DAYSTA FOR WINDOWS

Daysta Privacy Policy

Last updated: 2026-08-11 Effective date: 2026-08-11 Version: 1.1

Nyarrow Studio ("we", "us", or "our") respects your privacy. This policy explains how we handle personal information and data in connection with the software "Daysta" (the "Software").

1. Core Principle — Your Media Never Leaves Your Device

All video analysis and editing performed by the Software happens entirely on your device.

• The videos, photos, and music you load, and the videos you produce, are never transmitted to our servers or to any third-party server.
• The AI models used for face recognition, speech recognition (automatic subtitles), and scene analysis are bundled with the Software and run on your device. No cloud API is used.
• The only internet communication the Software performs is Microsoft Store licence verification and the purchase of paid features. This communication takes place through Windows and the Microsoft Store, and the other party to it is Microsoft. We do not obtain any personal data about you through it.
• The Software makes no other connections. It sends no usage data and no crash reports.
• We obtain information about you only if you yourself contact our support channel (Section 2).

2. Information We Collect

2.1 Support Enquiries

If you contact us through our enquiry form (https://support.nyarrowstudio.com/contact), we collect:

• The form states that device information is automatically attached, and submission requires you to tick a consent box. We do not obtain any of this unless you choose to send it.
• Each enquiry is given its own link, which you can use to follow up on the conversation. The link is constructed so that it cannot be guessed by others, and it stops working 90 days after the last message (you are welcome to contact us again after that).

2.2 About Crash Information

We do not collect crash reports or diagnostic data from the Software.

Windows does, however, include Microsoft's own error reporting mechanism, and if the Software terminates abnormally Microsoft collects that information. What we receive from Microsoft is statistical only (counts and error types) and contains nothing that identifies you personally. That collection is performed by Microsoft and is governed by the Microsoft Privacy Statement and your Windows diagnostic data settings.

2.3 Purchase Information

Purchases of the Software are processed by the store (e.g. Microsoft Store). We receive only aggregated licence and sales reports from the store; we do not receive information identifying you personally, nor any payment information.

3. Handling of Face Data

The Software can recognise specific people appearing in your videos in order to prioritise scenes featuring them. Our policy on this is as follows:

1. Face embeddings (numeric data derived from face images) never leave your device. They are not transmitted to our servers or to any third party, and we do not collect them. Face embeddings may constitute an "individual identification code" under Japan's Act on the Protection of Personal Information; however, they are generated, stored, and matched entirely on your device, and we neither collect nor handle them.
2. The AI models used for face detection and matching are bundled with the Software and run entirely on your device.
3. Data for people you register is stored only on your device, in two places:
   • The person library: inside the %LOCALAPPDATA%\Daysta folder
   • Project files (.daysta): if you select a person when creating a video, a copy of that person's face embeddings is also stored inside that project file, so that the project remains self-contained. Project files are saved wherever you choose to put them.

To erase this data completely, delete the person from the library and also delete any project file in which that person was selected (or remove the selection and save the project again). In all cases, this data never leaves your device.

1. Because we do not collect face data, we cannot and do not provide or sell it to third parties, nor use it for advertising or any other purpose.
2. Face data is processed by you, on your own device, for your own purposes. We do not determine the purposes or means of that processing and cannot access the data.
3. If you work with videos showing other people, responsibility towards those people rests with you (see Section 6 of the Terms of Service).

4. Purposes and Legal Bases

We do not use collected information for advertising, profiling, or automated decision-making.

5. Disclosure to and Processing by Third Parties

We do not disclose collected information to third parties except:

1. with your consent;
2. where required by law, or in response to a lawful request from a court or public authority;
3. where we engage the following service providers to process information on our behalf, to the extent necessary for the purposes set out in this policy:

We enter into appropriate data processing agreements (DPAs) with these providers and supervise them as required. We will identify the specific providers on request.

Information Microsoft collects in connection with distributing the Software and processing payment — including the error reporting described in Section 2.2 — is collected by Microsoft independently, as a separate controller; we neither provide personal data to Microsoft nor entrust processing to it. Microsoft's handling is described in the Microsoft Privacy Statement.

6. International Transfers (Provision to Third Parties in Foreign Countries)

• All of the processors described in Section 5 are located in the United States. Under Japan's Act on the Protection of Personal Information, entrusting them constitutes the provision of personal data to a third party in a foreign country (Article 28 of the Act).
• We have entered into data processing agreements (DPAs) incorporating the EU Standard Contractual Clauses (SCCs) with each of them, and make these transfers on the basis that the recipients have established systems conforming to the standards prescribed by the rules of the Personal Information Protection Commission. We also take the measures necessary to ensure the continuous implementation of equivalent safeguards (including periodic review of each recipient's handling and of the local legal regime), and will provide information about those measures upon your request.
• If you are in the EU/EEA: when we (located in Japan) access the information you send us, that constitutes a transfer outside the EU to Japan. Japan benefits from a European Commission adequacy decision (Art. 45 GDPR), and this transfer takes place on that basis.

7. Retention

Anonymisation erases information that could identify you — your email address, the body and subject of your enquiry — and keeps only fields used for aggregate counts (category, dates, app version, and similar).

Uninstalling the Software does not remove the project files and settings you created (this is intentional). To remove them completely, manually delete the %LOCALAPPDATA%\Daysta folder. Note that project files (.daysta) you saved elsewhere are not inside that folder and must be deleted separately.

8. Your Rights

You have the following rights in respect of information we hold about you:

• the right to request access;
• the right to request rectification, addition, or deletion;
• the right to request suspension of use or erasure (and, where the GDPR applies, restriction of processing);
• the right to data portability (where the GDPR applies);
• the right to object (Art. 21 GDPR): where we process information on the basis of legitimate interests (Art. 6(1)(f)) — such as retaining support correspondence — you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we can demonstrate compelling legitimate grounds;
• the right to lodge a complaint with a supervisory authority (your national data protection authority where the GDPR applies; the Personal Information Protection Commission in Japan).

How to make a request: Please contact us using the details in Section 13. After verifying your identity, we will respond without delay in accordance with law. No fee is charged (actual postage may be charged if you request disclosure by post).

We hold information only about people who have contacted us. The Software has no account feature, so if you have never contacted us, we hold no information about you at all.

9. Children's Privacy

The Software is not directed to children. We do not knowingly collect personal information from anyone under 13 (or under the age set by the relevant member state, generally 16, within the EU).

While the Software is intended for editing family videos, that concerns the content of the material being edited and does not mean the Software is intended for use by children.

10. Cookies and Similar Technologies

The Software does not use cookies (it is not a web browser and has no mechanism for storing cookies). On the enquiry form, the platform hosting the form may use cookies or similar technologies for anti-spam and security purposes. We do not use cookies for analytics or advertising.

11. Security (Safety Management Measures)

We take the following measures to protect the information we collect:

• Data minimisation: the Software is designed not to collect personal data at all. It never transmits your media or usage data to us, and the only information we obtain is what you send us in an enquiry.
• Organisational and personnel measures: only pre-authorised staff can view and respond to enquiries, and access requires authentication.
• Technical measures: encryption in transit, unguessable thread links, and access controls on administrative functions.
• Supervision of processors: we conclude data processing agreements (DPAs) with our processors and review their handling.
• Understanding the external environment: enquiry information is processed by providers located in the United States. We have reviewed that country's data protection regime and put contractual safeguards including Standard Contractual Clauses (SCCs) in place.

We will respond without delay to enquiries about these measures, to the extent that doing so does not itself compromise security.

12. Changes to This Policy

We may amend this policy where required by changes in law, the addition of features, or other need. For material changes (including where we begin collecting new categories of information) we will give advance notice within the Software and, where necessary, obtain your consent again. An amended policy takes effect on the effective date stated in it, or, absent such a date, when posted.

13. Contact

For questions about this policy, or to exercise the rights described in Section 8, please contact:

• Business name: Nyarrow Studio
• Address: 1-4-3 Sengencho, Wizard Building 402, Yokohama-shi Nishi-ku, Kanagawa-ken 220-0072, Japan
• Contact: https://support.nyarrowstudio.com/contact?product=daysta
• EU representative (Art. 27 GDPR): none appointed (see below)

We operate as a sole proprietorship and identify ourselves in this policy by our trade name (Nyarrow Studio). Any matter required by Article 32(1) of Japan's Act on the Protection of Personal Information that is not stated in this policy — including the name of the individual operator — will be provided without delay on request to the contact above (Article 32(1) expressly permits this information to be made available by responding without delay to a request, rather than by publication).

On the EU representative: We are established outside the EU. Article 27 GDPR requires controllers without an EU establishment to designate a representative, but Article 27(2) exempts processing that is occasional, does not include large-scale processing of special categories of data, and is unlikely to result in a risk to individuals. The Software never transmits users' media or usage data to us (licence verification and purchases are communications with Microsoft, from which we receive no personal data), and the only information we handle is what users voluntarily send us in support enquiries, so we consider this exemption to apply.