Privacy Policy

1. Who we are

Rayll is a service that lets a business pay its creators and contractors in USDC from a vault the business itself controls. It is available at rayll.io and through its API.

In this policy, "Rayll", "we" and "us" mean the operator of the service. You can reach us at support@rayll.io.

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what you can do about it. We wrote it to be read, not skimmed. If something is unclear, write to us.

2. Who this policy covers

Three kinds of people interact with Rayll, and we collect different things from each:

• Account holders: the people who open a Rayll account for an agency, platform or other business (we call that business the "Client") and use the dashboard or the API.
• Recipients: the creators and contractors a Client pays through Rayll. Recipients never open an account. They receive a link from us, confirm their email with a code, and tell us where they want to be paid.
• Visitors: anyone who browses rayll.io, joins the waitlist or books a call.

For account holders and visitors, we decide why and how data is used, so we are the "controller" in the sense of the GDPR. For Recipients, the Client decides who gets paid and gives us their details; we process that data on the Client's instructions, as its "processor", except for what we must do ourselves to keep the service secure, where we act as controller.

3. What we collect

3.1 From account holders

• Account: your name, your email address, and the name and contact email of your business. We sign you in with a one-time link sent to your email. There is no password.
• Sessions: when you sign in, we record the IP address and browser (user agent) of the session, so we can show you where you are signed in and detect misuse. Sessions expire after at most seven days of inactivity and when you sign out.
• Vault and passkeys: your vault is a smart-contract account on the Polygon network. Its signing key is generated and stored inside a secure enclave run by Turnkey, and can only be used with a passkey you register (Face ID, Touch ID, Windows Hello or a security key). We store the public part of that passkey credential, the identifier of your Turnkey organisation, your vault's address and the addresses of its owners. We never hold a credential that could sign for you.
• Batches and payouts: the batches you prepare: recipient references, amounts, the checks and simulation results, the transaction you signed, and the resulting on-chain reference and receipts.
• API keys and webhooks: if you use the API, we store a hash of each key (never the key itself), when it was last used, the URLs of your webhook endpoints and their signing secrets, and every event we delivered to them. For thirty days, we also keep the request and response of each idempotent API call so a retried request returns the same answer.

3.2 From Recipients

• What the Client gives us: your name or display name, your email address, and an identifier the Client uses for you in its own systems.
• What you give us: the payout address and network you enter through your personal link, and any later change to it.
• Verification: before you can enter an address, we email you a six-digit code. We store a hash of that code, the number of attempts, and when it expires (ten minutes). We never store the code itself.
• Security signals: whether the address you entered had already transacted on-chain before we saw it (a new, empty wallet is flagged to the Client at signing time), and, when you change your address, the previous and pending addresses during the 48-hour hold that precedes any change.
• Receipts: for each payment, a receipt showing who paid, who was paid, the address, the amount, the network, the date and the transaction reference.

3.3 From visitors

• Analytics: we use PostHog to count page views and time on page. We do not record clicks, keystrokes or form contents (autocapture is off), and we do not build a profile of you unless you are signed in. Any link that carries a private token (a Recipient link, an address-change link, a receipt link) is stripped of that token before it reaches PostHog.
• Errors: when something breaks, Sentry receives a technical error report: the page or route, the error and its stack trace, your browser and operating system. We have turned off the collection of request headers and cookies, and private tokens are stripped from URLs here too.
• Waitlist: if you join the waitlist, your email address and, if you give it, your name.
• Booking a call: calls are booked through Cal.com. What you enter there is handled by Cal.com under its own privacy policy; we receive your name, email and the time you chose.

3.4 What is public, by design

Every payment Rayll prepares is settled on the Polygon blockchain. A blockchain is a public, permanent ledger: the vault's address, each recipient's address, each amount and each transaction reference are visible to anyone, forever, and cannot be edited or deleted by us or by anyone else. No name or email address is ever written on-chain.

Receipts are reachable at a non-guessable link. Anyone who has the link can see what the receipt shows, and nothing more: no balances, no other payments, no contact details.

4. Why we use it, and on what legal basis

We do not sell personal data. We do not use it for advertising. We do not make automated decisions with legal effects about you.

5. Who we share it with

We use a small number of providers to run Rayll. Each one only receives what it needs for its job, under a contract that binds it to process the data on our instructions.

Beyond these providers, we share personal data only when the law requires it (a court order, a lawful request from an authority), to protect the rights and safety of Rayll, its Clients or Recipients, or, if Rayll is ever sold or merged, with the acquirer, who will be bound by this policy.

We never share Recipient contact details with anyone other than the Client that provided them.

6. Where the data lives

Our database and hosting are in the United States, and most of our providers are established there. If you are in the European Economic Area, the United Kingdom or Switzerland, your data therefore leaves your region. We rely on the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) with each provider, and on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguards that apply to you.

7. How long we keep it

When a Client asks us to delete its account, we delete the account, its Recipients and their contact details, its API keys and webhook configuration. We keep the payout history, receipts and the amounts paid, without names or emails, for as long as the law requires payment records to be kept.

8. Your rights

Whoever you are and wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it;
• delete it;
• give it to you in a machine-readable format;
• stop using it for a given purpose.

Write to support@rayll.io from the email address we know you by. We answer within thirty days. We may ask you to confirm your identity, and we will tell you plainly if we cannot do something (for example, we cannot erase a transaction from a blockchain) and why.

If you are a Recipient, the quickest route for a correction or deletion is often the Client that pays you, since it owns the relationship. You can also write to us directly; if the request concerns data we hold for the Client, we will pass it on and tell you we did.

If you are in the European Economic Area, the United Kingdom or Switzerland, you additionally have the right to restrict processing, to object to processing based on our legitimate interests, to withdraw a consent you gave (this does not affect what was done before), and to complain to your data protection authority. In France that is the CNIL (cnil.fr).

If you are a California resident, you have the right to know what personal information we collect and how we use and share it, to have it deleted, to correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.

9. How we protect it

• We never hold your funds and never hold a credential that could move them. The signing key lives inside Turnkey's secure enclave and only your passkey can use it.
• Every secret we mail (sign-in links, Recipient links, verification codes, address-change cancellation links) is stored as a hash. If our database were copied, the copies would be useless.
• API keys are stored as hashes. Webhook deliveries are signed so your systems can verify they came from us.
• Any address change waits 48 hours, during which both the Recipient and the Client are alerted and can cancel it.
• All traffic is encrypted in transit. Access to production systems is limited to the people who run the service.
• Private tokens are stripped from URLs before anything reaches our analytics or error-reporting tools.

No system is perfectly secure. If we ever learn of a breach that affects you, we will tell you and the relevant authority as the law requires.

10. Cookies

We use as few as the service allows:

Strictly necessary cookies cannot be turned off without breaking sign-in. You can block analytics cookies in your browser; doing so changes nothing about how the service works for you.

11. Children

Rayll is a business tool and is not intended for anyone under eighteen. We do not knowingly collect data from minors. If a Client gives us the details of a person under eighteen, we will delete them as soon as we learn of it.

12. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects what we collect or how we use it, we email account holders before it takes effect and, where Recipients are affected, tell the Clients so they can inform them.

13. Contact

For anything about your personal data: support@rayll.io.