Rayon API Privacy Policy

Version 2026-10-19 · Effective 19 October 2026

Clarified 20 October 2026 to describe the existing Discord trial-membership check and its short-lived access-token retention.

Disclosed 21 October 2026: the current service also retains encrypted derived processing material separately from five-minute source references, as described below.

1. Who we are

FLIPPIFY LTD, trading as Rayon API, is the controller for personal information used to operate our website, dashboard, customer accounts, billing, security and usage records. Where we process personal data in customer-supplied generation material solely on that customer’s instructions, we act as its processor under applicable data-processing terms. We are registered in England and Wales under company number 16548611. Our registered office is 61 Bridge Street, Kington, United Kingdom, HR5 3DJ. Contact support@rayonapi.com for privacy questions or rights requests.

This notice describes our processing under the UK GDPR and Data Protection Act 2018, as amended. It is information about how the service works, not blanket consent to every use of personal data. Where your organization independently determines how it collects and uses target data, it is responsible for that processing. Contact us before supplying personal data that requires a separate controller–processor agreement or special arrangements.

2. Information we handle

Discord identity and trial verification: Discord user ID, display name and avatar obtained when you sign in. Our OAuth integration requests identity and permission to check your membership in the Rayon API Discord community for trial eligibility. It does not request your Discord email, messages or password. Access tokens used for membership checks are retained in private server-side Redis for at most one hour, or less if they expire sooner; refresh tokens are not retained.
Account and access: account state and role, creation and access dates, domain/product applications, declared use case and notes, decisions, and legacy organization memberships and invitations. A domain or note can reveal information about your work; include only necessary information.
Agreement records: the Terms and Privacy versions acknowledged, account identifier and acceptance time. Checkout separately records an express request for immediate service where required.
Credentials and sessions: API-key secret hashes, non-secret key prefixes, names and lifecycle dates; hashed session and OAuth-state identifiers with expiry. Newly created API keys are shown once; we do not retain readable copies of their secrets in the customer database.
Usage and security: account/key and request identifiers, target domain, generation result, timing, short error codes, usage totals, allowance and fund reservations, and administrative audit actions. The usage database does not retain full target query strings, generated telemetry values, document cookies or profile contents. Hosting and connection logs may process IP addresses, user agents and basic request or connection metadata separately.
Generation input: supplied script text, contextual URLs, browser profile, JavaScript-visible document cookies and exact intended request details are processed by private workers to generate headers. Uploaded material may be cached temporarily for reference reuse. The material-only service does not fetch target pages or make the subsequent target request. Your own material collection and HTTP client are separate processing activities. URLs, scripts, cookies and bodies can contain personal information: minimize them and do not send passwords, payment-card details or unnecessary sensitive data.
Derived processing material: successful inputs can be analysed to produce reusable native definitions. These can retain supported profiles/canvas and source, request or cookie constraints. Definitions are scoped to the key and material identity and are stored encrypted for reuse; this is separate from source-reference caching.
Failure diagnostics: for relevant failures after generation executes, private workers may automatically capture submitted or resolved script text, the effective browser profile and canvas, contextual URLs and request details, and exception evidence in a separate diagnostic store, not the usage database. We exclude or redact detected credentials, session values and sensitive body fields, but cannot guarantee that arbitrary supplied material contains no secrets. Capture is for fault diagnosis under the purposes and customer instructions described in this notice. Access is restricted to authorized engineers and a bounded encrypted capture-action history is kept; captures are not used to replay target requests or for marketing. Authentication, domain-access, credit, ordinary request-limit and schema rejections do not trigger capture.
Billing: Stripe customer, checkout, invoice, subscription and payment identifiers; billing/tax details needed for invoicing; USD amounts, paid periods, prepaid funds, reservations, settlements and refund/dispute records. Stripe receives payment-card details through hosted checkout; we do not store full card numbers or CVCs. Crypto payment support can involve a transaction reference, asset/network details, wallet address and agreed service credit. Public blockchain transactions are visible to others and cannot generally be erased from that blockchain.
Support and operations: information you choose to send through email or Discord, and limited service reports used by authorized operators. Operational reports can include Discord/account identifiers, request method, sanitized target URL/path, totals and short failure codes. Queries and sensitive path segments are removed, but a remaining path may still identify an integration. Discord retains messages independently of our request database.

3. Why we use information

We process account identity, authentication, permissions, generation requests and billing to provide and administer the service you request and perform our contract with you. If an organization is the contracting customer, managing its representatives and integrations is also supported by our legitimate interest in operating that customer relationship.

Our legitimate interests cover protecting accounts, detecting misuse and fraud, limiting abusive requests, maintaining service reliability, diagnosing faults, supporting users and keeping proportionate evidence of administrative decisions. We balance these purposes against individuals’ rights and limit the information collected. Payment and tax records may also be required by accounting, tax or other legal obligations; agreement and dispute records are kept where needed to establish or defend legal claims.

We do not sell personal information or use supplied material for advertising. The current site does not use advertising trackers or an optional marketing newsletter. If we introduce a purpose requiring consent, we will provide a separate choice before using information that way. Acknowledging this notice does not provide that consent.

Identity and relevant request information are needed to provide an account and API responses. Without required billing information we may be unable to process a purchase or invoice. Optional application notes and support details should be limited to what is necessary.

4. Who receives it

Authorized personnel access information only where needed for account review, support, security and operations. We use service providers for hosting, persistence, authentication, payments, secret management and communications:

Hetzner: hosts our API, private workers and account/usage storage.
Vercel: hosts the website, docs and dashboard, including the authenticated request proxy.
Discord: provides sign-in identity and our support/operations communications; Discord’s own policy also applies to its platform.
Stripe: provides hosted payments, invoicing and subscription management and acts under its applicable processing terms and privacy notice.
Doppler: manages server configuration and secrets; customer request material is not intentionally stored as configuration.
Email and infrastructure providers: deliver support messages and operational services where necessary.

We may disclose proportionate information to comply with law, address a credible security incident or legal claim, or facilitate a business transfer with appropriate privacy protections. We do not authorize providers to use customer request material for their own advertising.

5. Processing locations and transfers

Our infrastructure and providers may process information in the UK, the EEA, the United States and other locations used by their authorized subprocessors. A website being hosted in one region does not mean every provider processes data only in that region. Discord is based in the United States; Stripe and Vercel also operate internationally.

Where a transfer is restricted by UK data-protection law, applicable protections may include a UK adequacy regulation or contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, with the assessments required by law. Vercel’s applicable Pro data-processing terms and Stripe’s data-processing/transfer terms include UK contractual safeguards. We use the relevant provider agreements for the service involved, rather than treating use of a provider as consent to an unrestricted transfer. Ask support@rayonapi.com for information about a relevant transfer and a copy or explanation of its applicable safeguards, subject to appropriate redaction.

6. How long we keep it

Detailed generation history is retained for 30 days and aggregate hourly usage for 365 days, with periodic cleanup. Dashboard sessions expire after seven days and unused OAuth state after five minutes. Material references have a five-minute logical expiry; expired entries may be physically removed later during cleanup. This is not a promise that all operational copies disappear at the exact expiry second.

Derived processing material has a 30-day logical retention limit in the configured encrypted store and can be restored after worker restarts. Capacity limits, expiry or revocation can remove definitions earlier; cleanup of memory, files and in-flight copies may follow logical expiry. Expiry of a source reference does not delete retained derived material. Different contexts can require separate validated definitions.

Failure diagnostic captures are encrypted, expire automatically after 72 hours, may be deleted sooner, and are excluded from ordinary backups. Storage caps and deduplication may leave a capture unavailable or partial.

Account, domain-review, membership and key records are kept while needed to administer an active account. After closure we assess deletion or anonymization, retaining only records needed for unresolved billing, security, legal obligations or claims. Agreement versions, payment/accounting records and relevant dispute evidence are retained for the period needed to meet applicable accounting and tax record requirements or establish and defend legal claims. Relevant statutory periods and any unresolved claim determine the period; these records are reviewed separately on closure rather than automatically purged with request history. Service credit and payment records are separate from short-lived request history.

Support, audit, provider logs and operations messages are kept according to their purpose: resolving the issue, investigating an incident, maintaining a reliable audit trail or meeting a legal requirement. We review these records when handling closure or erasure requests and do not assume that deleting request history also deletes messages held by a communications provider. Report buffering expires after six hours in Redis; posted Discord messages have separate retention. Backups may temporarily retain deleted data until their normal rotation. Retained backup data is restricted to recovery; where restored, applicable deletions must be reapplied.

7. Cookies and security

The dashboard uses necessary session and OAuth-binding cookies to keep you signed in and protect the login flow. Production cookies use Secure, HttpOnly and SameSite protections. State-changing dashboard requests use origin and CSRF checks. Essential cookies are not advertising cookies; optional nonessential tracking would require its own applicable controls.

We use access controls, hashed credentials, transport security, revocable sessions and restricted private workers. Avoid including secrets in support messages or client logs. No system can promise absolute security; report suspected exposure to support@rayonapi.com promptly.

8. Your rights

Depending on the processing and applicable exceptions, you can request access, correction, erasure, restriction or a portable copy of personal information. You can revoke API keys in the dashboard and request account closure through support. We may ask for proportionate identity verification to protect your information. We respond within the applicable legal timeframe, normally one month; if an allowed extension is needed, we explain why.

Right to object: you may object to processing based on our legitimate interests for reasons relating to your situation. Contact support@rayonapi.com and identify the processing concerned. Where we rely on consent for a particular purpose, you may withdraw that consent without affecting earlier lawful processing. A request to erase information does not require deletion of records that must lawfully be retained; we explain any relevant exception.

You can complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint, or another supervisory authority with jurisdiction. You are welcome to contact us first, but are not required to do so.

9. Automated decisions and children

Configured rules may approve domain/product/use-case combinations automatically. Other applications are reviewed by the team, and you can ask for human review of a decision. These rules decide access to our platform; they do not determine your legal right to access a third-party website. We do not use this flow for decisions about creditworthiness or similarly significant personal profiling.

The service is for adults aged 18 or older. We do not knowingly provide accounts to children. Contact us if you believe a child has supplied information so we can assess access and appropriate deletion.

10. Changes

We publish a date and version for this notice and communicate material changes through the dashboard or an appropriate account channel. We may request a fresh acknowledgment. Any new purpose still requires an appropriate lawful basis; acceptance of a revised notice is not automatic consent to unrelated processing.