Privacy Policy

1. Overview & Scope

Rayvotech Tools Inc. ("Rayvotech", "we", "us", or "our") respects your fundamental right to privacy. This Privacy Policy outlines how we collect, process, store, and safeguard personal data when you access our website located at https://rayvotechtools.online, utilize the Rayvotech development studio, interact with our APIs, or deploy web applications (collectively, the "Platform").

This Policy complies with Regulation (EU) 2016/679 (the General Data Protection Regulation or "GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the California Online Privacy Protection Act ("CalOPPA").

2. Information We Collect

We collect information across three distinct categories: data you provide directly, data generated through platform interactions, and technical operational telemetry.

2.1 Information You Provide Directly

• Identity & Account Data: Name, email address, workspace name, and cryptographically salted password hashes (Argon2id).
• Billing & Tax Data: Billing country, postal code, and business tax identifiers. All payment credentials (credit cards, bank numbers, PayPal tokens) are collected and processed directly by Stripe Inc. and PayPal Holdings Inc. Rayvotech does not store full credit card numbers or security codes (CVVs).
• Communications Data: Information submitted via support forms, engineering consultations, or email correspondence.

2.2 Project & Studio Data

• Prompts & Instructions: Natural language directives, design preferences, and structural parameters entered into the studio prompt bar.
• Synthesized Artifacts: Component source code (TypeScript, React, Tailwind CSS), database schema definitions (SQL), environment variable keys, and asset uploads.
• Connected VCS Data: If you connect GitHub repositories, we collect authorized OAuth tokens, repository names, and branch names to facilitate bidirectional commit synchronization.

2.3 Technical & Operational Telemetry

• Network & Device Data: IP address, browser user-agent, operating system, edge node routing latency, and HTTP request headers.
• Sandbox Metrics: In-browser WebContainer startup time, Vite build duration, and anonymized compilation error frequencies.

3. How We Process Your Data (Legal Basis)

Under GDPR Article 6, we process your personal data under the following lawful bases:

• Contractual Performance (Art. 6(1)(b)): To provision your user account, execute in-browser code sandboxes, route AI compiler requests, manage subscriptions, and deliver exported source code.
• Legitimate Interests (Art. 6(1)(f)): To maintain edge network security, prevent DDoS attacks, detect fraudulent billing activity, and enhance compiler performance.
• Legal Compliance (Art. 6(1)(c)): To maintain financial transaction records for statutory accounting, tax reporting, and anti-money laundering (AML) compliance.
• Consent (Art. 6(1)(a)): For optional marketing updates or newsletters, which may be revoked at any time via the unsubscribe link.

4. Zero Model Training Guarantee (AI Data Isolation)

No Public Model Training: Rayvotech Tools maintains a strict, contractual Zero Model Training policy. User prompts, synthesized component trees, custom database models, and application records are NEVER utilized to train, retrain, fine-tune, or calibrate public foundation AI models (such as GPT-4/5, Claude, or Gemini).

Enterprise Zero-Retention APIs: When prompts are routed to frontier LLM inference providers, transactions occur exclusively over commercial enterprise endpoints governed by Business Associate Agreements and Zero-Data-Retention (ZDR) terms. Prompts are evaluated in-memory and discarded upon token generation completion.

5. Authorized Third-Party Sub-Processors

To operate our globally distributed infrastructure, we share targeted data with verified third-party sub-processors bound by strict Data Processing Agreements (DPAs):

6. Cookies & Local Browser Storage

We utilize minimal, privacy-conscious browser cookies and local storage tokens strictly required for platform operation:

• rayvotech_session (Essential): Encrypted session identifier enabling secure user authentication.
• XSRF-TOKEN (Essential): Security token preventing Cross-Site Request Forgery (CSRF) exploits.
• localStorage (Functional): Caches active code editor tab state and theme preferences locally within your browser.

No Third-Party Ad Trackers: Rayvotech does not load third-party behavioral advertising pixels or cross-site tracking cookies.

7. Your Statutory Privacy Rights (GDPR & CCPA)

Depending on your geographical jurisdiction, you possess the following enforceable rights regarding your personal data:

• Right to Access (GDPR Art. 15): Request a structured copy of personal data maintained in your account records.
• Right to Rectification (GDPR Art. 16): Correct inaccurate, outdated, or incomplete profile details via Account Settings.
• Right to Erasure / "Right to be Forgotten" (GDPR Art. 17): Request permanent deletion of your account, project sandboxes, and database records.
• Right to Data Portability (GDPR Art. 20): Export your project source code, database tables, and metadata in standard formats (ZIP, JSON, SQL).
• CCPA "Do Not Sell or Share": Rayvotech does not sell personal data for monetary or other consideration, nor do we share personal data for cross-context behavioral advertising.

To exercise any statutory privacy right, submit a verified request to privacy@rayvotechtools.online. We respond to all verified requests within thirty (30) days.

8. Data Security & Technical Safeguards

Rayvotech employs defense-in-depth architectural controls to protect your data against unauthorized access, exfiltration, or modification:

• Encryption in Transit: All HTTP traffic is permanently redirected to HTTPS using modern TLS 1.3 encryption with strict HSTS policies.
• Encryption at Rest: Database volumes and customer project stores are encrypted at rest using AES-256 standards.
• Row-Level Security (RLS): Multi-tenant PostgreSQL databases enforce granular Row-Level Security policies evaluated at the database engine level, ensuring tenants cannot read foreign rows.
• WebContainer Isolation: Interactive previews execute in sandboxed WebAssembly environments isolated from the host server filesystem.

9. Data Retention & Erasure Schedules

We retain personal information only for as long as necessary to fulfill the purposes outlined in this Policy. Active project files, sandboxes, and database records remain stored while your account remains active.

Upon verified account closure or deletion, hosted database clusters, file storage, and associated WebContainers are permanently purged from active production systems within thirty (30) days. Financial transaction logs are retained for seven (7) years to comply with statutory tax and accounting obligations.

10. International Data Transfers

Because Rayvotech operates distributed global edge infrastructure, personal information may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. Where transfers occur, we implement valid legal transfer mechanisms pursuant to GDPR Article 46, specifically European Commission Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.

11. Protection of Children's Privacy

The Platform is not intended for or directed toward children under eighteen (18) years of age. We do not knowingly solicit or collect personal information from minors. If you believe a minor has registered an account without parental consent, notify privacy@rayvotechtools.online for immediate account and data deletion.

12. Privacy Contact & Data Protection Officer

For questions concerning this Privacy Policy, data processing practices, or to exercise your GDPR/CCPA statutory rights, contact our Data Protection Team at: