Ray Privacy Policy

Ray is supplied by the individual who trades under the brand "AeroArt - Rayworks": a natural person registered for VAT in Bulgaria. "AeroArt - Rayworks" is a trading brand, not a separate company or legal person. The supplier's full name, address and VAT number are available on request from contact@rayworks.dev.

This Privacy Policy explains how that supplier ("AeroArt - Rayworks", "we", "our", or "us") handles personal data in connection with Ray. Ray includes the Ray desktop software ("Ray Desktop"), the Ray web app at rayworks.dev/ray/app ("Ray Online"), and your Ray account at rayworks.dev/ray/account.

Contact, including for privacy and security matters: contact@rayworks.dev

Business jurisdiction: Bulgaria. Support response target: within 2 business days. Support hours: 10:00 AM - 7:00 PM Eastern European Time (EET/EEST).

Legal package: Terms | Refund Policy | Privacy Policy

1) Scope and our role

This policy covers:

• Ray Desktop, the Windows software;
• Ray Online, including the survey projects and report files stored in it;
• your Ray account and the Ray account page, including organisations and invitations;
• Ray licensing and activation services;
• billing and transaction data processed through Stripe;
• Ray support communications.

Where we decide how data is used (we are the "controller"): your Ray account, billing, licensing, security records, diagnostics and support.

Where we act for your organisation (we are a "processor"): the project data your organisation stores in Ray Online. Your organisation decides what goes into its projects and is the controller of any personal data in them. We process that data only to provide Ray Online, under the Data Processing Terms in section 15 of the Terms. If your personal data is in a customer's project, please contact that customer first. If you contact us, we will pass your request on to them.

2) Data we process

A) Billing data (via Stripe)

• name and billing contact details;
• company name and billing address;
• order and subscription IDs;
• payment status, tax/VAT and invoice records.

Note: AeroArt - Rayworks does not receive full payment card details. Stripe processes payment details for checkout and recurring billing.

B) Ray account data

• your name and email address;
• your password, which our sign-in provider (Netlify Identity) stores only in hashed form. We never receive or see it in readable form;
• your account ID, whether your email is confirmed, and sign-in session data.

We use your email to sign you in, send account emails (such as the confirmation email and password reset), link your account to your subscription or licence, and match invitations.

If a customer invites you to their organisation, we receive your email address from them so that we can send the invitation and manage your access.

C) Licensing and activation data

• licence key or licence reference;
• machine fingerprint/device identifier for seat control;
• the machine name or seat label, and when each machine was last seen;
• licensing state and token metadata (for example: activation/check-in timestamps, expiry, grace status);
• service diagnostics and redacted error context.

Our licensing provider (Keygen) also holds the licence owner's email address, the licence name (your organisation and branch name), the licence key and the registered machines.

D) Ray project data

Ray Desktop processes project files on your own computer. It does not upload your measurement datasets to us in normal use.

Ray Online stores your organisation's projects on our servers so that its members can open them from any browser. Section 3 explains what is stored.

Project data can include personal data, such as operator names, names typed into notes, or details of your client. Your organisation decides what goes into a project (see section 1).

If you contact support, you may choose to send us files or logs to help us fix a problem.

E) Diagnostics and security records

Our licensing service keeps a record of each licensing request, such as an activation, check-in or seat release, and of each billing event from Stripe. Each record holds the time, the result, any error code, and scrambled ("hashed") references to the licence and machine. It also holds a hashed form of the IP address and app or browser identifier, and a country code where the network provides it. Hashed values like these can still count as personal data, and we use them only for security, fraud prevention, diagnostics and running the service.

Ray Desktop licensing telemetry is designed to be redacted and can be configured per deployment. Where it is enabled, it sends redacted licensing and error events for reliability and security monitoring. Before storage, diagnostic events are cleaned of email addresses, phone numbers, licence keys, access tokens and file paths.

To prevent abuse, we briefly use your IP address to limit how often diagnostics can be sent. This happens in memory, and the IP address is not stored.

F) Data stored in your browser

Ray Online and the Ray account page store a few items in your browser's local storage: your sign-in session, your paste settings for each face, and an invitation you have opened but not yet accepted (for up to 7 days). Ray Online uses no advertising or analytics trackers, and our web fonts are served from rayworks.dev, not from a third party. Signing out and clearing your browser's site data removes these items.

3) Ray Online: what we store

Each organisation's projects are stored separately. Only signed-in members of that organisation can reach them through Ray Online.

• Projects: the project details you enter (such as job number, structure name, area reference, client, operator, test date and notes), your readings and survey layout, the edit history (which reading changed, from what to what, when, and the name recorded against the change), and issued revisions.
• Report files: the PDF, SVG and PNG files produced when you issue a revision.
• Report signatures: when you issue a revision while your subscription is active, we sign a small record with our private key so that anyone can later check it. The record holds an internal reference to your organisation, the project ID, the revision number, a checksum and the time. It holds no names or email addresses.
• Edit locks: to stop two people editing the same project at once, we record who is editing (account ID, name or email, and a browser session ID). Other members of your organisation can see who is editing.
• Organisation records: each member's email, role and date added; links to the subscription and licence that give access; invitations (the invited email, who sent it, and when it was created, expires and was accepted); a security log of key actions, such as a licence being claimed or an invitation accepted; and a count of recent attempts to claim a licence, to limit guessing.

We never store a desktop licence key that you type in to claim a licence. It is sent to our licensing provider to be checked and then discarded.

We use project data only to provide Ray Online to your organisation, keep it secure, provide support you ask for, and meet legal obligations. We do not use it for analytics, advertising or training, and we do not sell it. Our staff access stored project data only for those purposes.

4) Why we process data, and our legal bases

• Providing Ray, your account, licensing and support to the customer we contract with: performance of that contract.
• Accounts for a customer's staff and invited members: our legitimate interest in providing a business service to our customer and controlling who can access it.
• Billing, invoices, refunds, and accounting and tax records: performance of the contract, and our legal obligations.
• Security, preventing abuse and fraud, enforcing licence and seat limits, diagnostics and service reliability: our legitimate interests in keeping Ray secure, reliable and properly licensed.
• Storing and processing project data in Ray Online: we have no purpose of our own here. We process it only on your organisation's instructions, as its processor (see section 1).
• Legal claims and requests from authorities: our legal obligations and legitimate interests.

We do not use your data for marketing without your consent. Where we do rely on consent, you can withdraw it at any time.

5) Who processes your data

We use these providers ("sub-processors" where they handle project data) to run Ray:

• Netlify, Inc. (United States): hosts the Ray website, Ray Online and our server functions; stores Ray Online projects, report files, backups, account and organisation records, and diagnostics; provides sign-in (Netlify Identity) and account emails; and receives messages sent through our contact form.
• Stripe: payments, billing, tax handling and refunds.
• Keygen (United States): licence, machine and seat records for Ray Desktop activation.
• Google: where we keep accounting records of payments (customer name, email and amounts).
• Professional advisers, and authorities where the law requires it.

Within your organisation, members can see the organisation's projects, who last saved each one, and who is currently editing. Only the organisation's owner can see the desktop licence key.

We do not sell personal data.

6) International transfers

Some of our providers process data outside the European Economic Area, mainly in the United States. Where personal data is transferred outside the EEA, we use a valid transfer mechanism under the GDPR: an adequacy decision, including the EU-US Data Privacy Framework where the recipient holds a current certification, or the European Commission's Standard Contractual Clauses with additional safeguards where needed. As described in each provider's own terms:

• Netlify (hosting, sign-in and Ray Online storage): the EU-US Data Privacy Framework, and the European Commission's Standard Contractual Clauses where needed.
• Stripe (payments): the EU-US Data Privacy Framework and Stripe's data transfer terms, which include the Standard Contractual Clauses.
• Keygen (licensing): the Standard Contractual Clauses in Keygen's data processing terms.
• Google (accounting records): the EU-US Data Privacy Framework, and the Standard Contractual Clauses where needed.

You can ask us for more detail about these safeguards at contact@rayworks.dev. Before we add a provider that will handle Ray Online project data, we will update this list (see section 13).

7) How long we keep data

• Ray Online projects and report files: while your organisation's subscription is active. An organisation's owner can delete a project at any time from the Ray account page. After a subscription ends, projects stay available read-only for 3 months (see section 10) and are then deleted.
• Backups: we back up Ray Online data every night and keep each backup for 30 days, so that we can recover from a failure. We also keep an offline copy of recent backups on encrypted storage we control in Bulgaria, and it follows the same 30-day limit. Deleted data leaves our backups within 30 days of deletion. Backups are only for recovering from a failure. If we ever restore one, anything deleted since that backup was taken is deleted again.
• Account, organisation and membership records: while the account or organisation exists. Ask us to delete them at any time, except records we must keep by law.
• Invitations: an invitation stops working after 7 days. Its record is kept with your organisation's records.
• Edit locks: removed when the editor closes the project, and they stop applying 5 minutes after the last activity.
• Security logs, claim-attempt counts and diagnostics: only as long as needed for security, fraud prevention, reliability and resolving disputes.
• Billing, tax and accounting records: for the periods Bulgarian tax, accounting and limitation laws require. VAT documents are kept at least as long as Article 121 of the VAT Act requires, which can be more than 10 years.

8) Security

We use reasonable technical and organisational safeguards to protect personal data. For example: every request to Ray Online is checked against your signed-in account and organisation before any project is read or changed; data travels over encrypted connections; your browser never holds credentials for our storage; desktop licence keys you enter to claim a licence are never stored; and invitation links are stored only in scrambled form and work only for the email address they were sent to.

No system is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach, we will act as data protection law requires, including telling affected customers without undue delay where it concerns their project data. If you think someone else has used your account, tell us straight away at contact@rayworks.dev.

9) Organisations, roles and invited members

• Ray Online works in organisations. The customer who links a paid subscription or eligible licence to their Ray account becomes the organisation's owner.
• The organisation owns its projects. Projects stay with the organisation when a member leaves.
• Owners can invite colleagues and see the organisation's desktop licence key and registered machines. Members can open, edit and issue the organisation's projects. They cannot invite others or see the licence key.
• An invitation goes to one email address and expires after 7 days. It gives access to Ray Online only, not a Ray Desktop activation.
• To remove a member or cancel an invitation, the owner can contact us at contact@rayworks.dev.

10) After a subscription ends

• For 7 days after the end of the paid period, members can keep editing and saving projects.
• Then, for 3 months, Ray Online is read-only. Members can still sign in, open every project, and download projects and issued reports, but cannot create, save or issue.
• After those 3 months, we delete the organisation's projects and report files. Backup copies are gone within a further 30 days.
• If the subscription is renewed before the projects are deleted, full access returns with the same organisation and projects.

Please download anything you want to keep before the 3 months end.

11) Your rights

Subject to applicable law, you may have the right to:

• access your personal data;
• correct inaccurate data;
• request deletion;
• restrict or object to certain processing;
• request portability;
• withdraw consent where processing relies on consent.

To exercise these rights, contact contact@rayworks.dev. We will reply within one month, as the law requires. For project data in Ray Online, we act on the instructions of the organisation that controls it (see section 1).

Exporting your projects: any member can download a project (a .rayproj file) and every sheet as PDF, SVG or PNG from Ray Online at any time, including after a subscription ends.

Complaints: you have the right to complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, kzld@cpdp.bg. You can also complain to the authority in the EU country where you live or work. We would be grateful for the chance to resolve your concern first.

12) Children

Ray is a business product and is not directed to children.

13) Changes to this policy

We may update this Privacy Policy. Updated versions will be posted with a new effective date. If a change materially affects how we handle Ray Online data, including adding a provider that will handle project data, we will also email organisation owners at least 30 days before it takes effect.