information with encryption in transit (HTTPS) and at rest through our providers, access controls and row-level security on our database, restricted staff access to failed messages, and careful handling of credentials. No system is perfectly secure. If a breach affects your data, we will notify you and the ICO where the law requires.
13. Automated decisions
We use AI to transcribe voice notes and write subject lines. We do not make decisions about you that have legal or similarly significant effects based on automated processing.
14. Changes to this policy
We may update this policy from time to time. If we make significant changes, we will tell you by email or in your dashboard. The date at the top shows when it was last updated.
15. Contact us
Questions about this policy or your data: info@deardilara.co.uk