Rayana
Draft — pending counsel review. This document is a founder-prepared draft for review and is not the effective agreement. Bracketed items are unresolved, and nothing here is legal or investment advice.

Rayana — Privacy Policy (DRAFT)

STATUS: FOUNDER-PREPARED DRAFT FOR COUNSEL REVIEW. Companion to TERMS_OF_SERVICE.md; milestone 0.1 of SaaS-plan/SAAS_PLAN.md. This is not legal advice and is not effective until reviewed, redlined, and approved by qualified counsel, with bracketed placeholders resolved.

Design rules counsel should preserve: 1. Consistency with ToS §17 — the anonymized/aggregate data-license consent (Milestone 0.3) lives in the ToS; this policy describes the same processing so the future aggregate-data business (Phase 6.1) needs no re-consent. Keep the two aligned; do not narrow one without the other. 2. The firewall privacy fact is real and load-bearing — because of the publisher/adviser firewall (firewall/README.md), your personal account data is never sent to the AI models and never enters the advice engine. Section 6 states this plainly; it is both true and a differentiator. Do not let a redline dilute it into vague "we may share data with AI providers."

Last updated: [DATE] · Effective: [DATE]

This Privacy Policy explains how [RAYANA LEGAL ENTITY, LLC] ("Rayana," "we," "us") collects, uses, discloses, and protects information when you use the Rayana research website, applications, APIs, and related services (the "Service"). It is part of, and incorporated into, the Terms of Service ("Terms"); capitalized terms not defined here have the meaning given in the Terms.

By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

1. Scope and who we are

1.1 This Policy applies to information we process about visitors, Free-Tier users, and paid Subscribers of the Service.

1.2 The Service is operated from the United States and is intended for users in the United States. If you access it from elsewhere, you do so on your own initiative and are responsible for local-law compliance.

1.3 This Policy does not cover third-party websites, brokers, or services you may link to or use alongside Rayana; their privacy practices are their own.

2. Summary (not a substitute for the full Policy)

  • We collect account, billing, usage, search, and device information — most of it necessary to run the Service.
  • Payment-card details are handled by our processor (Stripe); Rayana does not store full card numbers.
  • We do not sell information that identifies you. We do create and may license aggregated and de-identified data and signals — including from search activity — as disclosed here and consented to in ToS §17.
  • Your personal account data is never sent to the AI models and never enters the advice engine (Section 6).
  • You have choices and rights, including access, deletion, correction, and opt-outs (Sections 10–11).

3. Information we collect

3.1 Information you provide

  • Account data — name, email, username, password (stored hashed), and account settings.
  • Billing data — subscription tier and billing history. Card/payment details are collected and processed by Stripe; we receive limited tokens/metadata (e.g., last four digits, brand, expiry, billing ZIP), not full card numbers.
  • Sandbox inputs — the hypothetical positions and parameters you enter into the descriptive Sandbox. These are user-entered hypotheticals, not your real brokerage holdings, and Rayana does not connect to your brokerage.
  • Communications — messages, support requests, survey responses, and feedback.
  • Newsletter — email address and subscription status (double opt-in).

3.2 Information collected automatically

  • Usage data — pages and features viewed, tickers viewed, search queries, clicks, session timing, and interactions. Search activity may contribute to Rayana's impersonal orca_search signal (Section 5.3 and ToS §17).
  • Device and log data — IP address, browser and device type, operating system, referring/exit pages, and timestamps.
  • Cookies and similar technologies — see Section 8.

3.3 Information from third parties

  • Payment processor — subscription and payment status from Stripe.
  • Analytics and infrastructure providers — aggregated performance and usage metrics.
  • Market and third-party Content feeding the engine is generally not personal information about you and is governed by the Terms, not this Policy.

We do not intentionally collect special-category or sensitive personal information, and we ask that you not submit it.

4. Sources of information

We obtain information (a) directly from you; (b) automatically from your use of the Service; and (c) from service providers acting on our behalf (payment, analytics, hosting, email).

5. How we use information

We use information to:

5.1 Provide and operate the Service — authenticate you, deliver Content, run the Sandbox, and maintain your account and subscription;

5.2 Process payments and manage subscriptions — via Stripe, including billing, renewals, and receipts;

5.3 Improve, analyze, and develop the Service — understand usage, debug, measure features, and improve models and Content quality. This includes using search and usage activity (which may feed the impersonal orca_search signal) to improve rankings and Content;

5.4 Create aggregated and de-identified data and signals — as consented to in ToS §17, we may aggregate and/or de-identify information and use it for any lawful purpose, including to create, derive, publish, license, or sell aggregated or anonymized data products, insights, and signals (Phase 6.1). Such data is aggregated and/or de-identified so that it does not identify you (Section 9);

5.5 Communicate with you — service and transactional messages, security alerts, and, where permitted, the newsletter and product updates (you can opt out of marketing at any time);

5.6 Secure the Service and prevent abuse — detect fraud, enforce rate limits and the Terms, and protect the Service and users;

5.7 Comply with law — meet legal, tax, and regulatory obligations and respond to lawful requests.

6. AI processing and the publisher/adviser firewall (important)

6.1 Parts of the Content are generated by automated and large-language-model ("AI") systems (for example, the AI ticker analyst and daily briefs). These are computed from impersonal market and engine data and served identically to all users.

6.2 Your personal data is not sent to the AI models. By architectural design (the publisher/adviser firewall), no user-specific state — including your identity, account, or Sandbox positions — is included in the prompts sent to AI providers, and no such state enters the advice engine. AI Output is impersonal and is not personalized to you.

6.3 As a result, our AI subprocessor(s) (currently Anthropic) receive impersonal Content-generation inputs, not your personal information. Where we use AI providers to process any account or support data in the future, we will update this Policy and do so under appropriate data-processing terms.

7. How we disclose information

We do not sell information that identifies you. We disclose information only as follows:

7.1 Service providers (processors) — vendors that process information on our behalf under contract and only for our purposes, including:

  • Stripe — payments and subscription billing;
  • [Cloud/hosting provider] — hosting and storage;
  • [Analytics provider] — usage analytics;
  • [Email provider] — transactional email and newsletter;
  • Anthropic — AI Content generation (impersonal inputs only; see Section 6).

7.2 Aggregated / de-identified data — we may disclose or license data that has been aggregated and/or de-identified and does not identify you (Sections 5.4 and 9).

7.3 Legal and safety — to comply with law, enforce the Terms, or protect the rights, safety, and property of Rayana, our users, or the public.

7.4 Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7.5 With your direction or consent — where you ask us to share information.

8. Cookies and tracking

8.1 We use cookies and similar technologies for essential functions (authentication, security, preferences) and for analytics to understand and improve usage.

8.2 The Service is subscription-first and not ad-funded; any newsletter sponsorship is contextual and not based on tracking you across other sites. We do not engage in cross-context behavioral advertising [confirm].

8.3 You can control cookies through your browser and, where offered, our cookie settings. Blocking essential cookies may break parts of the Service.

9. De-identified and aggregated data

Where this Policy or the Terms refer to aggregated or de-identified data, we maintain and use such data in a form that does not identify, and cannot reasonably be used to identify, you. We commit not to attempt to re-identify it except to test our de-identification, and we require recipients of any such data to do the same. This is the data used for the aggregate-data product (ToS §17; Phase 6.1).

10. Data retention

We retain information for as long as your account is active and as needed to provide the Service, then for the period required to comply with legal, tax, accounting, and dispute-resolution obligations, after which we delete or de-identify it. Aggregated and de-identified data may be retained and used indefinitely, as it no longer identifies you (Section 9; ToS §17.3).

11. Your choices and rights

11.1 Account — you can access and update most account information in your settings, and cancel your subscription at any time (Terms §12.4).

11.2 Marketing — you can unsubscribe from the newsletter and marketing email via the unsubscribe link or your settings. We will still send necessary service messages.

11.3 Cookies — see Section 8.

11.4 State privacy rights (US). Depending on your state of residence (e.g., California, and other states with comprehensive privacy laws), you may have rights to: know/access, delete, correct, obtain a portable copy, and opt out of the "sale" or "sharing" of personal information and of targeted advertising, and to be free from discrimination for exercising these rights.

  • Sale/sharing. Rayana does not sell personal information that identifies you and does not use it for cross-context behavioral advertising [confirm]. To the extent any processing is deemed a "sale" or "share," you may opt out at [opt-out link / "Do Not Sell or Share My Personal Information"].
  • Exercising rights. Submit a request at [[email protected]] or [link]. We will verify your identity and respond within the legally required timeframe. You may use an authorized agent where permitted.

11.5 GDPR/UK (if applicable). If EU/UK users are in scope, you may also have rights of access, rectification, erasure, restriction, portability, objection, and to withdraw consent and lodge a complaint with a supervisory authority.

12. Security

We use reasonable administrative, technical, and organizational measures designed to protect information (including encryption in transit, hashed passwords, access controls, and use of reputable processors). No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your credentials and notify us of any suspected compromise (Terms §3.4).

13. Children's privacy

The Service is not directed to children. You must be at least 18 to use it (Terms §3.1), and we do not knowingly collect personal information from anyone under 18 (or under 13 in any event). If you believe a child provided us information, contact us and we will delete it.

14. Financial-data note

Rayana is a publisher and does not open or manage brokerage accounts, hold customer funds, or provide personalized financial services on the Service (Terms §5). We believe the Gramm-Leach-Bliley Act's financial-privacy rules generally do not apply to this publishing activity, but we handle billing data carefully regardless.

15. Changes to this Policy

We may update this Policy. We will post the updated version with a new "Last updated" date and, for material changes, provide reasonable notice (e.g., email or in-Service notice). Continued use after the effective date constitutes acknowledgment.

16. Contact

Questions or privacy requests: [[email protected]] / [mailing address]. For a data-rights request, use [[email protected]] or [link].

Companion documents: TERMS_OF_SERVICE.md (esp. §17 data license, §5–6 publisher/firewall posture) and the display-surface disclaimer copy (0.1). Architectural counterpart: firewall/README.md. See SAAS_PLAN.md §0 and Phase 0.

← Back to Rayana