Last updated September 27, 2026
In plain terms: your organization owns its data. Daylight stores it on its servers so the app works and your information is backed up — but holding your data is not the same as reading it. Your records stay isolated to your team, an applicant’s information is visible only to the people working with them, and Daylight’s own staff do not access it. The documents below set out the details.
These Terms of Service (the “Terms”) govern your organization's access to and use of Daylight (the “Service”). By using the Service, the organization and its users agree to these Terms.
Daylight is software that helps parole advocacy organizations manage applicants, documents, packets, communications, contacts, and related work. Daylight hosts and operates the Service on the organization's behalf.
Each organization is responsible for its own users, for the accuracy of the information it enters, and for keeping account credentials secure. Access within an organization is controlled by roles the organization assigns; the organization is responsible for granting and revoking access appropriately.
The organization owns all information it enters into the Service, including applicant records and documents (“Organization Data”). Daylight claims no ownership of Organization Data. The organization grants Daylight only the limited rights needed to host, store, back up, secure, and process Organization Data for the sole purpose of providing the Service, and for no other purpose.
Daylight stores Organization Data on its servers as a custodian and processor. Daylight does not access, use, or disclose Organization Data except as necessary to provide, maintain, secure, and support the Service, as instructed by the organization, or as required by law. Daylight personnel do not access Organization Data in the ordinary course of operating the Service; where access is necessary, it is limited to the minimum required, is authorized, and is recorded.
Organizations and users may not misuse the Service, including attempting to access data belonging to another organization, interfering with the Service's operation or security, or using the Service for any unlawful purpose.
Daylight treats Organization Data as confidential and maintains administrative, technical, and physical safeguards designed to protect it. Security is described further in the Privacy Policy and Data Processing sections below.
Daylight will make commercially reasonable efforts to keep the Service available and to provide support, but does not guarantee that the Service will be uninterrupted or error-free.
Fees, if any, are as separately agreed between Daylight and the organization. During any beta or pilot period the Service may be provided at no charge or on terms agreed in writing.
Either party may terminate as provided in the organization's agreement. On termination, Daylight will make Organization Data available for export for a reasonable period and will then delete it from active systems, subject to routine backup cycles and any legal retention requirements.
To the extent permitted by law, the Service is provided “as is.” Daylight does not provide legal, medical, or other professional advice; the organization is solely responsible for its advocacy work and decisions.
To the extent permitted by law, Daylight's liability arising out of or relating to the Service is limited as set out in the organization's agreement.
Daylight may update these Terms from time to time; Daylight will communicate material changes to organizations.
These Terms are governed by the laws of the State of New York, without regard to its conflict-of-laws rules.
This Privacy Policy explains what information Daylight holds, how it is used, and who can access it.
On behalf of organizations, the Service holds the records organizations enter, which may include applicants' personal, medical, mental-health, criminal-history, and legal information. Daylight also holds account information for users (such as name, email, and role) and operational logs (such as sign-ins and actions taken in the app) that are used to run and secure the Service.
Organization Data is used solely to provide the Service to the organization that entered it. Daylight does not sell Organization Data, does not use it for advertising, and does not use it to train external or third-party systems.
Within an organization, access is role-based: an owner or coordinator can see the organization's applicants, while an advocate sees only the applicants they are assigned to. Between organizations, data is isolated so that one organization cannot see another's. Daylight's own personnel do not access Organization Data in the ordinary course; any access is restricted to the minimum necessary to operate, secure, or support the Service, is authorized, and is logged.
Organization Data is stored on Daylight's servers, isolated per organization. Daylight applies access controls, encrypts data in transit, maintains backups, and keeps an activity log as an audit trail of significant actions.
Daylight may rely on a limited number of service providers (for example, to send email) that process limited information under confidentiality and data-protection obligations. Daylight does not otherwise share Organization Data with third parties except as needed to provide the Service or as required by law.
Organization Data is retained while the organization uses the Service and is deleted after termination as described in the Terms, subject to backup cycles and legal requirements.
If Daylight becomes aware of a security breach affecting Organization Data, it will notify the affected organization without undue delay and cooperate in the response.
Organizations control their users' access and may export or request deletion of their data. Requests from individuals about their own information should be directed to the organization that holds it, which is the owner of that data.
When Daylight holds Organization Data, it acts as a processor on the organization's behalf. This section summarizes that relationship; a full Data Processing Agreement is available to organizations that require one.
Daylight processes Organization Data only to provide the Service and only on the organization's documented instructions.
Daylight maintains appropriate technical and organizational security measures, including per-organization isolation, role-based access control, least-privilege administrative access, encryption in transit, and audit logging.
Daylight personnel who support the Service are bound by confidentiality obligations.
Daylight will not engage a subprocessor without imposing appropriate data-protection obligations, and remains responsible for its subprocessors.
Daylight will provide reasonable assistance to the organization in responding to requests from individuals and to the organization's own legal obligations.
On termination, Daylight will return or delete Organization Data as directed by the organization, subject to legal retention requirements.
Some organizations handle information protected by the Health Insurance Portability and Accountability Act (HIPAA). Where Daylight holds such information on an organization's behalf, Daylight will enter into a Business Associate Agreement (BAA) with that organization.
A BAA sets out how protected health information is safeguarded, used, and disclosed, and the respective obligations of the parties. Organizations that require a BAA should request one before entering protected health information into the Service.
Questions about these terms or your data? Contact your organization’s Daylight administrator, or reach the Daylight team through the channel provided in your service agreement.
← Back to home